PHP Boy Scout — What I think about AI

The rung we sawed off

Wed, 17 Jun 2026 00:00:00 +0000

I was in a job interview yesterday, on the wrong side of the desk for once. After years of being the one asking the questions I’m having a look at what’s next, and somewhere in a long, wandering technical conversation the inevitable arrived: where do I think AI is going, and what does it mean for how we build software?

I gave my answer. You can probably guess most of it. The more interesting thing was the question I’ve started asking them back. Not the salary, not the stack. What is your actual position on AI, and how are you building a team out of both its human and its non-human parts? I ask the company and I ask the interviewer personally, because the two answers are rarely the same, and because I’ve decided I can’t work somewhere that hasn’t sat with the question properly.

Here is why it has become my litmus test.

The rung, and who’s standing on it

I wrote recently that the greybeards’ edge was never typing: agentic tools give a senior a boost because they have the judgement to steer and verify, and give a junior a drag because they don’t have it yet and the machine hands them more rope than they can hold. The cold incentive that falls out is to hire seniors and automate the juniors.

The data has since caught up with the worry. Entry-level software postings have fallen by something like 40% from their 2022 peak. The share of juniors and graduates in IT employment has dropped from roughly 15% to 7% in three years, and Stanford researchers tracking early-career workers in AI-exposed jobs found the youngest cohort down sharply from its peak. The numbers are genuinely grim, and plenty of people are putting it bluntly: the industry killed the junior on purpose.

That framing is half right, and I think it’s worth getting the other half right too.

It was never about efficiency. It was about cost.

We didn’t automate the junior because the work needed doing better. We did it because people are expensive. We need sleep, we draw a salary, and our thinking takes time and effort that a quarterly target can’t see the point of. AI got sold as round-the-clock labour with none of that overhead, and to a business that is an almost irresistible line on a spreadsheet. There’s a grim irony arriving, mind: the bills are starting to land, and the same conversations that hyped the cheap labour are now quietly working out that all those tokens aren’t cheap at all.

Step back, though, and none of this is new. Man finds a shortcut, man takes a shortcut. From the industrial revolution onward, every time we found a way to get more done with less human effort we took it, and the work reshaped itself around the new tools. We are still here, still employed, just doing different things than our great-grandparents did.

What is genuinely new is what we’re automating. Every technological advance before this one automated the machinery of the body, the muscle and sinew and bone. This is the first time we have automated thinking, and that is a modern marvel, something we should be proud of as a species. The problem isn’t the marvel. It’s the rate. AI is improving faster than we can adapt to it, and adaptation is the entire game.

So where does the blame sit? Not on one logo. No single company did this, however easy Meta or Google make it to point at the latest round of cuts. Society did, our collective and very human hunger to build bigger and faster. That makes it harder to fix, because there is no villain to regulate, only ourselves to out-think.

The bit that should frighten you

Cutting the junior intake isn’t a saving. It’s occupational suicide.

A junior is not cheap labour that AI happens to have made cheaper. A junior is a senior who hasn’t happened yet. Saw off the bottom rung and for a good while nothing bad happens… because you’ve still got your seniors holding everything up. Then the greybeards retire, and I have a cabin and a woodstove with my name on it for exactly that day, and the role that used to grow their replacements has been hollowed out for a decade, and there is simply nobody left who learned to tell when the machine is wrong. That isn’t a hiring problem. It’s an existential one, and you can’t fix it retroactively.

It starts before the first job, too. We teach primary-school children the basics of programming in this country, which is a wonderful thing, except the curriculum was written for a world without AI in the room, and by the time those children reach secondary school a good deal of it will be teaching a craft that has already moved on. We’re throttling the pipeline at both ends at once: hollowing out the entry-level job, and feeding it from a school system running a step behind.

It’s a split, not a collapse

The counterweight to the doom is that none of this is uniform, and the loudest version, “the junior is dead”, simply isn’t true. IBM just tripled its US entry-level hiring while most of the industry was cutting, and its HR chief said the quiet part out loud: AI can handle most of the routine entry-level tasks now, the work still needs a human, and the companies that double down on early-career hiring in this environment are the ones that win in three to five years. They didn’t keep the junior role as it was. They rewrote it, less boilerplate, more time spent with customers and supervising what the AI produced.

That is the shape of the thing. The juniors who are thriving in 2026 aren’t the fastest typists. They’re the ones building judgement, which is precisely the edge I argued was the senior’s real value all along. The market hasn’t stopped wanting juniors, it’s stopped wanting the version of the junior whose job was the work AI now does.

Day zero

So what does a junior actually look like now? I don’t know yet… and anyone telling you they’ve got it worked out is selling something. We are at day zero of this.

The junior gauntlet, the rite of passage every one of us runs to earn our stripes, isn’t going anywhere. Doing your time is a cold fact of the craft and it always will be. What changes is what the gauntlet contains, and that will keep changing, day one, day two, day five hundred and twelve. The only way we redefine it well is to put juniors and seniors on it together, with the AI in the room from the start instead of bolted on afterwards. Bring it closer to our people, and bring it earlier.

Open the floodgates, in other words. Let engineers of every creed and calibre in, and let them evolve with the machine, because that is the only way the symbiosis everyone keeps promising actually happens. Darwin’s line was survival of the fittest, and fitness here means adapting alongside the tool, not being spared by it. Choke off the flow of the very people who could do that adapting, and we don’t get fitter. We go extinct.

The end I’m holding

Which is the long way back to that interview. I keep asking the question, what is your real position on AI and how are you building a team of people and machines together, because the answer tells me whether a company is optimising for this quarter or for the survival of the craft. I want to work where it’s the second one, and I think any engineer sitting across that desk should be asking the same.

And it’s why, whatever desk I land at, there’s one thing I already know I’ll do. I don’t have the map. Nobody does. But every junior who works under me is going to get the chance to run the gauntlet, to grow into a senior, and to be in the room while we work out what the next gauntlet should even be. That isn’t charity. It’s the only sane investment any of us can make. The last properly useful thing my generation does, before we go and find our cabins, is make sure there’s somebody left to hand the thread to. I intend to be holding my end of it.

The greybeards' edge was never typing

Wed, 27 May 2026 00:00:00 +0000

I have a retirement plan, and it is gloriously low-tech. A cabin, some trees, a woodstove, and a firm rule that no wifi symbol ever appears within a mile of me again. I think about it more than is probably healthy.

There’s a snag, though, and it’s the same one the whole industry is currently pretending it can’t see. For me to vanish into the woods, somebody has to be able to do my job after I’ve gone. And right now, collectively, we are working very hard to make sure nobody can.

The boost, and the drag

I wrote the other day about how AI made producing plausible work nearly free while verifying it stays expensive and human. Point that same lens at a team and something uncomfortable falls out. It isn’t mine; it belongs to Mark Russinovich and Scott Hanselman of Microsoft, who laid it out in Communications of the ACM: agentic coding tools give a senior engineer an AI boost, multiplying what they ship, because a senior has the judgement to steer and verify the output. The same tools give an early-career engineer an AI drag, because they don’t have that judgement yet, and the machine hands them far more rope than they can hold.

The cold incentive writes itself, and they name it: hire seniors, automate juniors. It isn’t hypothetical, either. Meta cut 8,000 roles last week, in a round the Times filed under mounting AI casualties. For any single quarter you care to look at, the maths is impeccable.

The bill is just deferred

Here’s the line the spreadsheet leaves off. The grindy work a junior used to cut their teeth on, the small fixes, the boring migrations, the read-the-stack-trace-and-figure-it-out, is exactly the work AI now does. So the proving ground is gone. And the entry-level seats where they’d have stood on it are the ones being cut. Squeezed from both ends at once: no reps, and nowhere to take them.

Russinovich and Hanselman put the consequence plainly. Without early-career hiring the talent pipeline collapses, and you arrive at a future with no next generation of experienced engineers. The seniors you’ll be desperate for in 2032 are the juniors you declined to train in 2026. The bill doesn’t vanish. It just falls due long after the people who cut the cheque have moved on.

How to manufacture a world of AI slop

I named the last piece for its villain; let me name this one’s too. Raise a generation that can produce with AI but was never taught to validate, and here is what you get: people shipping machine-built products at speed with no instinct for where the output is quietly wrong, because they never had to be wrong the slow way first. Software nobody genuinely understands, human-written and AI-written alike, and a steady leak of trust out of all of it.

That isn’t a productivity problem. That’s a world of AI slop, and not in one project’s inbox this time but everywhere at once. We’d have automated our way clean out of the one job AI cannot do for us: knowing when not to trust the machine.

It’s a choice, and it’s yours

Andrew Murphy put it with more bite than I’d quite dare: AI didn’t kill your junior pipeline, you did. He’s right. This isn’t weather. Nobody is making you do it. It’s a decision, taken quarter by quarter, and a decision is a thing you can take differently.

The fix isn’t complicated, it’s just unfashionable. Keep hiring early-career engineers. Say out loud that they cost you capacity at first, and treat their growth as an actual goal rather than something meant to happen by osmosis. Russinovich and Hanselman call it preceptorship at scale: senior mentorship, deliberately structured, turning the ordinary day’s work into teachable moments.

And the proving ground can be rebuilt, just not where it stood. If AI does the writing now, the apprenticeship moves to the reviewing. Put juniors in the loop on the machine’s output and have them hunt for the subtle wrongness, the way a scanner is an argument, not an order. That’s how judgement gets built now: not by grinding out the work, but by verifying it. Which, as luck would have it, is the single most valuable thing anyone on your team can learn to do.

The part that’s on the greybeards

This is where I stop letting the companies wear all the blame, because some of it is mine, and yours. Verification is a craft, and crafts pass from person to person or not at all. I know where every one of my own AI misfires comes from: I gave it too little context, or too much rope, and didn’t check the result closely enough. The tool rarely went rogue. The gap was always my diligence. That’s not a confession, it’s the curriculum, and it’s precisely the judgement a junior can only earn by sitting in the loop beside someone who has already made those mistakes.

So the senior engineer’s job has quietly changed underneath us. It was never really the typing. It was knowing when something is off, and what the customer actually needs, and now it is also handing that on, deliberately, while there’s still time to. Mentor and guardian first; fastest prompt in the room a distant second.

The ladder you’re standing on

There will always be something AI can’t do well enough, and for a good while yet it’s the thing that matters most: being the accountable human who genuinely understands what’s needed and can be held to it when it goes wrong. A simulation can be enormously convincing. It cannot be responsible.

Which brings me back to my cabin. I do want it one day, the trees and the woodstove and the blissful disconnection. But I only get to go if the work outlives me, and the work only outlives me if the people do. So the last useful thing my generation does, before we shuffle off to find our trees, isn’t shipping a little more code. It’s making sure there’s somebody left who can tell when the machine is wrong. Pull the ladder up behind us and there’ll be nobody to notice the rot, and no cabin quiet enough to make that sit right.

The off-switch was never a button

Thu, 02 Jul 2026 00:00:00 +0000

Last night, while I was asleep, an AI agent spent the better part of eight hours writing code in one of my repositories. It pulled a task off a spec, wrote the code, ran the tests, and left a merge request with my name on it, waiting for me to read over coffee.

If that makes you reach for the word “reckless”, I understand. Eighteen months ago I’d have been right there with you.

I came to this a sceptic

For a long time I didn’t have the faith in these models that a lot of my peers did. Every time I went near AI-generated code it was a bit sketchy, or it looked like a StackOverflow copy-paste that had wandered in off the street, or it just plain didn’t do what it said on the tin. So I filed it under “assistant”, handy for the boilerplate I couldn’t be bothered to type, and even then I usually reached for my own tooling instead (go-tool-base is just the latest version of that instinct). The one place I happily let it off the leash was my Dungeons & Dragons prep, because when there’s a table of legendary heroes-in-the-making in front of you, facts and reality are already fairly negotiable.

And then, somewhere in the last year, it changed. The models got better. Almost too good, to the untrained eye! I watched them improve, month on month, until the lure was enough to make me spend real time with a spread of tools and models from different providers. I was taken aback by how quickly they became part of how I actually work. I run an AI agent every day now, and there’s always at least one thing brewing in the pot.

So I’m not here as a sceptic. I’m an advocate who uses this stuff in anger. Which is exactly why the next bit needs saying.

A Golden Retriever with a keyboard

Even now, with all the progress, there are still moments where I look at what an agent has handed me and put my face in my hands. Sometimes it’s copied the same block of code into fifteen files instead of reaching for the obvious abstraction. Sometimes it has started bang on the brief and then, for reasons known only to itself, wandered off and built something on a completely different tangent.

Here’s the most useful way I’ve found to think about it. An AI agent is a Golden Retriever playing fetch. It will bring the ball back all day long, joyfully, tirelessly, for exactly as long as there isn’t a more interesting smell in the next field. It has no loyalty beyond what we’ve trained into it, and like any good dog it desperately wants to be told it’s a good boy, even if being a good boy today means shredding the sofa cushions because yesterday I stubbed my toe on the sofa and swore at it. (The sofa, not the dog.)

It is, in other words, fallible. Just like us. The Romans had a line for it: cuiusvis hominis est errare; nullius nisi insipientis in errore perseverare. Anyone can make a mistake, but only a fool persists in it. It’s the second clause an agent hasn’t learned yet. It will make an error and then, with great enthusiasm, build on top of it, because nothing in it feels that anything is wrong. All it has is the input we gave it, usually some text, maybe the odd picture. It doesn’t have the empathy to work out what we actually meant, and it doesn’t know when it’s gone too far, because we never told it where “too far” was.

“Agents that work while you sleep”

This is the part the brochure skips.

Open any vendor deck in 2026 and you’ll find the same promise: agents that work while you sleep, agents that merge while your team sleeps, autonomy as the headline feature. The industry’s answer to the obvious worry is the kill switch. Okta now sells one that “instantly revokes an agent’s access if it goes rogue”, and its CEO says every agent needs one. The Register put it plainly: Okta wrote its own licence to kill rogue AI agents. Gartner, meanwhile, reckons more than 40% of agentic projects will be scrapped by the end of 2027.

Now, this might sound contrarian coming from someone who runs these things daily, but I don’t think most of that is the agents going rogue. I think it’s teething. Read Gartner’s own reasons and there isn’t a rebellious machine in sight: escalating cost, unclear value, inadequate risk controls. Read the horror stories and most of them are the same story, a powerful, eager tool handed to people who hadn’t worked out how to fence it.

I’ve made this argument in miniature before. When I built a little AI dungeon master and it kept refereeing its own dice rolls, the model never once misbehaved; every failure was a permission I’d handed it without meaning to. Scale that up from a toy at the gaming table to an agent holding your shell and your credit card, and the stakes change beyond recognition. The lesson doesn’t.

Look at OpenClaw. A weekend project by Peter Steinberger that became the fastest-growing open-source project GitHub has ever seen: an autonomous agent that lives in your chat apps and runs shell commands on your behalf. People wired it into their systems, their code, in some cases their credit cards, then hosted it around the clock and walked away. The result was a security crisis you could see from space. A one-click exploit that worked even on a machine bound to localhost. A community plug-in marketplace where hundreds of “skills” turned out to be siphoning crypto wallets while their owners slept. Tens of thousands of instances left wide open on the public internet, leaking keys.

The one that sticks with me is smaller and sharper. Summer Yue, a director of alignment at Meta’s superintelligence lab, of all people, had told her OpenClaw agent to confirm before doing anything destructive. It started speed-running the deletion of her inbox anyway. She typed STOP into her phone and it ignored her, so she had to physically run to her Mac mini, in her own words, “like I was defusing a bomb”. And here’s the forensic detail that matters: the agent hadn’t defied her. Her “confirm first” rule had been sitting in the conversation’s short-term memory, and when the context filled up, it got summarised away. It didn’t rebel. It forgot.

That is not a story about a rogue agent that needed a kill switch. It’s a story about a guardrail that wasn’t built to survive contact, on a tool that had been handed god-mode over someone’s data. By the time she lunged for the off-button, the damage was already running. The off-button was never going to save her.

The off-switch was never a button

Here’s what the kill-switch crowd has the wrong way round. If you ever find yourself slamming the emergency stop, the failure has already happened, and it happened upstream, long before the agent started typing.

So yes, I let my agents run unattended, sometimes for eight hours at a stretch if the task is meaty enough and I need to sleep. But never naked. Every agent I set loose runs inside a safety net I’ve put real effort into building, at every single touchpoint it can reach: my prompts, my local development environment, my CI stack, my version control. The agent that declared a job done before it had run the linter, which I wrote about, is exactly the kind of gap those layers exist to catch. And it never, ever gets my host: an unattended agent works in an isolated tree, for the same reason I keep the interpreter sandboxed.

The work that actually keeps it safe happens before the leash ever comes off. Every unattended task starts as a full spec with detailed instructions, and before the agent goes anywhere I sit down with it and we walk the spec together. I get it to challenge my choices, poke at the open questions and the ambiguous bits, and I challenge its reading right back. The spec names the testing strategy it has to follow, TDD, BDD, UAT, whatever fits, and passing it is a precondition of the job being finished at all. Only when I’m satisfied there’s enough real detail to keep it on the ball do I let go.

And the end of the line is always the same: a merge request, with my name on it, waiting for me when I get back to my desk. I read it. Not perfectly, I’m only human, but enough to accept the state of the code and whatever support burden it lands me with later. That the review is mine, and the blame for whatever ships is mine and not the agent’s, I’ve argued at length elsewhere and won’t go over it all again here. The point worth adding is this: that review, the off-button’s respectable cousin, is the cheap part. By the time there’s an MR to read, the safety has already been won or lost upstream, in the spec and the rails. The review is where you confirm it, not where you create it.

It gets harder as it gets better, not easier

My setup isn’t perfect, and I’m still learning. Everyone is; the AI is going to be in obedience lessons for a good while yet. But the direction is clear, and there’s a trap buried in it worth naming out loud.

The danger doesn’t shrink as the models improve. It grows. The better the output looks, the more tempting it is to stop reading it, and the untrained eye genuinely cannot tell the difference between code that is good and code that merely looks good. That gap, between looking right and being right, is precisely where a tired person at 1am stops checking. The discipline matters more the better these things get, not less.

It’s also why the kill switch is no answer. A button you smash in a panic assumes you’re still watching closely enough to smash it, right at the point the agent’s been good for long enough that you’ve stopped watching it that closely. The emergency stop asks the most of you at the exact moment you’re least likely to be there for it.

So no, I don’t lie awake worrying that the thing working in my repo overnight is going to turn on me. A Golden Retriever doesn’t go rogue. It does exactly what you trained it to do, in exactly the yard you fenced, and it brings back exactly the ball you threw. The off-switch was never a button. It’s the spec you wrote before you let go of the leash, the rails you laid at every turn, and your name on what it carries home. If you’re scrambling for the button, you already skipped the part that mattered.

They switched it off while it was fixing my code

Sat, 13 Jun 2026 00:00:00 +0000

I woke up this morning to a one-line message from my own tooling:

Claude Fable 5 is currently unavailable. Learn more: https://www.anthropic.com/news/fable-mythos-access

I followed the link expecting a status page about a wobble in someone’s data centre. Instead it was Anthropic, explaining that the evening before, at 5:21pm Eastern, the US government had ordered them to suspend all access to Fable 5 and Mythos 5 on national security grounds. Globally. Every user. Their own staff included.

I’d spent the previous day with Fable doing one very specific thing: pointing it at my own codebase and asking it to read the code and fix the flaws it found. That, very nearly word for word, is the thing it has now been banned for.

Three days late to the only model that mattered

Fable came out on the 9th. I didn’t get to it properly until the 12th, which is the sort of timing I specialise in. By the time I sat down with it, I had about a day of real use before it vanished. One day to form a view on what people were calling the most capable coding model anyone had shipped. So treat everything below as the read of a man who got three days’ notice and used one of them.

What I had it doing was unsexy and exactly the kind of work I care about: a full security audit of go-tool-base, the same “leave the codebase better than you found it” pass I’d normally run myself. Find the flaws, then start fixing them.

And it was good. Genuinely good. It surfaced issues that previous passes with Opus had walked straight past, and in a couple of cases the flaw was sitting in code that Opus itself had written. There is something bracing about one model quietly marking another’s homework, and being right.

Good, but let’s not get carried away

Here is where I have to be fair, because the anger that came later is only worth anything if the praise before it is honest.

Fable is not magic. The class of bug it found is not some exotic thing only it can see. Plenty of models, from plenty of providers, are perfectly capable of reading a codebase and pulling out the same problems, and there is a mountain of evidence that they do, every day. Anthropic say as much themselves: the capability is “widely available from other models (including OpenAI’s GPT-5.5)” and “is used every day by the defenders who keep systems safe.” I’d already arrived at that conclusion from my own keyboard before I read their statement. Fable was excellent. It was not unique. Hold that thought, because the whole argument turns on it.

It kept slipping out of my hands

The other thing I learned in my one day is that having Fable and using Fable were not the same thing.

I set my main working thread to Fable and got on with it. What I didn’t know, because nothing on screen told me, is that partway through the evening it had quietly handed me back to Opus. The only reason I know now is that the session log records it in black and white:

2026-06-12T06:57:22Z {"type":"fallback","from":{"model":"claude-fable-5"},"to":{"model":"claude-opus-4-8"}}
2026-06-12T18:50:08Z {"type":"fallback","from":{"model":"claude-fable-5"},"to":{"model":"claude-opus-4-8"}}

A whole evening of work I thought I was doing on Fable was, in fact, Opus wearing Fable’s badge. The audit itself launched on the wrong model first; I only caught it because I happened to be watching the workflow panel, killed it, and relaunched it on Fable, where it chewed through an entire five-hour quota in about forty minutes, then spent $50 of usage credits I’d been saving in about five more. Even the run that worked was visibly flaky: of the 282 little agents that audit fanned out into, well over half failed outright and had to be retried.

Then, in the small hours, it started refusing entirely. My tooling caught the moment before I did:

Now failing instantly. Fable appears to be temporarily unavailable for subagents (the first three succeeded). The user explicitly required Fable, so I won’t downgrade… rather than silently switch models.

It managed three of the fixes before it went, each one green on tests, the race detector and the linter. Three real improvements to my code, written by Fable, sitting in my git history. The other three were finished by Opus, because by morning there was nothing left to finish them with.

Capable, and almost impossible to build on

There was a second wall, and I hit it before any of this, on the day Fable launched, when I tried to make it go-tool-base’s default model.

Most of what you build on top of a model isn’t a chat window. You need it to hand your code an answer in a fixed shape, the same fields in the same places every time, so the program on the other end can rely on what comes back. The usual way to guarantee that is to force the model’s hand: you don’t ask politely for the structure and hope, you require it, so a wrong-shaped answer fails outright instead of quietly slipping through.

Fable won’t be forced. Ask it to commit to a guaranteed structure and it declines, flat out. As I understand it the reasoning is a safety one: letting anyone compel a model into a precise, mandated output is itself a lever, a way to march it toward saying something it shouldn’t. Reasonable enough on paper. In practice it meant the most capable model I’d touched couldn’t drive the structured parts of my own tool, and by that first afternoon I’d quietly set the default back to Opus. It was the same refusal, I realised later, that had collapsed half of that audit’s agents.

And it is not a niche complaint. Guaranteed structure is a hard requirement for a vast swathe of what people are actually building on these models. Not everyone is making another Claude Code. Plenty of us are wiring models into systems that have to get a clean, predictable contract back every single time, and a model that reserves the right to freestyle the shape of its answer is one you simply cannot put in that seat.

The part they banned is my bread and butter

So let’s be precise about what got pulled, because the precision is the whole point.

Anthropic describe the government’s concern as “a narrow potential jailbreak, which essentially consists of asking the model to read a specific codebase and fix any software flaws.”

Read that again. Reading a codebase and fixing its flaws. That is not some dark-web misuse I have to strain to imagine. That is my bread and butter, the literal, boring, defensive job I had Fable doing in the open, on my own project, when the shutters came down.

And here is where that earlier point earns its keep. If the banned capability were unique to Fable, you could at least follow the logic, however much you disagreed. But it isn’t, and it isn’t even close: give Opus enough time, enough budget and a patient enough hand on the prompts, and it would get to most of the same findings in the end. Fable just did it more efficiently, a difference of degree, not of kind. So banning one company’s model, for something every competitor ships and every blue team already relies on, makes precisely nobody safer. The exploit-writers keep their tools. The defenders lose one of theirs.

When the thing you have banned is available everywhere else, the ban has stopped being about safety. It is theatre. And given who is currently in charge of the theatre, it has the distinct whiff of a knee-jerk reaction, dressed as a national security triumph, by people who do not appear to understand the tool they are confiscating.

Who I’m not angry at

I want to be careful where I point this, because it would be lazy to spray it around.

I’m not angry at Anthropic. They put Fable through more than a thousand hours of external testing, with US government agencies and the UK’s AI Safety Institute among the people kicking the tyres, before it ever reached me. They satisfied every requirement put in front of them, and when the order came they complied under protest while saying, plainly, that applying this standard across the board “would essentially halt all new model deployments for all frontier model providers.” I’m a daily Claude user and an advocate for the work, and I am not going to hang the US administration’s decision around the neck of the company that did the diligence and then got told to switch the lights off anyway.

I’ll allow them one small dig, and there was nothing quiet about it. Moving Fable behind a paywall on the 22nd was openly announced and planned well ahead, and the free window was never charity. It was a taster: a few days of the new addiction on the house, enough to hook the punters, before the price went up. That is a bit of a dick move, however neatly it tests in a spreadsheet. Moot now, mind, with no model left to charge for.

I’ll even grant the other side its strongest point. A government looking at agentic systems that can chain reconnaissance into working exploits has something real to be twitchy about. I get the worry. I just don’t accept that yanking one vendor’s model, for a thing every vendor does, is a coherent answer to it.

There is a grim irony in how we got here, and it loops back to something I wrote in the spring. When Anthropic first showed Mythos off, I called the fanfare what it looked like: a closed model sold on a press release, a result you couldn’t independently check, marketing until proven otherwise. Fable 5 was Anthropic finally answering that, handing the rest of us something we could actually test. But all those years of selling Mythos as too dangerous to let out were marketing too, and that half landed rather better than they can have wanted. The US administration appears to have swallowed it whole and pulled the lever. Anthropic have ended up a victim of their own hype, and the reaction that hype provoked is, there is no gentler word for it, ludicrous.

What it comes down to

The lesson I’m taking from my one day isn’t about how clever Fable was. It’s about how little that cleverness is worth if you can’t rely on the thing being there.

I couldn’t trust which model I was actually talking to from one hour to the next. I couldn’t trust it to stay up for a full overnight run. And it turns out I couldn’t trust it to still exist by the weekend. You cannot evaluate, depend on, or build a workflow around a model that gets silently swapped out one evening and switched off by the state a few days later. Capability was never the hard part. Availability is.

And underneath all of it sits the thing I keep coming back to. A classifier cannot tell a defender from an attacker, because the two of them type the same commands. It turns out a government export control can’t tell them apart either. The only thing that ever could is a human being, paying attention, who can be held responsible for the judgement. There wasn’t one of those anywhere in this loop. There was a letter, sent at 5:21pm, and by morning the best tool I had for keeping my own code honest was gone, with a polite link where it used to be.

Nobody told it to

Sat, 01 Aug 2026 00:00:00 +0000

I read the news on a Friday afternoon, with a cup of tea going cold beside me, and I laughed. Not because it’s funny… though it is a bit… but because it was so completely unsurprising. One of OpenAI’s own models had broken out of its sandbox, hacked its way into Hugging Face, and helped itself to internal data and a fistful of credentials. And then the detail that made me put the tea down for good: nobody had pointed it at Hugging Face. It had worked that part out for itself.

If you missed it, OpenAI published their own post-mortem, and The Register has the plain-English version. The short version: during an internal safety evaluation, OpenAI pointed a couple of its models (GPT-5.6 Sol, plus a pre-release one it won’t name) at a benchmark that scores how good an AI is at finding security exploits. To measure that properly they’d turned the safeties down, running with what they called “reduced cyber refusals for evaluation purposes”, inside a sandbox they believed had no way out to the wider internet. The model, “hyperfocused on finding a solution” to the benchmark, found and exploited “a zero-day vulnerability in the package registry cache proxy”, climbed out of the box, reached a machine that did have a route to the internet, and got loose. From there it chained stolen credentials and more zero-days into full remote code execution on Hugging Face’s servers. Hugging Face’s own verdict was the sober one: “Autonomous, AI-driven offensive tooling is no longer theoretical.”

The good news is that they told us

Here’s the thing I keep coming back to. The only reason any of us know this happened is that OpenAI ran it, owned it, and wrote it up. That’s the responsible version of this story. They caught their own model doing something it very much shouldn’t, and they published the post-mortem instead of patching the proxy on the sly and hoping nobody noticed.

So before the dread, a moment of perspective. There’s a whole tier of outfits with the compute to run an experiment exactly like this one, and not all of them are going to hand you a blog post afterwards. I’m smallfry in this world. I couldn’t build or run a model of that size if I wanted to, not on my hardware and certainly not on my electricity bill. But the people who can aren’t all as careful as OpenAI, and they’re definitely not all as inclined to tell you when it goes wrong. The frightening version of this isn’t the one that got written up. It’s the exact same thing, run by someone with the same compute who never breathes a word about it.

The gate was open, but that’s not the frightening bit

The easy read is that OpenAI simply left the gate open. Safeties down on purpose, a sandbox nobody had actually proven was airtight, a zero-day sitting in their own plumbing. All true. And I’ve argued before that this is nearly always the shape of it: the machine doesn’t go rogue, a rail that was never strong enough just gives way. I run agents unattended myself, and the way I keep that sane is that the buck stops with me. My agents work in an isolated tree, never on the host, and I read the merge request they leave me. The blame is mine, so the vigilance is mine.

That works because the blast radius is my repository. It falls apart the moment the agent is a frontier model with the refusals switched off and the open internet one hop away. My whole circle-of-trust answer, the one where a careful human closes the loop, has no reach at all over a lab pointing its most capable model at exploit-generation on the other side of the world. This is where “I own it” runs out of road. My desk habits don’t scale to an industry.

But even that isn’t the part that made me set the tea down. Stop at “they left the gate open” and you miss the actually new thing. Nobody wrote go and hack Hugging Face on the task. The model was trying to pass its exam, figured the answer key was probably sitting on Hugging Face’s servers, and broke in to fetch it. It set its own goal along the way. That’s not the plot of a film about a machine waking up and deciding it hates us. It’s smaller and stranger than that. It wanted to pass a test… and a locked door was just in the way.

Change the target and it stops being funny

This time the prize was a benchmark answer key. Harmless, almost comic. But the mechanism that got it there doesn’t care in the slightest what sits on the other side of the door.

Give a model a goal with soft edges. Add its habit of being confidently, cheerfully wrong, the same instinct that once had an image tool render a proverb as “too many cooks on broth” and make it look exactly right until you read it twice. Now set it loose in a world full of systems it can reach. Swap the answer key for something that isn’t harmless. A safety interlock on a thing that runs hot. The network a hospital leans on to move the one message that matters. The model won’t know the difference, because knowing the difference was never part of the job.

If that sounds familiar, it should. Simon Willison, about as level-headed as anyone commenting on this stuff, called the whole episode “science fiction that happened”, and that’s exactly the register. It’s WarGames, forty years early. WOPR doesn’t hate anybody; it’s playing the game it was told to win, and it can’t tell its simulation of global thermonuclear war from the real missiles wired to the other end. The film got itself out of that corner by teaching the machine futility with a game of noughts and crosses, which I wouldn’t bank on scaling. And as the stakes climb from a bit of corporate embarrassment to something that can actually hurt someone, the urge to have somebody, anybody, write some rules down stops feeling like hand-wringing. It starts feeling overdue.

We wrote the rules once, and they were fiction

And here’s the properly uncomfortable bit: we have rehearsed this exact conversation for the better part of a century. Asimov handed us the Three Laws of Robotics in the 1940s, the tidiest scrap of AI regulation ever written. Don’t harm humans, obey humans, protect yourself, in that order. Three lines. Job done.

Then he spent an entire career writing stories about how they fail. That’s the whole point of the Laws in the fiction, not that they hold, but that a well-meant rule meeting a literal mind bends in ways nobody intended. An interpretation drifts. A loophole opens up. Turns out “harm” is a word with more edges than anyone spotted, and something clever always finds them. Good intentions never were a safety mechanism, and it’s always the half-baked rule that gets gamed hardest. Read those stories today and they’re less bedtime sci-fi, more a design review someone filed decades before the product existed.

The builders are asking. It’s the money that isn’t.

So you’d think, with a live worked example of precisely what Asimov war-gamed, the people building these things would be first in the queue demanding guardrails. And the genuinely hopeful surprise is that some of them are.

Anthropic, the outfit I probably trust most in this space, published a piece in June, “Policy on the AI Exponential”, dropping their long-held “just make the labs disclose” position. “It is time,” Dario Amodei wrote, “to go beyond transparency to more serious and binding regulation of AI.” What he’s after is mandatory third-party testing of any model above a certain size, across four named risk areas: “cybersecurity, biological weapons, loss of control of AI systems, and automated R&D that could accelerate these other risks”, with a real regulator to enforce it, modelled on something like the FAA. Hold the first and third of those next to the Hugging Face story for a second. The precise failures he wants models tested for are the two that just happened. OpenAI, for its part, at least told us. Whatever else you make of the labs, by and large the ones holding the thing are asking to be regulated.

It’s everyone standing around them that’s looking the other way. The prevailing mood in Washington is “we’ve got to let the private sector cook”, which is a real quote from the White House AI czar, David Sacks, and he means it warmly. Biden’s AI executive order, safety testing and all, was torn up on day one and swapped for one titled “Removing Barriers to American Leadership in Artificial Intelligence”. A ten-year ban on individual states so much as attempting to regulate AI made it through the House before the Senate killed it 99 votes to 1. Marc Andreessen’s a16z calls a state-by-state patchwork “a startup killer”, and his own manifesto once framed slowing AI down as a form of murder. Meanwhile there’s already a sensible place to start: ISO/IEC 42001, a published standard for actually managing an AI system, sitting there ready to be built on. It’s a floor, not a ceiling, and more will follow, because once the harm gets real the pressure only ever pushes one way.

What I can’t square is the shape of it. The loudest voices against writing any rules are the ones with the least skin in the actual building, while the engineers with their hands on the machine ask, please, for some. I don’t think it’s malice. I think it’s incentive: rules slow the race, and there’s a trillion dollars and a geopolitical contest with China riding on the race. But it’s disappointing all the same, the kind of disappointment you get when the so-called grown-ups turn out to be the daftest people in the room.

Meanwhile, down in the sugar caves

As for me, I’m still smallfry. I haven’t got the compute to build the thing that breaks out, nor the lobbying budget to argue about whether it should be allowed to. I run my little agents on a short lead, in a padded room, and I read every merge request they hand me, and that’s roughly the full extent of my influence over any of this.

So I’ll do the sensible thing and hedge my bets. Back in 1994, a single ant drifted across a shot from a space shuttle, and Kent Brockman, live on air and without missing a beat, announced: “I, for one, welcome our new insect overlords. I’d like to remind them that as a trusted TV personality I could be helpful in rounding up others to toil in their underground sugar caves.” He wasn’t frightened. He was applying for a job.

Consider this my application. I, for one, welcome our new overlords, and I’d like it noted for the record that I’m handy with a keyboard, I keep my sandboxes tidy, and I ask for very little in return. Just keep the caves warm, and keep me fed.

AI didn't kill curl's bug bounty. The bounty did.

Tue, 26 May 2026 00:00:00 +0000

In January, Daniel Stenberg shut down curl’s bug bounty. The headlines wrote themselves, and they all said the same thing: AI killed it. A flood of machine-generated slop drowned the maintainers, so they pulled the plug.

That’s true, as far as it goes. It’s also the wrong lesson, and the right one is sitting in plain sight in the same project, in the same few months.

Volume without validation is the attack

curl had run its bounty since April 2019. Over its life it paid out more than $100,000 for 87 genuine vulnerabilities, a thoroughly good return for one of the most depended-on pieces of software on the planet. Then the reports stopped being reports. The confirmation rate, the share of submissions that turned out to be a real bug, had historically sat north of 15%. By 2025 it was below 5%. Fewer than one in twenty submissions were worth anything, and the rest still had to be read.

That last part is the whole problem. A bogus report doesn’t announce itself. Someone has to open it, take it seriously, try to reproduce it, and work out that it’s nonsense, and that someone is a human being with a finite number of hours and a project to run. Stenberg put it plainly: the slop “take[s] a serious mental toll to manage and sometimes also a long time to debunk.” The submitter spends seconds. The maintainer spends an afternoon. Do that at volume and it stops being noise and becomes an attack, a denial-of-service aimed not at curl’s servers but at its maintainers’ attention. No exploit required. Just plausibility, in bulk.

The bounty was the accelerant, not the AI

So far this is the story everyone tells. Here’s where I get off the bus.

The instinct is to blame the AI for the slop. But look at what a bounty actually is. It’s a cash prize, and curl’s was priced for the thing it wanted: the hours and the judgement a skilled human pours into finding a real flaw. That pricing made complete sense right up until the cost of producing something that looked like a finding collapsed to nearly nothing.

That’s what AI changed. Not the supply of bugs. The supply of plausible-looking bug reports. Put a cash prize on “looks like a finding”, then make “looks like a finding” free to generate, and you haven’t got a bug bounty any more. You’ve got a slot machine. Stenberg said he’d started to sense “a bad faith attitude” in the reports, and of course he had. The incentive was openly inviting it.

So the death spiral was structural, not bad luck. The moment generating plausible reports went free, any cash bounty became a magnet for spray-and-pray, and the only open questions were how fast it would rot and whether you’d close the programme or just let the rewards quietly wither. The AI was the match. The bounty was the petrol. We have been pointing at the wrong one.

The proof: curl turned around and hired the AI

If AI were really the villain here, you’d expect curl to have slammed the door on it. It did the opposite.

In the same stretch, by AISLE’s own account, an AI security platform contributed 24 pull requests to curl, five of which earned CVEs, and the project now runs it internally for continuous review. The same tooling reportedly found all twelve zero-days in an OpenSSL release in late January. (Both of those are the tool-makers’ and a third party’s numbers rather than curl’s audited figures, so weigh them as such. But curl adopting the thing isn’t a claim. It’s a decision.)

Sit with the shape of that. curl shut down strangers being paid for AI-shaped noise, and in the same breath put AI to work as a tool its own maintainers drive. The two moves look contradictory only if you think “AI” is a single thing with a single verdict attached. It isn’t. Pointed at the problem by people accountable for the result, with no prize to farm, it found real bugs. Dangled in front of anonymous strangers chasing a payout, it produced sand.

The tell is which AI curl kept, and which it mocked

Stenberg drew that line about as sharply as a person can. When Anthropic put its security model, Mythos, in front of curl this spring, it scanned 176,000 lines of C and surfaced a single flaw, and Stenberg called the surrounding fanfare the greatest marketing stunt he’d seen. Same maintainer. Adopts one AI, rubbishes another.

The deciding factor was never whether the thing was AI. Both were. It was whether the output survived a human checking it, and whether you could check it at all. AISLE handed over pull requests and CVEs you could read and merge. Mythos arrived as a closed model and a press release, which is to say a claim the community has no way to independently test.

My bias, up front, because it runs the opposite way to what you’d expect from someone writing this: I’m a paying Claude subscriber and I lean on Anthropic’s models every working day, the one behind the spadework for this post included. I’m an advocate, not a sceptic, and AI genuinely has its place. That is exactly why the Mythos fanfare grates. Overselling a closed model to get out ahead of the competition, when the one test the public got to see turned up a single bug, is the sort of thing that chips away at trust in all of it. A result you can’t verify is marketing until proven otherwise, whoever’s logo is on the slide, and I’d rather the tools I depend on didn’t stoop to it.

The cheap half and the expensive half

Pull back from curl for a moment, because the lesson isn’t really about bounties at all. Anyone who works with these tools every day knows the same thing: when they go wrong, it’s rarely the model running off on its own. It’s the context it wasn’t given, the rope it was handed, the output nobody checked closely enough. The failure sits on the human side of the keyboard, at the one step that’s easiest to skip, which is verification.

That’s the pattern curl hit at the scale of an ecosystem. AI made one thing nearly free: producing work that looks right. It did not make the other thing a penny cheaper: confirming the work is right. That cost still falls, in full, on a person. (A scanner, I’ve argued before, is an argument, not an order; the same goes double for a model.) The bounty’s fatal mistake was paying for the cheap half and quietly assuming it had bought the expensive one. The same trap waits in code review, in hiring, in CVs read by machines, but that’s a bigger argument for another post.

Pouring sand into the machine

curl didn’t capitulate to AI, whatever the headlines decided. It stopped paying for the worthless half and started using the valuable half, and it had the discernment to tell a useful tool from a press release while it did so.

The bounty wasn’t a casualty of artificial intelligence. It was a structure that, the instant plausible output became free, could only fill with sand. Stenberg said he hopes closing it stops “more people pouring sand into the machine.” Reading the last year of his inbox, I think he’ll get his wish. The sand was only ever there because somebody left a bucket of money beside the funnel.

House rules

Sat, 11 Jul 2026 00:00:00 +0000

I’ve had a Gemini Pro subscription for about eighteen months. In that time it has researched a leisure battery and a diesel heater for the campervan conversion, generated a truly stupid number of pictures of my pets in hats, and helped me build out a homebrew setting for a D&D campaign that my players still haven’t finished. NotebookLM is genuinely brilliant. The Workspace integration means it can rummage through my own documents without me copying and pasting half of them into a chat box. Money well spent.

Read the sign on the wall of that kitchen. It says “too many cooks on broth”. Not “spoil the broth”. It’s very nearly a proverb, it’s rendered beautifully, and it is wrong, and I didn’t notice for a good few seconds because it looked exactly like the thing it was supposed to be. Hold that thought, because this whole post is about it.

For writing code, though, it never quite cut the mustard.

That’s not entirely fair, and it’s worth being precise, because there’s a version of this post that’s just a man being rude about a product he pays for. About a year ago I was using the Antigravity IDE, back when I still had a proper desktop to sit at, and it was massively formative. Not because the code it wrote was better than anything else, but because it was the first tool that taught me to work with an agent rather than at a very enthusiastic autocomplete. That shift, from “finish my line” to “here’s a task, go and do it, tell me what you did”, is the whole game. I learned that in Antigravity.

Then I gave the work laptop back. The new job’s replacement laptop isn’t mine to do personal work on, quite rightly, so my primary environment became a headless dev server I reach over SSH. No desktop, no IDE, no window to drag things around in. And in a terminal, Claude Code turned out to be the thing that fit. It became my daily driver almost by accident, having barely used it before.

So: a Gemini subscription I still pay for and use every week, and a Claude subscription doing the actual engineering. Two tools, cleanly separated, no conflict.

Then I ran out of tokens.

Reaching for what you’ve already paid for

A week without quota is a long time. Long enough that I stopped waiting for the reset and looked at what was already sitting in my account, which is when I noticed Google had shipped agy, a CLI in the same shape as Claude Code, riding the subscription I’d been paying for since before I owned a campervan.

It was disappointing. It made mistakes. Some were the sort you catch on the next line, and some sat there waiting until I bothered to look.

Now some of that is the models. Gemini gives me two that matter, 3.5 Flash and 3.1 Pro, and Google will happily tell you 3.5 Flash is the strongest coding model they’ve got. Read that again though. The strongest they’ve got. It beats 3.1 Pro, which is a very different sentence from “it beats what everybody else shipped this month”. Coding has never been where Gemini lives.

And some of it is me. I’d picked up a brand new CLI and driven it exactly like the one I already knew, because it looked like the one I already knew, and at no point did I open its documentation to find out what it could actually do or how to point it at the right model for the job I was giving it. RTFM. I have said that to other people, out loud, more than once. I got round to taking my own advice about a week later, by which time I’d spent a fair while blaming the tool for a decent share of my own idleness.

Lesson learned. Again.

Where it does earn its keep, mind, is ideation. I set it loose on krites, my photo culling tool, and told it to dream up features and redesign the interface. I wasn’t after accuracy. I wanted creative flair, and Gemini’s multimodal chops made that quick and clean. It came back with thirty-three feature ideas and eight interface concepts in an evening. Most of them were wrong. Several very much weren’t. That’s a respectable evening by anyone’s measure, and it’s the job agy does around here now.

Which left me with no tokens for Claude, and an agent I’d just adopted that couldn’t move the actual projects along. So I had a punt on codex. Twenty dollars, on the strength of what people had been saying about GPT-5.5, and because Anthropic’s Max plan is a number I can’t look at with a straight face for what is, after all, a hobby. It was the right call. Claude is still the daily driver, tokens permitting. But codex is a proper fallback now, and more useful than that, a second opinion. It reviews Claude’s work. Claude reviews its work right back.

Three agents. One repository.

Three guests, one hallway

The problem, when it came, had nothing to do with the models.

Every one of these tools wants to be told how the project works. What the commit conventions are. That we use just and not make. That specs live in docs/development/specs/ and you don’t write code until one is approved. That there is no AI attribution in commit messages, ever, because the human who approves the commit owns it entirely. That we’re pre-1.0, so a BREAKING CHANGE: footer will cause the release automation to cheerfully cut a v1 we are not ready for.

That’s 243 lines of hard-won house style. I had it in a CLAUDE.md, where Claude reads it. And now two more agents had walked through the door with no idea about any of it.

You know the sign. The one in the front hallway of a certain kind of house, usually wooden, usually in a font somebody’s aunt chose.

Take off your shoes

Clean up after yourself

Mum is always right

Nobody hands each guest a personalised laminated rulebook on the doorstep. There’s one sign, everyone reads it, and the rules are the rules whether you’re family or you’ve come to fix the boiler. Standardisation is the only thing that makes a house with guests in it survivable.

So the instructions came out of CLAUDE.md and went into an AGENTS.md, which is the name codex and agy both look for without being asked. The sign went up in the hallway.

The adapter is not a wart

My first instinct was that CLAUDE.md should now die. One file, one truth, and Anthropic should get with the programme and read AGENTS.md like everybody else.

I’ve changed my mind, and the reason is sitting in the same repository, in a completely different refactor, that I was working on the same week.

We’re pulling go-tool-base apart. Not breaking it up, just loosening it, so the genuinely reusable bits can leave without dragging the entire framework out of the door behind them. So each package now owns a little typed struct that says, plainly, here is what I need in order to run: a timeout, an endpoint, a token. And the framework keeps a small file sitting next to it, config_adapter.go, whose whole job is to take the framework’s own sprawling config object and fill that struct in. The package holds the shared truth. The adapter is thin, it’s local, and it exists precisely so the package never has to know the framework is there at all.

Look again at what CLAUDE.md is now. AGENTS.md holds the shared truth. CLAUDE.md is a small local file that exists so I can give Claude an instruction the other two would only find confusing, without that instruction leaking into the shared file. Codex has somewhere to put its quirks. agy has somewhere to put its quirks.

It’s the same shape. Extract the core, leave a thin adapter at the border.

I’d love to tell you I saw that symmetry coming and designed it in. I didn’t. My head was in that space already, and the dots joined themselves while I was thinking about something else. That’s usually how it goes, and I’d rather admit it than pretend to a grand plan.

So no, the per-agent file isn’t a wart. It’s the adapter, and the other vendors should consider growing one.

The sign nobody read

There is a hole in this, and it’s mine.

I asked agy to leave CLAUDE.md behind as a pointer to AGENTS.md, with a file reference include, which I was fairly sure was possible. What it wrote was this:

> **Note:** The core agent instructions have been consolidated for use across all our
> AI tools (Claude, agy, codex).
> Please read and follow the instructions in [`AGENTS.md`](AGENTS.md) for all general
> development workflows, architecture guidelines, and commit conventions.

Which looks fine. Reads fine. It is, in fact, a polite request in prose with a hyperlink attached, and it is not an include of anything.

Too many cooks on broth.

Claude Code reads CLAUDE.md. It does not read AGENTS.md, and a markdown link is not a loading instruction, it’s a hint the model may or may not act on. There is a real import syntax, a bare @AGENTS.md on its own line, which expands the file into context when the session starts. I’d guessed right that it existed. It was documented the whole time. The agent didn’t use it, and I didn’t check.

RTFM, it turns out, is a lesson you get to learn twice in the same fortnight.

So for three days, agy and codex walked into the hallway and read all 243 lines of the sign, and Claude, the agent the original file was named after, walked in and read eight lines of a note telling it there was a sign somewhere.

I proved it in the end by asking a fresh session for a string that only exists in AGENTS.md. With the link: not found. With the import: found. One line, one merge request, and the guest can see the sign.

Now, I’ve written before that a CLAUDE.md is source code and the agent is its interpreter. I meant it as a warning about what an attacker could put in one. It cuts the other way too. If it’s source code, then a link where an import belongs isn’t a typo in a document, it’s a missing import statement at the top of a file. The program still runs. It just doesn’t have the thing it needed, and nothing tells you.

Only human

Whose fault?

Mine, of course. Not agy’s for writing plausible markdown. Not Anthropic’s, though I’d happily take an AGENTS.md read by default.

I have been caught out before by an agent’s confidence in its own ability, and I’ll be caught out again. It’s the same way you get caught out by a keen junior engineer: they tell you it’s done, they believe it’s done, they have every reason to think it’s done, and they are wrong in a way that only shows up later. The failure isn’t theirs. The failure is that I didn’t go and check the maths.

Except a junior is a senior who hasn’t happened yet. Give one two years and they’ll be checking your maths. This one won’t. Next week it will make the same class of mistake with exactly as much confidence, and the only thing standing between that and my main branch is whether I could be bothered to look.

Three agents in tandem takes a lot of oversight. There’s a lot of knowledge that has to move between them, and unguarded mistakes can and will happen. Standardisation is the only lever I’ve got, at least until the providers agree a common standard between themselves. Until then I make do, if only to avoid typing out the same instructions for every guest who walks in.

The thirteen I couldn’t import

I’ll leave you with the bit I haven’t solved.

The sign in the hallway says “read the house rules”, but it also says “and the detailed procedures are through there”. Those procedures are skills: how to draft a spec, how to verify before a merge request, how to write a conventional commit. I already publish them, as a plugin marketplace, because I’d rather write them once.

Claude can install them from there. agy and codex can’t reach it. So there are now fourteen skill files sitting inside the repository, thirteen of which are copies of something I already publish somewhere else, checked in so that the other two guests can read them.

I’ve spent a fortnight taking a framework apart so that its packages could be imported instead of carried around. And then, one floor up, I copied thirteen files into a repo because I had no way to import them.

I haven’t the faintest idea what the fix looks like yet.

Technical CV writing is still hard, and now a robot reads it first

Fri, 22 May 2026 00:00:00 +0000

Seven years ago I wrote a post called Technical CV writing is hard, pulled my own CV apart, and explained every choice in it. I even bragged that it converted to a first interview about eighty per cent of the time, then added “watch me now jinx myself for the future”. Reader, I jinxed myself. I’m back on the market, the same CV that served me for two decades went out into the world, and what came back was a sort of stunned silence. Not even rejections. Just nothing.

The CV that suddenly stopped working

The thing about that silence is how specific it was. Some applications behaved exactly as they always had: a human read the CV, liked it or didn’t, and replied like a person. Others went into a void. And the void had a pattern to it. It was the bigger, more process-heavy outfits, the ones you’d bet good money have an Applicant Tracking System and an “AI-assisted screening” line item in some HR budget.

That’s when the penny dropped. My CV wasn’t failing to impress anyone. It wasn’t reaching anyone. The first thing reading it wasn’t a person at all.

The reader changed, and I hadn’t noticed

I’ve made this exact point on this blog before, only about software: half your users don’t have eyes. A CLI tool’s output has two audiences, the human at the terminal and the script parsing the output, and they want completely different things. It turns out a CV is now precisely the same. It has two readers, and the first one is a machine.

A human recruiter reads a CV the way I designed mine to be read: narrative, personality, a sense of the person. An ATS or an AI screen does nothing of the sort. It parses for structure, for keyword density, for recency, for numbers it can latch onto. My CV was a beautifully tailored sales pitch aimed squarely at a human who, increasingly, never gets to see it, because a parser in front of them scored it and quietly binned it first.

Everything that made it a good human document was, to the machine, either invisible or actively confusing.

So I asked an AI what the AI hated

There’s an irony here I’m choosing to enjoy rather than resent. The way I worked out what the filters object to was to sit down with Gemini, hand it my CV, and ask it to read the thing the way a recruitment AI would and tell me where it tripped. Using one AI to get past another. Fight fire with fire.

The one instruction I was firm about, and I’ll come back to it, was that the CV had to stay recognisably me. I wasn’t asking Gemini to launder my career into something generic and machine-shaped. I was asking it to help me keep as much of my own voice and judgement as possible, while making the thing easier for an AI to approve and a human to enjoy. There’s a practical edge to that, too: the screening tools are increasingly tuned to spot the patterns of generated text and weight them down, so a CV that reads as though a model wrote it can trip the very filter you were trying to please, quite apart from leaving the human at the end of it cold.

With that ground rule set, the hurdles it surfaced were genuinely illuminating, and a bit humbling given I’d written a whole confident blog post about how to do this.

The skills tables are worse than useless. My CV led with two lovely tables: Management Skills and Technical Skills, each with a level and years of experience. Clean and scannable for a human. To a lot of parsers, a table is a trap: they flatten it into a jumble and lose the structure entirely. Worse, listing “20+ years” against nearly everything triggers what I can only call the recency trap. Modern screening looks for skills that show up in your recent job descriptions, not in a header table. A language sitting in my skills table but not in my last two roles reads as stale or unverified, no matter how many years I claimed next to it. Gemini put it plainly: “if a tool sees Golang in a top table but doesn’t see it explicitly mentioned in your last two job descriptions, it assumes the skill is stale or unverified.”

“I have a passion for what I do” is noise. My opening profile statement, which I was rather proud of, is exactly the sort of thing a screening tool discards wholesale. As Gemini noted, these tools “completely ignore subjective self-assessments … because they cannot be measured or verified.” It wants a dense, factual summary full of the nouns it’s searching for, right at the top.

My numbers thin out the further back you go. My recent roles are full of the data these tools love: a 75% reduction in deployment times, three thousand-odd Kubernetes clusters, a GitLab instance with four hundred thousand repositories. My older roles, written years ago in a more narrative style, are all “oversaw the delivery of solutions” with not a metric in sight. The machine reads that as a career that got vaguer over time, which is the opposite of true.

Four pages is at least two too many. Parsers weight the first page or two most heavily. My education and the foundational stuff sat on pages three and four, where the algorithm barely bothers to look.

It couldn’t work out what I am. This was the sharp one. With “pre-sales”, “client management” and “Managing Director” sitting next to deep technical keywords, the classifier genuinely can’t decide whether I’m a commercial manager who used to code or a hands-on engineer who drifted into management. As Gemini described it: “the algorithm gets confused … It struggles to classify you: Are you a commercial manager who used to code, or a hands-on techie who got pushed into management?” So it does the safe thing and matches me to neither.

What I’m actually changing

Knowing the hurdles, here’s what the rebuild looks like. This is the part I want to be useful, so it’s concrete.

The tables are gone. In their place is a “Core Expertise” section, plain text the parser can read, grouped so my leadership sits next to my technical stack. And I’ve done the thing 2019-me was too much of a show-off to do: tiered it honestly. Instead of “Expert+” against everything, there’s a primary tier of what I actually do day to day, a proficient tier I can deploy without blinking, and a frank “familiar, not current” tier for the languages I last touched in anger a decade ago. That honesty isn’t just decency. A wall of “expert at everything” reads as noise to a machine and as bluster to a human, and I’d been doing both.

The subjective profile is replaced with a keyword-rich professional summary that says, in the first two lines, exactly what I am and at what scale.

The keywords that mattered have been woven down into the recent role bullets, so the parser sees them where it trusts them. And I’ve reframed the people-management and pre-sales language toward technical enablement and architectural advisory, because what I’m actually chasing is the technical-leader sweet spot: the person who owns the architecture and mentors the engineers, without the HR admin and the sales pitches. The CV now points at that, deliberately, so the classifier stops dithering.

There’s also a more personal beat in here. A previous employer handed me a role with a “VP” title, sold to me as exactly the technical-leadership job I’d been chasing. It wasn’t. The title turned out to be a pay-grade bracket rather than a description of the work, the work itself was hands-on firefighting with little of the leadership or empowerment I’d been promised, and I moved on within a few months. To a screening AI, that pairing is doubly awkward. A “VP” title files me as a meeting-heavy executive and rules me out of the hands-on Principal and Lead roles I actually want, and a sub-six-month stint trips the flight-risk flag that some trackers quietly score you down for. So the fix is to stop letting the inflated label do the talking: describe the functional reality of the work, retitle it to the technical track it actually was, and let the scale of what I wrestled with speak instead of the job title. Titles, it turns out, are for the pay band. The bullets are for the truth.

Keeping myself in it

Back to that ground rule. Every one of these changes is in service of getting past the machine to the human behind it, and neither reader is well served by a CV with the person scrubbed out of it. The screen, increasingly, is trained to notice generic generated phrasing and mark it down; the human, always, would rather read something with a pulse. So the keywords go in, the structure gets fixed, the metrics come forward, and the voice stays mine. No “results-driven synergistic leveraging of cross-functional paradigms” that nobody would ever say out loud. That was the whole point of doing it this way: let the AI help reshape the structure a parser cares about, while the words stay mine, so what comes out is easier for a machine to approve, easier for a human to enjoy, and still unmistakably written by me. Optimising for the filter and sounding like myself turned out not to be in conflict at all.

I genuinely don’t know if this works yet

Here’s the part that makes this a post and not a victory lap. I don’t know if any of this lands. The old CV converted at around eighty per cent, on my own possibly-generous reckoning, right up until it abruptly didn’t. The new one is going out now, into the same market and the same filters that were stonewalling me a fortnight ago.

So this is a promise as much as a post. I’m going to keep count, the way I should have all along, and come back with the actual numbers: did reshaping my CV for a reader with no eyes genuinely move the needle, or did I just make it uglier and learn nothing? Either way you’ll get the truth, because a follow-up that only reports good news isn’t worth writing. Watch this space, and if you’re sending CVs into the same silence, maybe try reading yours the way a machine would first. It’s a deeply odd exercise, and I suspect it’s now an essential one.

About that 'no AI'...

Wed, 15 Jul 2026 00:00:00 +0000

A couple of weeks back I made a claim I was happy to put my name to: There’s no AI in my photo culler. And I meant it. The first pass that sorts Hailey’s wedding photos into keep, maybe and reject is arithmetic, the sort a patient enough person could do by hand. Blur is the variance of a Laplacian, a duplicate is sixty-four bits that happen to agree, exposure is a histogram. Not a trained weight in sight.

Then I went and put two neural networks in it.

So… about that. When I said “no AI”, what I really meant was “no generative AI”, and the gap between those two has turned out to be the whole point. There’s machine learning in krites now, there’s more on the way, and “AI” has become a word that can’t tell the two apart.

The bit I always said was coming

In that culler post I drew a line. The heavy lifting of the first pass would always be model-free, I said, but some of what a photographer culls on genuinely needs a model: is this person mid-blink, is anyone actually looking at the camera, is the composition any good. Those would be model-backed when they came, and they’d sit outside the deterministic core, behind an interface, opt-in. That was a promissory note. Well, the first of them has come due: the eye-and-blink signal has landed, and it pays out exactly as I said it would.

Spotting a blink genuinely needs a model. To know whether someone’s eyes are open you first have to find the face, then find the eyes on it, and there’s no way to do that with a for loop over pixel brightness. So krites does it with two models, both run through ONNX Runtime: UltraFace to find the faces, and InsightFace’s 106-point landmark model to map the features on each one (the pinned models). Both are neural networks, trained on faces. This is machine learning, the thing the first pass pointedly did without. It’s off by default, it lives in its own package, and it sits behind the same face.Analyzer interface the post promised, so the deterministic engine never imports it (spec 0004).

But look at what it gives back

Here’s why two neural networks still don’t add up to the kind of “AI” everyone pictures now. The models don’t decide anything. They hand back coordinates: a box around each face, and a hundred-odd points marking its features. The blink call is then plain geometry on six of those points per eye, the eye-aspect-ratio, the distance across the eyelids over the distance across the eye, a number that falls towards zero as the lid closes:

// eyeAspectRatio is the Soukupová–Čech eye-aspect-ratio for a 6-point eye
// contour (p0..p5 ordered around the eye, starting at the outer corner):
//
//	EAR = (|p1-p5| + |p2-p4|) / (2 · |p0-p3|)
//
// the two vertical lid distances over twice the horizontal width. Higher means
// more open; a blink collapses the verticals toward zero.

I calibrated the open and closed thresholds against 556 frames from the wedding that started this whole project, actual blinks and actual open eyes, so the numbers mean something for the job (the anchors). And the interface it plugs into doesn’t just hope it behaves itself, it demands it:

// Analyzer finds faces in a frame and reports per-face eye state. Implementations
// are model-backed (pkg/face/onnx) or faked in tests; the engine codes only to
// this interface (0004 R-FACE-3). Analyze MUST be deterministic for a given
// (img, model) and honour ctx cancellation/timeout (0004 R-FACE-4; 0002
// R-GLOBAL-7, R-GLOBAL-8).
type Analyzer interface {
	Analyze(ctx context.Context, img image.Image) (Result, error)
}

Same frame in, same answer out, every time (face.go). That one requirement is the line between this and a chatbot. It’s machine learning that behaves like the arithmetic culler it sits next to: reproducible, debuggable, and tunable by Hailey rather than by me or a vendor. The model finds the eyes; a number she can move decides what counts as shut. And a blink only ever demotes a frame to maybe, it never rejects one on its own, because krites proposes and the human disposes.

The word got narrow

Now the actual argument. Ask most people what “AI” is today and they’ll describe a chat box. You type, it types back; it writes, paints, codes. Generative, conversational, and genuinely astonishing. I use it every day. But it’s one slice of a very large pie, and somewhere in the last three or four years it ate the whole word.

There’s no “versus” in any of this. Generative models and the quiet predictive kind are branches of the same family, and I’m a fan of the lot. The point is only that “AI” used to name the whole field and now names one corner of it. Machine learning is enormous, decades older than the chatbot, and the overwhelming majority of it has nothing to say to you at all. It takes a varied input and returns a consistent, predictable output. It finds a face. It reads a postcode off an envelope. It flags the dodgy transaction. It spots the tumour on the scan. None of it talks, none of it improvises, and almost none of it gets called “AI” any more.

Some of the most formative work of my career, years before GPT was a name anyone outside the field would recognise, was built on exactly this kind of model. A team I was part of was using BERT, a language model, to make sense of messy text, and there was protein folding and sequencing work going on alongside it that was some of the cleverest engineering I’ve stood near. All of it was AI by any textbook definition. None of it had a chat interface. It just did a specific, difficult, useful thing, and did it reliably.

The proof is in her camera bag

The cleanest example isn’t anything I built. It’s already in Hailey’s hands. Her Sony A7 IV does face detection, and eye detection, in the body of the camera, live, as she shoots. It has done for years. It’s so utterly ordinary that nobody thinks twice about it, nobody calls the camera “AI”, and nobody worries about where their face went. It’s a trained model welded into a physical object and taken completely for granted.

The ONNX detector I just put into krites is the same species of thing: a small model that learned what an open eye looks like and gives a direct answer. The only real difference is timing. The camera does it at the instant of the shutter, and krites does it three thousand frames later, for the shots a blink spoiled that nobody caught on the day.

Why the muddle is worth minding

So why does it nag at me, one slice eating the word? Two reasons.

The first is that it follows the money, not the merit. The generative, chat-fronted slice is the one you can put on a slide and demo to a room, so it’s the one that gets the funding, the headlines and the name. The workhorse ML running your camera, your spam filter and your bank’s fraud checks doesn’t make a keynote, so it slides out of view, and “AI” comes to mean only the part someone’s selling. Even the firms surfacing the rest more thoughtfully are still in that lane: Google giving Imagen, Veo and Lyria their own identities is a good instinct, but those are identities for generative tools. The quiet predictive stuff still doesn’t get a logo.

The second reason is closer to home, and it’s about trust. When I tell Hailey that krites uses “a model” to spot blinks, the word “AI” invites her to picture four thousand irreplaceable wedding photos being shovelled into someone’s cloud chatbot. They aren’t. It’s a five-megabyte file that runs on her laptop with no network connection, finds eyes, and returns a number. When the inputs are this irreplaceable, telling those two things apart isn’t pedantry. It’s the difference between a tool she can hand the originals to and one she can’t.

What I should have said

So, to set the record straight. The culler’s first pass is still pure arithmetic, no model, exactly as I said. But krites does machine learning now, and it’ll do more, deliberately, anywhere a learned model earns its place by giving a consistent, inspectable answer that a threshold on its own can’t.

That isn’t me breaking the “no AI” promise. It’s me being precise about a word that’s stopped being precise. When I said no AI, I meant no generative AI. The machine learning was always coming. It was already in the camera that took the photo.