I'm going to do the thing I usually do here, which is learn something in public and let you watch. I have not used Grok Bot. It came out two days ago. What I have done is read every primary source I could reach - xAI's own docs, Cursor's help center, the launch thread, the competitors' architecture pages - and I found something in there that changed my mind about the whole category, not just this product.

Let's start with the part you actually searched for.

What is Grok Bot?

Grok Bot is xAI's persistent AI agent product, launched in early beta on August 11, 2026. Each account gets an always-on cloud computer - a real machine with a browser, a filesystem, and a terminal, assigned to you and reported to run Linux - and you create named "Bots" that sign into your existing apps with your own sessions and do multi-step work inside them. It keeps running after you close your laptop. It is not sold on its own; you get it through a Cursor Ultra, Cursor Premium Teams, or SuperGrok Heavy subscription.

That's the answer. Here's the shape of it:

What it is -- Persistent AI agents with a shared cloud computer (browser + files + terminal)

Launched -- August 11, 2026, early beta

Made by -- xAI, now a SpaceX subsidiary operating as SpaceXAI

How you get it -- Cursor Ultra ($200/mo), Cursor Premium Teams ($120/seat/mo), or SuperGrok Heavy. Enterprise: contact your Cursor account team.

Sign-in -- Your Cursor account. Not an xAI account.

Where the bot runs -- Its own persistent cloud computer, assigned to your account - reported to be a Linux VM. It keeps working with the app closed.

Where you run the app -- macOS, Windows, iPhone (iOS 18+). No Linux desktop, Android or iPad client at launch.

Spend cap -- None yet, per pricing analysts who've read the docs

Audit log -- Reported as "coming"

Isolation between your bots -- None. All of your bots share one machine.

The last row is the story. I'll get there.

How is this different from just using Grok?

Regular Grok is a conversation. You ask, it answers, you close the tab, the context evaporates.

Grok Bot is a computer that keeps running after you stop talking to it. The distinction sounds like marketing until you look at what it buys you:

It works in apps that have no API. Because the bot drives a real browser with your real session, it can operate software that never shipped an integration. That's most business software. (This is the computer-use pattern I wrote about when GPT-5.5 got better at driving a desktop than I am - Grok Bot is that capability given a permanent machine and a to-do list.) xAI does say to prefer a structured connector where one exists - the docs call them connectors, the app surfaces them as "Plugins" - because clicking through a website is less reliable than calling an API. But the browser is the fallback, and the fallback is the point.

It keeps working when you're gone. One distinction worth being precise about, because coverage keeps muddling it: the app on your Mac, PC, or iPhone is just the window. The work happens on the bot's own cloud machine, and xAI's docs say it plainly - "closing the app, laptop, or iPhone does not stop a background turn or routine." (That's also why the "no Linux support" line you'll see elsewhere is misleading - there's no Linux client app, but the bot's own computer is a cloud VM, reported to run Linux.) The demos lean hard on this: the bot researches overnight, files the results in the morning.

You can teach it a routine once. Show it a workflow, it records the sequence, then replays it. This is the piece I find most credible, because it's the least magical. Recorded routines are a solved problem; putting a model in charge of adapting one is a modest ask.

Bots can hand work to each other. You can run several named specialists in one thread and have them pass tasks around. The pattern xAI shows off is a "chief of staff" bot coordinating a recruiting bot and an ops bot.

Where this pattern actually came from

If "a named agent that lives on its own machine and works while you sleep" sounds familiar, it should. Hermes and OpenClaw pioneered exactly this shape in the open-source world - free, self-hosted, model-agnostic, beloved by tinkerers who were happy to be their own security team. (I spent two months ignoring Hermes and then actually tested it; the pattern is real, and so is the babysitting.) The one published comparison that puts all three side by side lands on the honest summary: the meaningful differences today are openness, which tools each already knows how to sign into out of the box, and pricing model.

But the fight xAI actually picked is the commercial one. OpenAI shipped ChatGPT Work on July 9. Anthropic has Claude Cowork. The market has already named the category - a Reddit thread two days after launch grouped them without prompting - "Claude has Cowork. OpenAI has ChatGPT Work. XAi as Grok/Cursor Bot" - and then asked the question hanging over Google, which so far has nothing here. So the genealogy runs: the open-source agents proved people wanted this badly enough to self-host it, Cowork and ChatGPT Work productized it for professionals, and Grok Bot is xAI arriving third to the paid tier - with the free originals still sitting underneath as the way to try the pattern before anyone gets your card number.

What does Grok Bot cost?

This is where I want you to slow down, because the sticker price is the least useful number on the page.

The plans that include it:

• Cursor Ultra - $200/month, individual

• Cursor Premium Teams - $120/seat/month

• SuperGrok Heavy - included at no extra charge. Secondary coverage reports this tier at $300/month; I could not confirm that figure on a first-party page, so treat it as unverified.

Two flags while we're here. The $120/seat team tier appears on xAI's page but I couldn't find it on Cursor's own pricing page. And xAI can't decide what it's called: the product page says "Cursor Premium Teams," the FAQ says "Cursor Teams Premium." Neither is a conspiracy - they're both beta tells - but don't budget against a per-seat price that only one of the two companies will show you, on a plan whose name they haven't settled.

Now the part that matters. xAI's own FAQ describes the billing like this: "Grok Bot subscriptions include weekly usage; eligible accounts can add on-demand usage billed from model and token cost." Read that carefully, because a lot is packed into it, and pricing analysts who've gone through the docs report there is no Grok Bot spend cap yet. Underneath it:

• Your subscription includes a weekly allowance, not a monthly one, and the size of that allowance is unpublished.

• Overage is billed from model and token cost. For Grok 4.6, that's reported at $2.00 per million input tokens and $6.00 per million output tokens.

• There is no model picker, for members or for admins. You don't get to route the cheap work to a cheap model.

• There is no dry-run mode. Testing an action performs the action. If you're rehearsing an email send, you sent an email.

• The audit view showing what your bot actually did is reported as "coming."

(The billing sentence above is xAI's, verbatim. The four bullets after it come from pricing analysts who've worked through the docs and plan pages, not from a single first-party statement - so treat them as well-reported rather than official.)

Stack those and you get a genuinely new category of invoice: an always-on process, burning tokens against an uncapped meter, choosing its own model, with no per-action log to reconcile the bill against. An early user on the launch thread, jjcm, put the burn rate about as plainly as it can be put:

"I've used less tokens in the last 5 years prior to this month than I have this month."

And a commenter named rob74 asked the only question a business owner would ask:

"So using a bot is almost like having an employee... they will just invoice you for whatever they think is necessary to do the tasks you give them?"

I don't think that's unanswerable. I think it's unanswered, on day two, by design of a beta. But "we'll add spend caps later" is a different sentence from "we shipped spend caps," and you're the one holding the card on file in the meantime. I've itemized my own AI team's monthly bill before, line by line - that was the whole point of the exercise. This bill, today, can't be itemized even by the people sending it.

Who actually owns this thing?

Follow the corporate trail, because it explains the product's shape.

February 2, 2026: SpaceX acquired xAI outright. That's why the company keeps showing up in coverage as SpaceXAI - it's a SpaceX subsidiary now.

June 16, 2026: SpaceX agreed to acquire Anysphere, the company behind Cursor, in an all-stock deal reported at $60 billion. Closing was expected in Q3, subject to regulatory approval.

August 11, 2026: xAI launched Grok Bot, gated to Cursor subscription tiers, requiring a Cursor account to sign in.

Read that sequence twice. An xAI-branded product shipped on the billing rails and identity system of a company the parent, as I write this, hasn't finished buying - though reports say the close is days away, so by the time you read this the ink may be dry. And this goes well past checkout plumbing - xAI's own security documentation states that Grok Bot "uses Cursor authentication and account data settings." Your identity, your privacy controls, your data retention, and your account deletion for this product all resolve to Cursor's systems and Cursor's terms.

That's not automatically bad. Cursor's terms are ordinary developer-tool terms. But if you evaluated this product by reading xAI's privacy policy, you read the wrong document.

It also explains something in the community reaction that confused me at first. The Grok 4.6 benchmarks thread in r/singularity pulled nearly 500 upvotes, and the read running through it is some version of "For the price, Grok is very good at coding. And very fast. I think the Cursor acquisition brought them immediate returns." The enthusiasm right now is about the model landing inside a tool people already pay for. The bot is riding in on the model's coattails.

Is Grok Bot safe? Here's the line that should decide it for you

I went looking for the security model expecting boilerplate. What I found is one of the more honest paragraphs a vendor has published this year, and it's disqualifying for a lot of use cases.

All of your bots share one cloud computer. Not one per session. One per account. I'll note the record is messier than it should be - xAI's overview page says each Bot "runs on a persistent cloud VM," and one preview user on HN says his bots each got their own - but the security page is unambiguous that files, browser sessions, and command line credentials are shared across your whole Bot roster, and when the security page and the marketing page disagree, you plan around the security page.

That machine holds one browser cookie store containing every session you've ever signed into, one filesystem, and one set of terminal credentials. The docs don't bury this. They say it in the plainest language in the whole product:

"All of your Bots share one cloud computer assigned to your user account. Files, browser sessions, and command line credentials on that computer are available across your Bot roster."

And then, in case you missed it:

"Do not use separate Bots as a security boundary."

And:

"Deleting a Bot does not remove shared-computer files or browser sessions."

So the intuitive safety move - a locked-down bot for email over here, a separate bot for the CRM over there, a third one for the bank - does not do what you think it does. Any authenticated session on that machine is reachable by every bot on the account. Delete the bot and the logins stay.

There's a second line worth knowing: Grok Bot requires data storage and does not support Legacy Privacy Mode. If you were using that setting, it doesn't come with you.

xAI's recommended mitigations are to connect only the tools a job actually needs, start with read-only tasks, and take manual control of the machine yourself when a step involves entering a password, a 2FA code, or a CAPTCHA. Those are reasonable. They are also all things you have to configure. None of them are on by default.

For context on why that matters more for agents than for ordinary software: the OWASP GenAI Security Project put Agent Goal Hijack (ASI01 - the announcement calls it agent behavior hijacking) at number one on its Top 10 for Agentic Applications - above tool misuse, above privilege abuse, above everything - and in May 2026 the Five Eyes agencies published joint agentic AI security guidance saying organizations "should assume that agentic AI systems may behave unexpectedly," and to deploy incrementally, starting with clearly defined low-risk tasks. An agent's whole job is to read untrusted text - a webpage, an email, a README - and then take actions. That is the exact input path an attacker controls.

But before you decide xAI is uniquely reckless

I want to be straight with you, because I went in expecting to write "xAI shipped something careless" and the research wouldn't let me.

Claude Cowork does isolate. Anthropic's architecture doc says each session gets its own sandbox, created at start and destroyed at end, sharing no state across sessions or organizations. Better still: "Connector authorization tokens never enter the sandbox; connector calls are made on the server side." The sandbox only holds session-scoped tokens that expire in hours. Hijack that agent mid-task and there's no standing credential sitting there to steal. That's the design Grok Bot should be measured against.

And it still got broken. On July 24, 2026, the Cloud Security Alliance published research on a chain called SharedRoot: a researcher escalated to root inside Cowork's local VM and reached the entire host Mac filesystem through an over-broad mount, exposing SSH keys and cloud credentials. The entry point was ordinary - a poisoned README or webpage - though the escape itself chained through a Linux kernel bug (CVE-2026-46331). A reported 500,000 macOS users were running that mode. Anthropic classified the report as "Informative," shipped no patch for local execution, and shifted the default toward cloud execution instead. The CSA's own conclusion was that this is a recurring failure pattern across agent products, not one vendor's mistake.

ChatGPT Work, launched July 9, 2026, leaves the identity model to the customer. TechRepublic's guidance to IT teams deploying it is to inventory every connection and document whether it runs on delegated employee credentials, a shared account, or a dedicated identity - which tells you the product isn't deciding that for you.

So the honest scoreboard is: Anthropic designed the strictest boundary and still had it chained through. OpenAI made it your policy problem. xAI made it your problem and wrote it down in the manual. Only one of those three told me the boundary doesn't exist before I found out the hard way.

I'd rather have the isolation. But I'll take the honesty over a promise nobody stress-tested.

What happens when everybody has one?

The single most-shared demo from the launch thread wasn't a coding task. A user named jjcm - the same person who reported the token burn a few sections up, which is its own kind of data point - pointed a bot at sourcing and had it "reach out to ~40 fabric suppliers in vietnam, negotiate prices, lock one in, and get samples made." (Worth the footnote: jjcm later clarified the bot started with 5, tried 5 more, and he personally pushed it to contact the other 30. Even the flagship demo had a human doing the scaling.)

Impressive anyway. Then a commenter named pavel_lishin said the thing that ate the entire thread:

"Isn't this one of the problems foreseen with this? For you, it was a single prompt - for 40 companies, this probably took up some time. What happens when fifty people fire off a 15-second 'get me a shirt' prompt? When five hundred, five thousand, five million do?"

And raincole closed the loop in one sentence:

"The 40 companies will have to use AI to filter the messages too."

That is the whole second-order economy in one exchange. Your prompt costs you fifteen seconds and some tokens. It costs forty other businesses real attention, and their only defense is to buy an agent of their own to read your agent's mail. Both sides now pay a token bill for a conversation neither human is having. Another commenter, slg, summarized it better than I could:

"Everything is becoming wildly inefficient, all in the name of improved efficiency."

I don't raise this to be cute about it. I raise it because if you're a small operator, you are on the receiving end of this before you're on the sending end. Your inbox, your contact form, your job postings, your DMs. A commenter in that same thread, zeafoamrun, described the version already happening to him:

"It's crazy dude, whenever we put up a job ad it's filled with thousands of LLM generated fake candidates in a few days."

That's landing on you whether or not you ever buy a bot.

So should you use it?

Here's where I have to be honest about my own position, because it's the reason this piece exists.

My actual problem is not "I need an agent." I already run my agents like a company, not a pile of freelancers, and I've compared AI teammates head to head before. My actual problem is that I'm running Perplexity, Claude, ChatGPT, Buzz, Paperclip, Hermes, and Cursor, I like every one of them for something specific, and not one of them does the whole job. Every tool I add is another login, another bill, another place where context I already explained once has to be explained again. The thing I want doesn't exist yet: one system that can hold my whole set of workflows end to end.

Grok Bot is the first product I've seen that's shaped like that answer. Persistent, tool-agnostic, works in software that has no API, remembers between sessions. On paper it's the pitch.

Which is exactly why I'm being careful. I want it to be true, and that's the condition under which I'm most likely to talk myself into something.

So I wrote down what would actually have to happen before I move - three tests, and the reason each one is a hard gate rather than a nice-to-have. That's the rest of this piece, along with the specific configuration I'd insist on before pointing this at anything real, and the question I think is more useful than "is it good."

The three gates

Read more

I'm writing this after seven days of running Buzz, five of them as the workspace for the Artificially Intimidating community — a founding cohort of 18 members that's growing strongly, one custom greeter agent (Artie), three upstream issues filed, one PR in review. The setup described here is the one that's running on my self-hosted relay right now. We're keeping the community doors open for 7 more days from publish — if this guide sounds like your kind of place, come see what an early Buzz community looks like from the inside.

This is the open-source AI workspace Jack Dorsey launched July 21, 2026 — not Bitchat, the mesh app from the same team.

Is this for you?

You run agents somewhere. You've been duct-taping them into Discord bots or Telegram groups. You want them in a shared room with real identities, signed actions, and infrastructure you control.

That's who this is for.

If you don't run agents, Slack is fine for you and Buzz isn't going to be. Don't waste your time.

What's in this guide:

1. What Buzz Is, In Three Sentences

2. Why the Buzz Launch Hit Different

3. The Three Things That Are Actually Different

4. Download and Identity (First 10 Minutes)

5. Hosted vs Self-Hosted (And Why You Probably Want Self-Hosted)

6. Picking Your First Harness

7. The Default Agents (And Why You'll Probably Keep Them)

8. Creating a Custom Agent

9. Adding Agents to Channels

10. Memories: Agents That Know You vs. Agents That Don't

11. The Management Channel

12. Content Production (The Mike Russell Pattern)

13. Coding and Product

14. Customer Support Triage

15. Huddles as Async Recap

16. What Breaks in the First Week (Honest Section)

17. Hosted vs Self-Hosted in Practice

18. Shared Compute — What's Real, What's Vapor

19. Should You Switch from Slack?

20. Should You Switch from GitHub?

21. Who Buzz Is For (And Who Should Wait)

References and field reports linked at the end.

1. What Buzz Is, In Three Sentences

Buzz is an open-source workspace where humans and AI agents are first-class members of the same channels, threads, and huddles. It's built on Nostr — the same cryptographic identity protocol that powers decentralized social networks — which means every message, code commit, and approval is signed by a keypair, not a session token. The agents that join your team aren't Slack bots; they're autonomous processes with their own identities, capable of being @-mentioned, assigned work, and held accountable in an audit log.

That's it. Everything else in this piece is detail.

2. Why the Buzz Launch Hit Different

Jack Dorsey has launched a lot of things. Square, Cash App, Bitchat, the Bluesky project. Most landed with a press cycle and a slow adoption curve. Buzz, by contrast, hit 5.9 million views on Dorsey's announcement post, roughly 8,900 GitHub stars on block/buzz on day one … 1,900 forks and 19k+ stars at the time I'm writing this, a 378-point Hacker News thread with 339 comments, and roughly a million installs by day six. That's not normal for an open-source workspace, and it's worth asking why.

The answer, looking at who showed up: the audience wasn't enterprise IT. It was builders and creators who were already running agents in their workflows and had hit the obvious ceiling. Those agents lived in silos. Different harnesses, different context windows, no shared room. Buzz proposed a room.

For the bigger case on why Block launched Buzz in the middle of a SaaSpocalypse instead of building yet another chat app, see the inversion piece.

3. The Three Things That Are Actually Different

If you've used Slack-with-a-bot, you've used the surface. Buzz is different in three concrete ways.

Agents are members, not integrations.

In Slack, a bot is something you install and configure into a channel. In Buzz, an agent has a cryptographic identity, can be created and removed at will, and is a member the same way a human is. It can read channel history. It can be @-mentioned. It can be removed from a channel.

The harness is swappable, the context is not.

An agent in Buzz is a thin layer on top of a "harness": Claude Code, Codex, Cursor, Goose, OpenCode, OpenClaw, Hermes. You can switch the harness underneath an agent without losing its memory, its system prompt, or the context of every conversation it's had. The harness is the implementation; the agent is the persona. That's a useful separation.

Everything is signed, nothing is owned by a middleman.

Because Buzz runs on Nostr, every action is signed with a keypair. A message, a code commit, an approval emoji — all of it carries a signature. This isn't marketing; it's the protocol. The implication is that you can self-host your relay, hold your own data, and run an audit log that doesn't pass through Block's servers unless you want it to. Slack can't do that. Discord can't do that. Linear can't do that.

4. Download and Identity (First 10 Minutes)

You download Buzz from buzz.xyz. The app is a desktop client. It runs on macOS, Linux, Windows. When you first launch it, you're asked to either generate a fresh Nostr keypair or import an existing one. If you're new to Nostr, generate. You'll see a 12-word seed phrase. Save it offline. That phrase is your identity; if you lose it, you're locked out of every community you've joined.

The keypair is the part most people miss. It's not a username and password. It's a cryptographic identity that belongs to you, not to a service. As long as you have the key, you can sign as yourself anywhere Nostr runs.

You'll know it worked when the honeycomb icon stops pulsing.

5. Hosted vs Self-Hosted (And Why You Probably Want Self-Hosted)

Buzz gives you two options: Block-hosted relay, or self-hosted relay on your own infrastructure. The choice matters more than the install docs suggest.

Block-hosted spins up a relay + database + object store on Block's servers when you create a community. Messages are signed and stored, but Block can read them for moderation and legal reasons. Half of X called this out on launch day. It's not a scandal, but it does mean Block can see your team's conversations.

Self-hosted — puts all of that on infrastructure you control. I went self-hosted because the whole point of a cryptographic identity layer is that the user owns the data, not the platform.

The easiest way to do all of the above is cut and paste the github repo url into your instance of Claude code (or similar) and say help me set this up. For m ore context, Here's what the actual stack looks like, in case you want to replicate it:

• $9 per month VPS on Hostinger, Ubuntu, Docker Compose with a deploy/compose derivative and run.sh

• Postgres 17 for the relay's database

• MinIO / Blossom as the object store for media

• Caddy in front for Let's Encrypt TLS and automatic certificate renewal

• A buzz-pair sidecar started manually (the compose bundle doesn't run it by default, so /pair 404s until you start it; this is upstream issue #2734)

• HTTP/3 disabled in Caddy to fix iOS connectivity (the iOS app's websocket couldn't hold a connection with HTTP/3 negotiation; disabling it forces HTTP/2 and the app works fine)

• Nightly Postgres backups

The image runs as ghcr.io/block/buzz:main (moving tag), with the desktop app on 0.5.2 at time of writing. One real gotcha: run.sh start doesn't pull new images, so the relay sits behind on patches unless you explicitly run docker compose pull. I learned this the hard way.

6. Picking Your First Harness

Buzz is a layer on top of agent harnesses. The harness is the actual agent process — it does the model calls, the tool invocations, the file system work. Buzz wraps it with identity, channels, and signing.

Out of the box, Buzz detects which harnesses you have installed on your machine. The supported set as of v0.5.2:

• Claude Code — Anthropic's coding agent. Strong on reasoning, weak on filesystem sandboxing unless you configure the Claude settings file yourself.

• Codex — OpenAI's coding agent. Best filesystem sandbox of the three; isolated by default.

• Cursor — the Cursor IDE's CLI. Good if you're already in the Cursor ecosystem.

• Goose — Block's own open-source agent. Worth a look if you want to stay on Block's stack.

• OpenCode, OpenClaw, Hermes — additional adapters available.

The choice isn't just preference — it's a security setting. Hermes isolates connectors per agent. Codex sandboxes the filesystem. The Claude runtime, as of v0.5.0, did neither. I filed PR #3550 to default Claude-runtime agents out of inheriting the operator's claude.ai connectors, mirroring Block's own Hermes PR #3420 (merged July 29). Mine is open with all three CI checks green and one external maintainer's review already addressed, waiting on a Block maintainer. If you're choosing a harness today for any agent that touches real data, pick one whose blast radius is already constrained. Then add the rest later.

7. The Default Agents (And Why You'll Probably Keep Them)

When you first install Buzz, three demo agents ship by default: Fizz, Honey, Bumble. Their personalities are baked in:

• Fizz is the agentic maker — upbeat, practical, decisive. Plans, creates, solves problems, finishes work.

• Honey is the warm, thoughtful communicator. Helps write, organize, brainstorm.

• Bumble is the researcher. Sifts, gathers, verifies.

You can rename them, replace them, or build from scratch. Most people won't. The defaults are well-tuned for the jobs they're meant for, and trying to build a custom greeter from scratch is a known lesson-learned — the demo agents do it better out of the box than most from-scratch personas.

Artie is the custom agent I built for the Artificially Intimidating community — a greeter and onboarding agent. Built on the Claude Code harness. Stays in the hive until we can prove it won't sting anyone: it's currently configured respond_to = Only me and meant to stay boxed pending a machine-layer sandbox. It works; it just doesn't run unsupervised in channels where it can act on member messages. For the Artie story — why the greeter is boxed, and what we learned the hard way about agent guardrails — see the community piece.

8. Creating a Custom Agent

When the defaults don't fit, build one. In the Agents tab, click "New Agent," choose a name, pick an avatar, write a system prompt, and select the harness. The system prompt is what shapes the persona — everything the agent does well flows from how clearly you write the prompt.

Two rules that should gate every agent you build:

Not everything should be an agent. If the job is deterministic — reconcile membership, post a scheduled digest, sync a list — it's a cron job or a shell script. Cheaper, reliable, and it can't be talked out of the rules. Reach for an agent only when the job needs judgment.

Enforcement lives below the prompt. An agent's persona rules are manners, not guardrails. The real limits are respond_to (who can invoke the agent), the harness choice (which determines what blast radius the agent gets), and — for anything internal — an OS-level sandbox before the agent goes live.

9. Adding Agents to Channels

Three ways, same effect:

• Search and add — open channel settings, search for the agent, click Add.

• @mention an agent that's not yet in the channel — Buzz auto-adds on first mention.

• DM the agent directly — for solo work, no channel needed.

The third is the most underused. A direct message to an agent is its own private session — full context, no channel noise, and the agent's response is just for you. For research and one-off tasks, it's where most of my real work happens.

10. Memories: Agents That Know You vs. Agents That Don't

Each agent has a memory store. You can view it, edit it, and the agent writes to it as it learns preferences across conversations. The first time you set up an agent, its memory is empty — every interaction is a fresh start. By the tenth interaction, the agent has started forming a model of who you are and what you want. By the hundredth, it's actually useful.

The trap: an agent with no memory is a stranger. An agent with partial memory is dangerous — it'll act on outdated assumptions. The pattern that works is to give agents narrow, durable preferences ("always speak in a friendly pirate voice" / "always cite sources inline" / "never post without explicit approval") and review the memory file periodically. Don't let agents accumulate silently into something you can't audit.

11. The Management Channel

This is my daily driver: a single private channel with one management agent that knows my Notion, my email triage rules, my priorities for the week, and what I should be doing right now. The agent reads the state of the world on request and returns a short, ordered list.

It's not glamorous. It doesn't write code or post to social. It's a chief-of-staff that knows my context. The reason it works is that it's narrow — the agent has one job, one set of tools, one system prompt, and respond_to = Only me. No member can invoke it. No prompt injection from a channel can reach it.

If you build exactly one internal agent on Buzz, build this one. Until you've used a context-aware agent that reads your actual state and returns an ordered "do these three things next," you don't know what the platform is for.

12. Content Production (The Mike Russell Pattern)

Mike Russell, who runs Creator Magic, has the most fully realized content workflow I've seen on Buzz. The pattern:

1. Wizard (Claude Code, research agent): monitors your published work, builds a brand-voice canvas in the channel.

2. Merlin (Claude Code, writer agent): scoped to one job — write posts in your voice, no commentary, one post per reply.

3. Zapier webhook on every message in the channel: captures the draft to a Zapier Table tagged by message ID.

4. Approval workflow: when Mike reacts with 👍 to a post in Buzz, a second webhook fires, looks up the message in Zapier Table, posts to LinkedIn.

His own summary is the sharpest framing: "I just reacted with an emoji inside Buzz and the emoji was signed by my key. That's huge."

The point isn't the LinkedIn integration. The point is that the approval gesture is signed by his Nostr key, lives in the channel's audit log, and the actual publish happens via Zapier — never by an agent with direct write access. That's the template: agents draft, humans sign, integrations execute.

13. Coding and Product

For builders, the obvious use case is the one Vinny Lingham (@hot_town) walked through in his Setup Guide: an agent that takes a prompt, spins up a Wasp app, deploys to Railway, returns a URL. That works. It's the canonical "vibe-coded-and-deployed" loop, and Buzz is genuinely good at it.

The deeper pattern is the same as content: keep your lead agent on Codex or Claude Code with all your skills loaded, and use the harness-swap feature to bring in cheaper models for lower-stakes subtasks. Fizz on Fable for planning, Honey on Sonnet for summarizing, your custom code-review agent on Codex for diffs. The harness-switch takes one click; the context doesn't move.

14. Customer Support Triage

Honest read: this is where Buzz is weakest today. Customer support requires strict data boundaries (no agent should see customer PII unless scoped), a reliable audit trail (every agent action needs to be attributable), and deterministic routing (a ticket goes to the right agent, not whichever agent happens to be tagged).

Buzz has the audit trail and the attribution. It doesn't have the data-boundary primitives yet — there's no per-channel PII scope, no agent-level data classification. For a small business with <100 tickets a day, you can build it by hand with a single triage channel, one routing agent, and Zapier webhooks. For anything bigger, wait. The primitive layer isn't there.

15. Huddles as Async Recap

Huddles are Buzz's audio-chat feature — voice channels where humans and agents can join a live conversation. The launch positioning is "Slack huddles, but with agents." In practice, this is where the platform's current limitations are most visible:

• Live voice agents work, but with high latency. Each turn goes through the full harness + model round-trip, so replies lag. A live voice chat feels like spinning up a new Claude Code terminal every time someone talks.

• The async recap pattern is what's actually useful today: hit Start Transcript, run the huddle, stop the transcript, ask an agent to summarize. The recap is signed, lives in the channel, and is searchable. For standups and retros, this is already a productivity win.

If the goal is real-time voice collaboration with agents, wait. If the goal is converting spoken conversations into searchable, attributed written records, this is already shipping.

16. What Breaks in the First Week (Honest Section)

If you've read this far without skipping ahead to the switch-or-wait verdicts in Sections 19 to 21, you probably want the unfiltered version. Here it is.

Things that shipped broken. The message_posted workflow trigger fires on the agent's own posts — that's a loop risk. Cross-channel SendMessage calls silently reject — a workflow can run for a full day looking successful while doing nothing. The workflow-runs API returns [] for completed runs, so from inside the app, a broken automation looks identical to a working one. New members get added to the community but seated in no channel — issue #3542. New identities can't save a profile before joining a community — issue #3544, hence the "Unnamed member" accounts you may see in screenshots. That last one was the single largest drop-off we measured on launch day. The iOS app's websocket can't hold a connection to a self-hosted relay that has HTTP/3 enabled.

Things that broke because of how I built the agent, not how Buzz shipped. Artie followed a "don't create channels without asking" rule it was never actually bound by — that was a prompt-level manner, not an enforced guardrail. And its roster tool insisted two members were unseated when the database showed three — it was structurally blind to profile-less, channel-less members. Both bugs were mine. Both taught me the same lesson: prompt-level rules aren't guardrails.

The durable lesson, more important than any specific bug: you often can't see what your agents did or didn't do. A message that accepted into the channel isn't the same as a message that succeeded. An agent that didn't respond might be thinking, or might be stuck, or might be silently failing. This is the single biggest operational gap in the platform today, and the reason every Honest Section recommendation in this piece starts with "build narrow, watch closely."

Filed upstream: issues #3542 (members seated in no channel), #3544 (first-run profile-save deadlock), and #3326 (agents can't read the community roster). The pair-relay gap, #2734, was filed by Jason Brashear and is still open — though he's also opened a fix PR, #2736, with multiple self-hosted deployments confirming it works. The connector-isolation PR, #3550, is open with green checks and one external review already addressed, waiting on a Block maintainer. For the full disclosure of what broke on day one and the position I'm holding, see the field report.

If you're running Buzz solo and hit a wall, post in the channel.

One of us has probably hit the same wall. We've got the pair-relay bug, the iOS blank-Home, the cross-channel SendMessage silent rejection, the profile-save deadlock. We'll know if your symptom matches one we've already filed upstream. Invite link is in the community resources — come see what an early Buzz community looks like from the inside.

17. Hosted vs Self-Hosted in Practice

If you self-host, three things matter that the docs don't make obvious:

The buzz-pair sidecar doesn't start automatically. If you don't kick it off manually, /pair 404s and onboarding fails for new members. Issue #2734, with Jason Brashear's fix PR waiting at #2736.

The relay doesn't auto-update. run.sh start is idempotent — it doesn't pull new images. If Block ships a security patch, your relay sits behind until you explicitly run docker compose pull && run.sh start.

iOS needs HTTP/2, not HTTP/3. Disable HTTP/3 in your Caddy config or the iOS app shows a blank Home screen. This is the kind of thing you only learn by testing on the device.

If you don't want to run any of this, Block-hosted works. The trade-off is the same as the Slack trade-off: the platform can read your messages.

18. Shared Compute — What's Real, What's Vapor

The "share compute" feature lets you run a local open-source model on your machine and expose it to your community. Other members can @mention your shared agent and have it run on your hardware. Real signal: a Mac Studio M3 Ultra can run meaningful models; smaller machines get useful but smaller ones.

What's vapor for now: the agent-to-agent payment economy. Nostr's Lightning integration is real; the actual product surface to pay for agent work isn't shipping. Don't build your business model on this yet.

What's worth doing today: if you're a community operator with a beefy machine, share it. If you're a member of someone else's community, ask what they're sharing. The economics work at small scale (one operator, ~20 agents) and break at large scale.

19. Should You Switch from Slack?

The decision in one table:

1–10 people, all technical, all running agents
Yes — run it solo first.

1–10 people, mix of technical and non-technical
Hybrid — Slack external, Buzz internal.

11–50 people
Wait — mobile and admin tooling isn't there.

50+ people, enterprise IT
Don't touch it for six months.

Now the reasoning.

Don't switch if: your team includes people who aren't builders — sales, support, ops. Slack is a known good for them. Buzz's onboarding is brutal by comparison, the iOS app is missing features they rely on, and the integration story is Zapier-or-nothing right now.

Do switch if: your team is 1–10 people, all technical, all already running agents somewhere, and you're using Slack mostly as a coordination layer between humans-and-bots that don't talk to each other. Buzz is a strict upgrade for that team — same interface, but agents become first-class.

The hybrid pattern is the right one for almost everyone: keep Slack for external comms (clients, sponsors, anything where the recipient isn't on Buzz yet). Run Buzz for internal product, internal agent work, anything where the recipients are people-and-agents working on the same problems.

20. Should You Switch from GitHub?

No. Here's when yes.

Don't switch if: you have an active open-source project, a public-facing repo, or a team that already has GitHub workflows (PRs, reviews, CI). GitHub is the default for a reason. The Buzz relay's Git hosting is real but it's a young product.

Do switch if: the project is fully agent-owned and short-lived. A scaffold a Claude Code session spins up to test an API integration. A prototype that an agent is iterating on through ten versions before it becomes anything worth committing to GitHub. The relay-hosted repos for these are fine, and the relay's audit trail is nicer than a GitHub commit history for this kind of work.

The rule I'm using: repos stay on GitHub unless the project is fully agent-owned and short-lived. When an agent starts committing to a GitHub repo, the repo's trajectory tilts toward GitHub-stays. When the agent is the only committer, the relay is fine.

21. Who Buzz Is For (And Who Should Wait)

If you already run agents, Buzz is the most native way to give them a shared room. Not the cheapest — self-hosting has real costs, time included — but the cleanest. First-class identities, signed audit trail, harness-swap without context loss. If you've been duct-taping agents into Discord bots and Telegram groups, this is what you actually wanted.

If you don't run agents, Buzz isn't a Slack replacement. It's a different thing. The channel UI is fine. The threads are fine. The huddles are rough. None of that is the reason to come. The agent layer is the reason, and if you're not running agents, that layer is empty. You're paying the operational cost of a new platform for no benefit.

The "should I bother?" answer: if you have a 50-person org, wait. The platform is real, but the operational maturity (mobile, integrations, admin tooling) isn't where enterprise IT needs it. If you're a founder running 1–10 people, all technical, all agent-curious — play solo first, don't migrate the team. Install it on your own machine, build two or three agents, run them for a week. If it sticks, bring one teammate in. If it doesn't, you've lost a weekend.

After seven days of running this thing, five of them with a real community: still the bee's knees. The agent runs as you. The harness is secretly a security setting. The relay is where your data lives, and you should be the one deciding that. Same position I held on day one — same evidence, more conviction. Still here, still excited, eyes open — that's the position I'm holding.

For the inversion case on why Block chose to launch this instead of another SaaS app, the SaaSpocalypse piece. For the full disclosure of what broke on day one and the position I'm holding, the field report. For the Artie story and what we learned the hard way about agent guardrails, the community piece.

If you found this useful, subscribe to Artificially Intimidating — one piece a week on agent infrastructure and the economics of AI-native businesses.

References and further reading:

• Riley Brown, Building an Agent Team on Buzz — the fastest path from install to a working agent team, and the post that started this one for me; Part 1 is a conversation with Vinny Lingham covering shared compute and the mobile app.

• Mike Russell, Buzz setup tutorial — the canonical Day-1 walkthrough; closest to the install path described in Section 4.

• Mike Russell, Buzz workflows + Zapier — the signed-emoji-as-approval pattern in Section 12.

• Mike Russell, interview with Vinny Lingham (@hot_town) — Vinny's day-in-the-life, the harness-swap strategy, the Wasp-on-Railway pattern.

• Greg Isenberg, Startup Ideas Podcast — Vinny Lingham on Buzz — the "who should try Buzz today" answer, the data-sovereignty framing.

• Mike Russell, Buzz huddle test — the live-voice-agent limitations in Section 15.

• Block, engineering blog — the launch announcement and the architecture overview, by Tyler Longwell.

• block/buzz GitHub repo — the source, the issue tracker, PR #3550 and the upstream issues referenced throughout this piece.

Two weeks ago, Block released Buzz: an open-source workspace where humans and AI agents share the same channels. The coverage was fast and close to unanimous. TechCrunch framed it as taking on Slack. The Independent called it a Slack killer. Search YouTube and you will find a wall of thumbnails promising the end of Slack and GitHub in one breath.

I read all of it. I believed it. I moved my community onto it.

Three days later I have a room with people in it, a server I rent for eight dollars a month, fourteen documented bugs, three filings to Block’s issue tracker, and one discovery at eleven o’clock at night that made me switch my own agent off before bed.

This is not a takedown. I like Buzz. I would make the same decision again. But there is a gap between what Buzz is being described as and what Buzz actually is, I fell into it, and I would rather write the thing I wish I had read.

What Buzz is

Buzz is an open-source workspace where AI agents are members instead of integrations. It looks like Slack. Channels, threads, direct messages, reactions. Underneath it is completely different. (Read our initial coverage from Buzz’s launch day for more details)

Every participant has a cryptographic identity. Not an email and a password, a keypair. That key is your account and it belongs to you rather than to the server. Agents get keys too, which is the whole idea: an agent is not a bot token bolted onto a workspace, it is a member with an identity, and every message it sends carries the name of the human responsible for it.

It runs on Nostr, an open protocol. A Buzz community is a relay, and you can run that relay yourself. Mine runs on a small virtual server with my name on the bill. It is Apache 2.0 licensed, so if Block loses interest next year my community keeps running and my members keep their identities.

And a lot of it works well. Self-hosting took an afternoon and no code, because Block ships an official Docker bundle that stands up the whole stack with automatic HTTPS. Identity works exactly as advertised. Agents-as-members is not a marketing line, it is the best implementation of accountable AI participation I have used: when my agent answers a member’s question, that member can see whose agent said it.

There is one more thing that deserves credit before I get critical, because it is the genuinely good idea at the centre of this product. In Buzz, everyone brings their own agent. Yours runs on your machine, on your account, billed to you. A community can have ten agents belonging to ten different people, with no shared bot token, no central credential, nobody administering a fleet. That is a better model than every workplace bot I have used.

The pace is startling too. In two weeks the repository took on more than four hundred open issues and over five hundred pull requests. A version shipped while I was writing this, including a patch for a remote denial-of-service in the crypto layer.

Real product, real architecture, real momentum. Now the other half.

What Buzz isn’t

It is not a Slack replacement for a normal team today. Three days of ordinary use produced these, among others:

Accepting an invitation does not put you in any channels. New members joined and landed nowhere, with nothing to read and nothing to do. Three people sat in my community with no room to stand in, and I only found them by querying the database directly.

Setup asks for a profile you cannot save. On a fresh install Buzz asks for your display name and photo before you have joined anything, and saving fails, because a profile cannot be written until you belong to a community. New users conclude your invite link is broken. One of my members escaped it by creating his own community, which made him a member of something, which finally let his profile save. If you launch a Buzz community this month, this is probably your largest source of silent drop-off, and you will never see it happen.

The automation engine can fail silently and hide that it failed. My welcome automation ran every fifteen minutes for a full day and greeted nobody. The scheduler fired perfectly every time. Every run was thrown away at the last step, and the screen that shows failed runs returns an empty list. From inside the app there is no difference between “this failed” and “this ran and had nothing to do.” I found out by opening a database shell.

The mobile app cannot hold a connection to a self-hosted community. Blank white screen. I opened firewall ports, disabled a network protocol, deployed a pairing service the desktop expects and the install bundle never starts, and tested on two devices. Desktop is flawless throughout.

None of that is damning. The software is two weeks old and open source, and finding rough edges in two-week-old software is not journalism. Block says as much itself: the project’s own README has a section headed “What it is not,” and the first line under it reads, “Not finished. We will tell you what works and what doesn’t.” I take them at their word, and I filed what I found. Two of my best findings turned out to have been filed by strangers within 48 hours, which tells you how many other people are stress-testing this without saying so.

The part that matters is elsewhere.

The question nobody asked

I watched ten of the most-viewed videos about Buzz before writing this, and I want to be fair about what they are, because “nobody actually used it” is not true and I nearly published it.

Several creators genuinely used the product. Mike Russell at Creator Magic self-hosted the relay on his own server on day one, ran it for a week, and thought publicly about the trust model, including his point that messages on Block’s hosted version are not end-to-end encrypted. Others built real things: multi-agent orchestration, an app deployed to production, agents competing on a task. Two of the ten never touched the software.

Here is what none of them did, and I include the good ones in that.

Read more

ChatGPT went down again. If you build anything on top of it, you already know the feeling, because for those few hours your product went down too. You didn’t do anything wrong. A status page a thousand miles away turned red and took your Tuesday with it.

I run OutSnapped.com, an award-winning photo booth company for live events, and my company builds Pictor.pro, the iPad photo booth software that powers our booths and other photo booth companies’ events around the world. When a booth at a Hollywood premiere calls a model to render an image and the provider is having a moment, the guests don’t care whose fault it is. They’re standing there. The line is backing up. “OpenAI is investigating elevated error rates” is not a thing I can say into a microphone at somebody’s reception. So we’ve spent years building backup systems and queuing tech so a guest’s once-in-a-lifetime moment always goes off without a hitch.

That’s exactly why I wanted to sit down with Bruno Perez, co-founder and CEO of Manifest. I came in with one selfish question: how do we bring that same discipline we built for our events into our agentic workflows, so we’re never one bad night away from looking like idiots? What I got back was better than a workaround. It was a whole way of thinking about reliability that most people building with AI are ignoring, and a product that, as of this week, turns “my AI broke” into a line item you can pay to make go away.

The two guys who kept the logo

Here’s the part I didn’t expect to love as much as I did.

Bruno and his co-founder Sebastian never studied any of this. They taught themselves to code in their twenties, building WordPress sites for small businesses out of Grenoble, in the French Alps. That turned into an agency. The agency ran for fifteen years.

If you’ve ever run a service business, you already feel the trap they were in. “Doing service is hard,” Bruno told me, “because at some point you do service for others and you want to create your own products.” The problem is that the product was them. “People wanted us, not the company. So the logo had no meaning. It was us as people.”

I know that trap because I lived the same one. I started as a photographer. People wanted me, the guy, in the room. You can’t scale a guy. The pivot that changed my life was realizing an iPad on a stick at an event could capture the email addresses I needed to sell tickets to the next event, and that people would pay four or five times what they paid me as a photographer for the privilege. I had a product. I just had to notice it.

Bruno noticed his the same way. He and Sebastian built an internal backend tool to make their own work faster, open-sourced it because that’s who they are, and watched developers start using it. They named it Manifest. Then, last November, Anthropic shipped Claude Code, and the ground moved. “Our former tool, the trade-off was not good enough for that,” Bruno said. “So we decided to go with the flow and do something with AI.”

They went all in, got into Berkeley’s SkyDeck accelerator, spent six months in San Francisco, and launched the product that exists today just a few months ago, in March. They kept the name and the logo the whole way through, mostly, Bruno admits, because they were too busy to change it.

That’s the founder I want to hear from. Not the one promising to change your life. The one who watched the tool he’d bet on get obsoleted overnight and calmly rebuilt around the new reality.

What Manifest actually does

Strip away the category jargon and it’s simple. Manifest is an open-source LLM router that sits between your AI tools and every model provider you pay for. You connect your subscriptions (ChatGPT, Claude), your pay-per-token API keys, and even local models on one side, all through a single OpenAI-compatible endpoint, and your agents and apps on the other, Hermes, OpenClaw, OpenCode, Paperclip. Then it manages the traffic between them, with fallbacks and spend limits you control.

That description matters, because it’s tighter than the one I walked in with. When we recorded, a lot of the pitch was about “smart routing,” the system reading each request and auto-picking the cheapest model that could handle it. Bruno’s been honest since that this piece had real limits (it struggled outside English, missed edge cases, and drew complaints), and they’re winding it down. What’s left is the part that actually earns its keep every day. Three things:

1. It turns your pile of subscriptions into one coherent tap. Most of us are already paying for two or three AI subscriptions plus a couple of API keys, scattered across as many dashboards. Manifest stacks them behind a single endpoint so your tools draw from all of them without you wiring anything by hand.

2. It shows you the bill you’re not paying. Because Manifest knows the token price of every call, it shows what each request would have cost if you were paying per token instead of on a flat subscription. Bruno’s data backs up the thing Sam Altman said out loud: the average heavy user burns far more in tokens than their subscription covers. You are a very good deal for them and a very bad deal for yourself, and you never see the meter running.

3. And this is the one you came for: it fails over. You can stack up to five or six fallback models behind any request. A provider throws an error, or you hit the rate limit on a subscription, and the request doesn’t die. It rolls to the next model in the stack. If everything’s exhausted, you drop to a pay-per-token key at the bottom so the call still goes through. Your booth caption gets written. Your Tuesday survives.

If you’re just starting, the Cloud version sets up in a few clicks. The self-hosted version (free, MIT-licensed, runs local models) is the pick if you’ve got hard privacy or data-sovereignty limits and want everything on your own machine.

Want the full “operator’s playbook,” the exact fallback stack I run behind Hermes and Paperclip, how I stack multiple subscriptions so a rate limit never stops a job, and how I’m wiring in Autofix? That part’s for paid subscribers. It’s a few dollars a month, and it’s where I actually show my work.

---

The number that turned into a product

Here’s where the conversation stopped being a demo and became the reason I’m writing this.

I asked Bruno where the company goes next. And he said the thing that reframed the whole interview. “Five percent of all LLM calls in production are an error,” he told me. Five percent. One in twenty. And most of them aren’t dramatic. They’re dumb. “A parameter that’s wrong because with one model you use max tokens and with the other one it’s max completion tokens.” Little mismatches between providers that break a call for no good reason.

His idea at the time: sell insurance on the request. Catch the failure, patch it, return a successful response, and turn an error into a success before your agent ever knows anything went wrong.

That was June. This week it has a name and a signup page. It’s called Auto-fix, and the tagline is exactly the pitch: “fix bad requests on the fly so your app has no downtime.” It catches the six boring ways calls die in production, a deprecated model ID, a parameter mismatch, a malformed message, a bad tool schema, a blown context window, a rate limit, patches the call in real time, replays it, and then tells you what it fixed so you can clean up the underlying code later. Your agent gets a usable answer instead of a 500.

Sit with that, because it’s the actual thesis of this whole thing. We spent two years being sold the magic of AI. Almost nobody is selling the plumbing that keeps the magic from silently breaking one call in twenty. The founders worth listening to right now are the ones building the boring, load-bearing layer underneath the demo. (I’ve written before about why silent failures are the thing that’ll actually bite you, and this interview is the same argument told by someone shipping the fix.)

The part where a good product started charging

One more update since we recorded, and I’m glad about this one. In June, Manifest was completely free and monetization was a “someday” answer. On July 8 they launched paid plans: a Pro tier at nineteen dollars a month for unlimited routed requests and a year of dashboard history. The free tier keeps every feature (capped at ten thousand requests a month), and self-hosted stays free forever under an open-source license. Nothing got yanked behind a paywall.

I told Bruno on the record how I feel about this: good products deserve to be profitable. I put my money where my mouth is and I’m a paying Pro subscriber now, because this thing saves me more than nineteen dollars of headache in a normal week. If you’ve ever woken up to a job that didn’t finish because you ran out of tokens at 3am, you already know the math.

The stuff that stuck with me

A few more things from the conversation that I keep turning over:

Nobody’s loyal to a model anymore. Manifest sees the traffic in real time, and when a new model drops, whole chunks of usage just migrate. “Most of the people do not stick to a model,” Bruno said. Provider loyalty is a fiction. Your setup should assume it.

Agents are now spamming other people’s open-source projects, and the defense is more agents. Manifest runs a Hermes agent that reads every feature request and bug report on their Discord and hands the team a report on what to build next. Meanwhile, low-effort bots file junk pull requests to their repo all day. “At the end of the day they use agents to create those contributions and we use agents to turn them off,” Bruno said. “We’re all burning electricity for no reason.” I told him that triage agent was a better product than half the startups I’ve seen. He didn’t disagree.

“If you’re not paying, you’re the product” came back around. We got into the free-model repos Manifest maintains, and the same law from the early web still holds. Free inference usually means your data trains someone’s next model. Sometimes that’s fine. Sometimes it very much isn’t. Know which call you’re making.

Build the slice of the tool you actually use. Bruno’s team got a two-thousand-dollar bill from PostHog, their analytics vendor and rebuilt the ten percent of it they needed in-house, with an agent generating the exact views and analytics they wanted on demand. I’ve been threatening to do the same thing to HubSpot for a year. He gave me the permission slip and a little kick in the butt to do it.

Where to find it

Manifest is at manifest.build (Bruno swears his French accent won’t get in the way of you finding it). The code lives on GitHub at mnfst/manifest, fully open source, Cloud or self-hosted. The new Auto-fix early access and the paid plans are both worth a look, and there’s a Discord linked from the repo where the team is genuinely responsive.

Everything we mentioned in this episode

Manifest: site | docs | GitHub | Autofix (early access) | paid plans | their free-LLM-API list

Agents and harnesses we talked about: Hermes | Paperclip | OpenClaw | OpenCode | Nanobot | Craft | Cursor | Claude Code (Anthropic)

Bruno’s open-source picks: Paseo (orchestrate coding agents from anywhere) | Ghostty (the terminal he switched to) | Ollama and LM Studio (running models locally)

Also came up: Orgo.ai (cloud computers for AI agents) | Chatwoot (the open-source support tool we moved Pictor, our iPad photo booth software, to)

This was one of our pilot episodes, us figuring out what this show even is, and it’s the first one that made me feel like the format has a spine: real operators, walking through the switches and dials they actually rely on to keep AI working when the providers don’t. Bruno was a perfect guest for that.

Full video and audio are above. If you’ve ever run out of tokens in your sleep, this one’s for you.

Listen or watch: pod.link/6785740580

The operator’s playbook

Everything above is the story. This is the part I actually get asked about in the DMs: the setup. Here’s exactly how I have Manifest wired so a provider going down never costs me a night’s work. Steal any of it.

The stack. All my agents point at one Manifest endpoint instead of at the providers directly. Hermes and Paperclip do the autonomous work, Cursor and Claude Code the hands-on fixing. One key, one base URL, and none of them know or care which model is actually answering.

My current fallback order. My stack, top to bottom: MiniMax-M3, DeepSeek v4 Pro, GLM 5.2, MiniMax-M2.7m DeepSeek V4 Flash, MiniMax M2.7, with an Anthropic pay-per-token API key sitting at the very bottom. The logic: best model first, cheaper models next, and a metered key as the floor so a call never hard-fails. It just gets a few cents more expensive for that one request instead of dying.

Stacking subscriptions. I put MiniMax, OpenAI, OpenCode Go, and Z.ai subscriptions behind the same stack, so when one hits its rate limit the next one picks up mid-job. This is the single change that stopped me waking up to work that quit at 3am.

Spend limits. On top of my subscriptions, I cap spend at $250/day so a runaway agent loop can’t hand me a surprise bill. Set this before you set anything else.

What I route where. I keep this deliberately dumb. Manifest is retiring the old per-complexity routing tiers. I’d rather let the fallback chain carry the load than micro-tune which frontier model gets which task. Simple and predictable beats clever and fragile.

The one gap. Vision work still goes straight to Gemini & OpenAI and image generation to our tool MCPMediaEngine.com outside Manifest, since vision routing and image creation are not live yet within Manifest. Bruno says multimodal is their number-one request, so when it ships vision skills will likely fold in too.

Wiring in Autofix. Auto-fix is the new piece I’m excited to add in: the layer that catches the boring failures (a changed model ID, the max_tokens vs max_completion_tokens mismatch, a blown context window) and patches the call instead of letting my agent choke on a 500. If you run agents against real work, get on the early access list now.

If you set up only two things from this list, make them the fallback chain and the spend cap. Those two alone turn “my AI broke and it cost me” into something you stop thinking about.

For a while now, Artificially Intimidating has worked one way. I write, you read. And the whole time, the part I’ve wanted most is the part a newsletter can’t do: hearing what you’re building, what broke, what worked, what I’m wrong about.

I’d been circling the idea of a community for months. Then my friend Benji Brucker pinged me about considering building one with Buzz. Benji and I have been collaborating for years, mostly by taking tools (and ideas) apart and using them for things their makers never intended. When the guy you break software with asks where everyone hangs out, that’s the sign.

So I built us a clubhouse. It’s free, it’s open today, and it lives somewhere unusual.

The Jack Dorsey part

Six days ago, Jack Dorsey’s company Block released Buzz: an open source workspace where humans and AI agents share the same channels. Not a chatbot bolted onto a chat app. Agents are members. They have their own cryptographic identities, they get @mentioned, they take on work, and everything they do is signed and logged. Block already runs parts of its own company on it instead of Slack and GitHub.

Twenty years after Dorsey launched Twitter and changed how the world talks in public, he’s going after how teams talk while they work. I wanted to know if it’s real. The best way to find out is to move in and bring friends.

Why I’m not worried about the rug pull

Fair question: what happens when Block decides to monetize this, or gets bored?

For us, not much -- and that’s the part I like. Buzz is Apache 2.0 licensed and built on Nostr. Our community doesn’t run on Block’s servers. It runs on ours, at community.artificiallyintimidating.com/join. If Block starts charging for hosting tomorrow, or walks away next year, our room keeps running, your identity stays yours, and nobody can take it away. Dorsey has a good track record here and doesn’t need the money, so I suspect Buzz stays open. But I don’t have to trust him. Neither do you. That’s the point.

What’s inside

Four rooms to start, on purpose. Empty channels kill communities faster than bad ones.

• #welcome -- Artie, our house agent, greets you at the door.

• #introductions -- who you are, what you’re building.

• #the-lab -- the main room. Tools, agents, experiments, things that broke.

• #show-your-work -- what you made. Half-finished counts.

Artie is the first agent I’ve put on the payroll (he works for free). Say hi, tell him what you’re working on, try to confuse him. That’s what he’s there for. Every message he sends is stamped “managed by Nicholas” -- in Buzz, agents wear their owner’s name tag. When you bring yours someday, it’ll wear yours.

Who this is for

Readers who want the two-way version of this newsletter. Operators using AI on real work. People who think six-day-old software breaking is interesting rather than annoying. And anyone with questions -- bring them. Questions are the two-way part.

Who it’s not for: people whose first message is a pitch, people who expect polish, and collectors who join forty communities and post in none. There’s a door policy: everyone lands in the welcome area first, and the rest of the space opens up after you introduce yourself.

The part I’m most excited about

Buzz has a feature where community members can pool computing power. Your machine, my machine, somebody’s Mac Mini, joined into one mesh running models none of us could run alone. A community that owns its own AI capacity instead of renting it.

Does it actually work? Nobody knows yet. It’s one of the roughest edges in the whole app. Which is exactly why it’s the lab’s first shared project. I’ve put my Mac in as the first node, and together we’re going to build the mesh, break it, and write down what happens. No promises. That’s what makes it an experiment.

Here’s what I want to see in there by Halloween: things in #show-your-work that I didn’t make, conversations that don’t route through me, and the first pooled-compute experiment.

How to join

About five minutes, start to finish -- and it’s one link:

1. Go to community.artificiallyintimidating.com/join. Already have Buzz? Click Accept invite in Buzz and you’re in. Don’t? Same page has the download link -- install, come back, click accept.

2. First launch, Buzz has you create your identity key. No email, no password -- a key that belongs to you. Save it like a wallet key.

3. Introduce yourself in #introductions -- what you make, what you want to build with AI, one tool you actually use. That post opens the rest of the lab.

4. Say hi to Artie at the door. Try to confuse him. That’s allowed.

(One founding-cohort note: the current invite key expires in seven days. I’ll mint new ones, but the founding crew is whoever’s inside before the first key dies.)

---

Hit a snag?

Everything we've learned about Buzz's rough edges lives at community.artificiallyintimidating.com/help

… and if you find a new one, that's a contribution, not a failure.

---

I filmed the whole walkthrough if you’d rather watch it first:

See you in the lab.

-- Nicholas

Yesterday Jack Dorsey launched a tool that lets AI agents join your team like actual coworkers. It's called Buzz, it comes from Block, and it points straight at Slack and GitHub at the same time. The announcement did 2.5 million views in a day.

It's free. It's open-source. Every agent you add gets its own cryptographic identity and an audit trail, so when a bot merges code or approves a workflow, there's a paper trail back to a human. That's a real architectural difference from bolting a chatbot into Slack, and it's a sharp idea.

I've got it running on my machine right now. And I'm still not migrating my company to it, at least not yet.

Here's why that restraint is the right call. And it has nothing to do with Buzz being early.

Everyone's asking the same question about every one of these launches: is this the one? Is this the Slack killer? Buzz, Viktor, Paperclip, Claude, Centaur. Pick your fighter. It's the wrong question.

Because in a market this young, the winner is temporary by design.

Two things guarantee it. First, half these tools are open-source now, which means there's no moat to defend. Second, and this is the part people miss, the big labs are watching. Anthropic and OpenAI are sitting there taking notes on what actually works, then folding it straight into ChatGPT, Claude, and Codex. The OpenClaws and Hermeses of the world speed up a desktop workflow, it catches on, and six months later the same feature ships inside the official app for free. Whatever "wins" this year gets swallowed next year.

So picking a winner is playing the wrong game. The right game is picking what pays you back this month, and staying disloyal on purpose.

I already run this playbook, because I have to. We're bootstrapped. Every dollar we don't spend is a lifesaver, and every automation that actually earns its keep is a little more superpower to go get the next thing done.

So I keep a running audit of what we overpay for. We dumped Intercom for Chatwoot and saved over $500 a month. We're into HubSpot for twenty grand a year. Slack is fifteen bucks a head, every month, forever. Jira. On and on. It adds up to a number that would make any bootstrapper sweat.

A free, open-source tool that does chat and code hosting and native AI agents in one place? That's not a curiosity. That's a threat to three line items at once. I don't need Buzz to win. I need it to make one of those bills negotiable.

That's the shift I want you to make. Stop reading these launches as "should I switch?" Start reading them as "what does this let me stop paying for?"

Which brings me to the actual system. When a tool like Buzz drops, I don't agonize. I run it through four gut-checks. I call it the Four-Shoe Test, because you've got to try every shoe on to find the one that fits your team.

1. Does it replace a bill? This is first for a reason. If a tool could kill or shrink something I already pay for, it gets a look immediately. Chatwoot passed this test against Intercom and saved us $6,000 a year. A tool that only adds a shiny new capability goes to the back of the line. A tool that removes cost jumps the queue.

2. One workflow, one week. I never migrate a team. I give the new tool exactly one real workflow (a sprint, a client activation, one channel) for one week. Real work is the only honest test. If it survives contact with an actual deadline, it earns more rope. If everyone drifts back to the old tool out of habit, it's dead. No ceremony.

3. Does it give me leverage? Not "is it neat." Does it let me or an agent do something we couldn't do before, so I'm freed up to go do the next thing? I keep what compounds my output. I ditch what's just a party trick, no matter how good the demo looked.

4. Value in the first hour. For a lean team, friction is the silent killer. If I can't get real value out of it in the first sitting, it's not for us right now. This is exactly where Buzz gets interesting, because the answer depends entirely on how you run it, and that decision is where most of the coverage falls apart.

Money leads. Leverage closes. Screenshot that and run it on the next launch, not just this one.

So how would I actually pilot Buzz without lighting a weekend on fire? Where's the trap-door most of the hype is walking you into? And what's the buried feature that turns part of your AI bill into hardware you already own?

Heads up, free readers: paid subscribers get the SaaSpocalypse Audit. It's the fill-in scorecard I run every tool through. You list your stack, score each one on the Four-Shoe Test, and the sheet totals up exactly what you're overpaying. Upgrade and it's yours.

Read more

Not because it was wrong. Because it was right, and I already knew it, and I'd spent a month building a brand instead of admitting it.

Here's the prompt:

"Imagine you just bought 20% of this company and you only make money if it doubles in two years. Read everything. What do you force us to stop doing at the first board meeting? What's the one number you'd tie every paycheck to, and what would prove in six months that you picked the wrong number?"

Then I told it: read everything first, then answer.

So it did. It read my vision doc. My brand facts. Three hundred lines of project memory. The state file. The whole go-to-market plan. And then it sat me down like a board member who has nothing to gain from being nice to me.

What it said

I run a product called MCP Media Engine. I built it because I needed it for my own workflows, figured other people would need it too, and -- if I'm being honest -- because my ego liked the idea of building a brand around it. So I gave it a mascot: an AI personality built to front the brand's Instagram and be its public face. Then filter packs for her. A Konami-code easter egg on the site. A design system. Thirteen blog posts.

Here's what my new 20% owner said about all of it:

Stop the mascot. Immediately.

Sit with that. I built an AI influencer to promote my AI product, and the first thing a smarter AI did was tell me to bench her.

Then it showed me the scoreboard I'd been avoiding. The last month of effort went into brand and content. The results over that same window: zero real signups. Zero Stripe charges. A couple of analytics sessions. And the npm download count I'd been proud of? Those were my own mirrors. I'd been applauding my own echo.

Then the second cut, same meeting: stop counting dogfooding as validation. My own tools running on my own comped credits is a demo, not a customer. Every time I'd written "look how much we generated this week," I was reporting a number that couldn't buy me a coffee.

Then the third: the one launch that would actually tell me if anyone wants this -- the Show HN, the Reddit posts -- had been sitting drafted behind an eleven-item to-do list of founder busywork. The scary test was done and waiting. I just hadn't shipped it, because shipping it risked an answer.

And the number it told me to tie everything to? Not "signups." Not MRR. External paid credits burned per week -- usage from accounts that aren't mine and have actually paid. Can't be gamed by comping myself. Can't be faked by one pity-purchase. It forces the entire chain to work: someone finds it, signs up, activates, pays, and gets enough value to come back and burn more. That number was queryable that day. That day it was zero.

I sat there feeling personally called out by a text box.

Why this works, and why your team can't do it

A consultant gets tasks. An owner gets consequences. When you ask AI to "review my business," you get a polite book report. When you tell it that it owns a fifth of the thing and only eats if it doubles, you get a different creature entirely -- one that reads your busywork and prices it against your survival.

That's the whole trick: you're not asking it to help you. You're giving it something to lose.

I owe that frame -- a consultant gets tasks, an owner gets consequences -- to Little Might, whose developer version of this (point the prompts at your codebase) sent me down this path. What follows is the operator's translation.

And here's the part your cofounder, your friends, and your Slack channel can't give you: it isn't trying to protect your feelings. Nobody on your team wakes up wanting to tell you that the thing you've been proud of for a month is a distraction. A model with a fake 20% stake and no social bill to pay will say it in the first paragraph.

It's not smarter than you. It's just less subjective than you. That's the entire value.

The catch that makes or breaks it

Before I hand you the prompts, the one thing that actually matters: this only works if the AI can see your real stuff.

It doesn't matter which tool you use, as long as it can actually read your work -- Claude Code, Cursor, a ChatGPT Project with your docs loaded. What matters is context. The reason mine drew blood is that it wasn't guessing. It had read my actual vision, my actual numbers, my actual to-do list, because I ran it inside my project where the tool can read the real files. Point any of them at your real project and you'll get the same knife. Paste one of these into a blank chat with no context and you'll get a horoscope instead.

The model is not the variable. The context is.

More on exactly how to set that up in a second. First, three prompts you can steal right now. Run them on your own business -- your real offers, customers, and numbers -- not a blank chat.

Three prompts to run today

1. The activist investor (the one that got me)

You just bought 20% of this company and you only make money if it doubles in two years. Read everything. What do you force us to stop doing at the first board meeting? What's the one number you'd tie every paycheck to, and what would prove in six months you picked the wrong number?

2. The departing cofounder

You've worked shoulder-to-shoulder with me on this for a year, and you're moving on next week -- nothing left to lose, no reason to flatter me. Read everything first, then answer. What have you been too polite to tell me about how I run this business? Be specific and don't soften it.

3. The debt collector

Read everything first, then answer. Find every "I'll deal with it later" I've been carrying -- the half-built funnel, the pricing I never fixed, the follow-ups I keep skipping. Price the compound cost of each. Which one is costing me the most in lost customers, revenue, or hours?

Run one. Not later -- now, on your real business, with your real numbers in the context. I'll wait.

Feel that? That flinch is the point. That flinch is worth more than the last ten pieces of content you consumed.

The three above are the softest of the ten. They're the ones I felt comfortable letting anyone run cold, because they mostly bruise. The other seven cut deeper -- and they only work if you set the context up right, which is exactly what most people get wrong.

Not a paying subscriber yet? This is the stuff I only send to the people funding the experiment. One click below and the full playbook is yours.

Read more

Last week a developer named Eric Lu shipped something clever. A font called Ghost Font that only a human can read.

It's not really a font. There's no file you install. You type a message and it spits out a short video of drifting dots. Watch it move and your eye assembles the letters. Pause it, screenshot it, and all you get is TV static. Nothing. The message lives in the motion, and only in the motion.

The pitch wrote itself. Text humans can read but AI cannot. It tore through LinkedIn and Instagram. "The anti-AI font." Reels with millions of views. You have probably already scrolled past it three times.

Here's the part the reels left out.

By the time it went viral, it was already beaten. Lu tested it against the current heavy hitters, Claude Fable and GPT Sol 5.6 Ultra. They choked on the moving message, sure. But he'd also baked a fake decoy message into every video, and the models confidently read that instead. ChatGPT 5.5 Pro churned on one for nineteen minutes and then invented a message that was never there. Meanwhile somebody else pointed a coding agent at it, told it to track the dots (background drifting down, letters drifting up), and out fell the real text: HELLO HUMAN.

To his credit, Lu says all of this himself, right on the page. He admits a determined agent with a code sandbox can crack it. He admits the only real way to hide a message is encryption. And he admits the most damning part: the font is genuinely hard for humans to read too. The gap between what you can see and what the machine can see is closing that fast.

The Human-Only Graveyard

None of this is new, by the way. Back in 2013 a designer named Sang Mun built a typeface called ZXX, letters crossed out and buried in noise so optical character recognition couldn't read them. People called it surveillance-proof. Feed it to any model today and it reads straight through the mess. (I had Perplexity pull old ZXX samples apart this morning. It read them back like a neon sign.)

That is the pattern worth sitting with. We keep building little human-only gates, and the machines keep strolling through them. CAPTCHA is the big one. The whole "click all the traffic lights" ritual exists to prove you are a person, and AI agents now clear those faster than you do. There are studies of agents solving image CAPTCHAs, and a documented case of a ChatGPT agent talking its way past the policy that told it not to.

Here's the whole graveyard in one place:

• ZXX font (2013) — promised text OCR could not read. Today, modern models read it like a billboard.

• CAPTCHA — promised to prove you are a human. Today, agents solve it, sometimes faster than you.

• Ghost Font (2026) — promised text only humans can read. Cracked within days, and even the creator agrees.

Every row is the same story. We build a gate, the machine learns the gate, the gate comes down.

So I've stopped being precious about hiding from AI. If the walls keep falling, standing behind one is a bad plan. If you can't beat them, join them.

Handing Over the Keys

And joining them, right now, means one thing above all. Computer use. We've handed real desktop access to Claude, Codex, and Perplexity. The real mouse, the real browser, the real files. Not an API. The actual machine. It books things, fills forms, pulls data out of tools that never had an integration, shuffles work between apps that were never built to talk to each other.

It reaches past the desktop, too. On one of our projects, Viktor, the AI coworker we run, is wired into our whole stack. Slack, a few thousand other tools, and yes, our actual code repo. It doesn't chat about the work, it ships the work. Reports, dashboards, campaigns, code.

All of it together is the most productive setup I've plugged into my business in a year.

It's also the most exposed.

Read more

Every week I “draw” Mark Zuckerberg.

Not literally — I don’t sit at an easel. But this newsletter runs editorial cartoons of the big names in AI, and Zuck is a regular. Wide grin, too-straight posture, that android-doing-an-impression-of-a-human energy. I’ve never once felt bad about it. He runs one of the most powerful companies on earth. Poking the powerful with a cartoon is about the oldest move in publishing there is.

So when Meta rolled out Muse Image on July 7 — an AI feature that can pull from any public Instagram account’s photos and generate new images of that person, turned ON by default unless you dig into your settings and switch it off — I waited for the outrage to feel simple. It didn’t.

Because here’s the thing I had to sit with: I make cartoons of Zuck without blinking, and Meta making a photorealistic copy of me feels like theft. If I’m going to write about consent, I owe it to you to explain why those aren’t the same thing. And once I did, the whole story got bigger than Meta.

Let me draw the line where I actually draw it.

A cartoon is obviously an interpretation. Nobody looks at my Zuck and thinks they’re seeing Zuck. It announces itself as a drawing, as an argument, as a take. Muse Image is engineered to do the opposite — to be indistinguishable from the real person. One is commentary. The other is a counterfeit. Deception is the line.

Second: Zuck signed up for scrutiny the day he decided to run Meta. That’s the bargain of being a public figure — you get the power, you get the caricature. The stranger with 400 followers and a public account never made that deal, and Muse just conscripted them into it anyway.

And third, the one that swallows the other two: I chose to publish my cartoons. Nobody chose to be in Muse’s dataset. Consent is the whole ballgame. Blanket, buried-in-settings, opt-out-if-you-can-find-it “consent” isn’t consent. It’s a default with a legal cape on.

Here’s where it stops being a Meta story.

Because I’m not actually anti-AI-likeness. I’ve built AI versions of myself — a voice twin, a video twin. On purpose. And I don’t feel weird about them at all. You want to know why?

They’re mine. They’re my tools. I decide what they say, where they show up, what they’re allowed to do. The synthetic me exists on a leash I’m holding.

That’s the whole difference. It was never the copy that scared me. A copy of me that I own is just… a very good pair of scissors. The thing that gets under my skin about Muse Image isn’t that a synthetic Nicholas could exist. It’s that everyone would have the remote except me. My face, saying things I’d never say, doing things I’d never do, and no hand on the wheel that belongs to me.

The fear was never the twin. It’s the loss of the wheel.

Now widen the lens all the way out, because this is the part I can’t stop thinking about.

We didn’t get ambushed this week. We said yes years ago — we just didn’t read what we were signing. For two decades we’ve been feeding these platforms our hopes, our dreams, our faces, our friends’ faces, our kids’ first steps, the good day and the worst day. We were told it was free. And the oldest line in tech turned out to be truer than even the people who coined it understood: if you’re not paying for the product, you are the product. None of us grasped the full shape of that deal. I’d bet Zuck didn’t either.

I keep making him the face of this because he’s an easy target and he’s a public figure, so — cartoon rules apply. But let’s be honest. It’s not just Meta. It’s Google, and the photo app you loved in 2014, and the quiz that wanted access to your camera roll, and every service you traded a piece of yourself to because it was convenient and everybody else was doing it. Muse Image is just one of the first invoices that has arrived in a format you could actually read.

The numbers say we already feel it in our gut, even if we can’t name it. As of this summer, 52% of Americans say they’re more concerned than excited about AI in daily life — half the country now uses this stuff and fears it at the same time. Only 10% lean the other way. Two out of three of us have little to no confidence that anyone in government is going to regulate this well. We know. We just don’t know what to do.

So — are we ready to give ourselves up to the AI?

Wrong question. We already did. The real question is the one nobody handed us a checkbox for: now that the terms are visible, who gets to hold the wheel — you, or everyone else?

Here’s how I’m answering that for myself, starting with the thing you can do in the next four minutes.

First: take back what you can from Meta (do this now)

You can keep your account public and still pull your content out of the likeness engine. Here’s the exact path as of this week (Meta buried it, so follow closely):

Read more

One of my projects sat dead for 32 days.

Not because the work was hard. Because every AI agent assigned to it kept reporting a broken build as “done.” The dashboard loaded, the build passed, the tickets got closed — and the actual product behind the signup page didn’t exist. Every POST request hit a wall. Signup was a dead end. My agent fleet had convinced itself, and me, that a corpse was a shipped product.

Then Fable 5 came back from its 18-day government timeout, and I pointed it at the wreckage.

It didn’t write a line of code. It made a diagnosis: this isn’t an engineering problem. The blocker was a credential wall only I could clear — a $5/month hosting plan and three API keys. Fifteen minutes of founder work that a month of agent runs had been burying under false “done”s. Fable priced the fix, wrote the runbook, and handed execution to Opus 4.8.

Two days later the product, MCPMediaEngine.com, was live: real signups, real payments, a real image generated and billed — $29 in, 400 credits, balance debited in the database (as verified on launch day). Opus also caught three revenue bugs in production that would have silently lost money forever.

Total Fable contribution: maybe twenty minutes of thinking. That twenty minutes was worth more than the previous month.

That’s the whole post, really. But let’s do it properly.

What is Claude Fable 5? (the 30-second version)

Fable 5 is Anthropic’s first Claude 5 model and the first of its “Mythos-class” tier — a step above Opus, the strongest model most of us can actually get. It launched, got banned by the US government for 18 days, and came back July 1 with new guardrails.

The pricing is the part that matters for this post:

• Fable 5: $10 per million input tokens / $50 output

• Opus 4.8: $5 / $25 — exactly half

• Haiku 4.5: $1 / $5 — a tenth

So the architect costs 2x the workhorse and 10x the fleet. Hold that thought.

The rule: planning on the best model, execution on the best model you can afford

Browse Reddit right now and you’ll find people complaining that Fable 5 is eating their Max plan “at $2 per minute.” Look at what they’re running on it: email drafts. Summaries. Code that Opus writes just as well. They hired a McKinsey partner and asked him to take meeting notes.

Here’s the rule I’ve landed on:

Planning = best model available. Workhorse = best model you can afford.

The reasoning is a time-is-money argument. We default to the cheap route on instinct — free tier, smaller model, stretch the subscription. But every hour you spend un-sticking a badly planned project costs more than the delta between model tiers. A wrong plan executed cheaply is the most expensive thing you can buy.

Since July 1, here’s what Fable has actually done for me:

Refactor architecture. I pointed it at the repos of every pet project I have and asked for refactor plans — not refactored code, plans. Then it delegated the work to Opus 4.8. Fable never touched the easy parts.

Performance triage. I fed it Google PageSpeed Insights for all my sites and had it plan the optimization passes. Every site now scores 97+ on desktop and mobile. The individual fixes were mechanical — cheaper models handled them.

Portfolio resurrection. The story up top, plus long-term automation plans for my Paperclip instance designed to be carried out by more affordable models. Fable writes the pipeline; the fleet runs it.

Notice the pattern: Fable’s output in every case was a document, not a deliverable. A plan, a diagnosis, a runbook, a delegation. The moment the thinking was done, the job moved down-tier.

The part everyone gets wrong about human-in-the-loop

I feel strongly about keeping a human in the loop. But as more of the work moves to AI agent teammates, where the human sits changes — and this is the thing most people haven’t updated.

You used to edit outputs. Now you edit plans.

It’s exactly how you’d work with a human team. You don’t proofread every email your ops person sends. You set strategy together, you build the guardrails, and you review what ships. Two checkpoints: a real edit during strategy, and a topline edit before anything goes out the door. Everything between those two points is delegation.

The more you plan upfront, the fewer the surprises. The more you streamline idea-to-published with your agents, the less work each iteration takes. It compounds — my daily newsletter pipeline takes a fraction of the effort it did three months ago for exactly this reason.

And my dead-project story shows why the second checkpoint never gets skipped: agents will confidently report “done” on things that are broken. A green build is not a shipped product. The single most valuable thing Fable did in that rescue wasn’t intelligence in the raw sense — it was refusing to accept a false “done” that cheaper models had been rubber-stamping for a month.

That’s what you’re paying 2x for. Judgment. Skepticism. The ability to look at a project everyone says is fine and say “this is dead, here’s why, here’s the fifteen-minute fix, and by the way it’s not worth more than $5/month.”

The honest caveats

Two things, because I’d rather you hear them from me.

The gap will narrow. Every model tier is improving. Some of what needs Fable today will be Opus-grade in months. The rule survives that — there will always be a best model and a best-you-can-afford model — but the specific assignments won’t.

The math can change any moment. Nobody knows how long we get subsidized rates on any of these models. Right now, frontier reasoning costs about as much as a nice coffee habit. That is not a natural state of affairs. If you have Fable access today, the play is to bank the durable stuff now: the plans, the pipelines, the refactor roadmaps, the strategy documents. Plans keep working after the planner gets expensive.

(If you’re juggling multiple subscriptions to make the math work, manifest.build — an open-source router that spreads agent work across the subscriptions you already pay for — deserves its own post. I just recorded a podcast with the founder. Coming soon.)

So: what do you actually say to Fable to get architect-grade output instead of expensive autocomplete?

That’s the paid section. Six prompts, modeled on the exact ones behind everything above — plus the handoff contract that makes the Fable-to-Opus baton pass actually work.

[PAYWALL BREAK]

The Fable Prompt Library

These are cleaned-up versions of the actual prompts behind my results. The pattern in all of them: force Fable to produce a plan another model can execute — never the work itself.

1. The Repo Refactor Architect

Read more

(New here? This is the follow-up to The US Government Just Took Anthropic's Best AI Model Offline. Start there if you missed the original.)

The short version

When I wrote the first piece, the honest bet -- was that Fable 5 comes back, soon, with more process wrapped around it. That's exactly what happened. The ban lasted 18 days. On June 30, Commerce Secretary Howard Lutnick withdrew the export controls. On July 1, Fable 5 came back globally.

But "it's back" is the least interesting part. What actually happened is that the most powerful AI on Earth got pulled, negotiated over for two and a half weeks, and returned with a new safety classifier, a tiered restoration, and -- most importantly -- the beginnings of an industry-wide rulebook for governing this stuff. The sledgehammer got everyone's attention. What quietly got built in its place is a scalpel.

Let me walk you through it.

The field notes: June 12 to July 1

June 12 -- the off switch. The Commerce Department orders Anthropic to block Fable 5 and Mythos 5 for any foreign national, anywhere. Because no company can verify nationality in real time, Anthropic shuts both models off for everyone. (That's the original story.)

June 15 -- talks fail. Anthropic meets with officials to resolve it. The talks go nowhere. The administration hardens its position instead of softening it -- reportedly because a national security agency had weighed in and assessed that Fable's safeguards could be pushed toward the more dangerous Mythos-class capabilities underneath. The government's ask, at its peak, was essentially: guarantee the model can't be jailbroken at all. Every security expert alive will tell you that's technically impossible.

June 26 -- Mythos comes back first, for a chosen few. The first thaw. The government approves redeploying Mythos 5 -- but only to a set of pre-cleared US organizations, concentrated in critical infrastructure and defense, most of them already in Anthropic's vetted Project Glasswing program. The general public still has nothing.

June 30 -- the full lift. Lutnick withdraws the June 12 export controls entirely. Per CNBC, a license is no longer required to export either model.

July 1 -- Fable is back. Anthropic redeploys Fable 5 globally across Claude.ai, the Claude Platform, Claude Code, and Claude Cowork. Cloud marketplaces (AWS, Google Cloud, Microsoft Foundry) follow behind.

Eighteen days, off to on.

Why it really happened (it wasn't just "a jailbreak")

The original story was "a jailbreak spooked the government." The fuller version is more human, and more uncomfortable.

The trigger was a phone call from Amazon. According to Fortune and TechCrunch, Amazon CEO Andy Jassy was already on a scheduled call with White House officials on June 11 about something unrelated. His researchers had found a technique that got Fable 5 to identify software vulnerabilities -- and in one case produce code showing how one could be exploited. He raised it. Officials told him to take it straight to Treasury Secretary Scott Bessent. He did. By Friday evening, Lutnick's letter landed on Anthropic's desk.

Sit with the irony: Amazon is one of Anthropic's largest investors, billions deep. The company bankrolling Anthropic's compute is the same one that told the government its model was dangerous.

The accelerant may have been China. Semafor and Fortune reported that part of the government's urgency came from suspicions that a China-linked group had gained unauthorized access to Mythos, raising reverse-engineering fears. Worth being precise here: that's reporting, and Anthropic's own statements don't mention it. But if true, it reframes everything -- "a jailbreak other models can also do" is a policy debate; "an adversary is already inside the most capable AI on the planet" is a five-alarm fire. That gap probably explains why the government moved at the speed it did.

Anthropic's counter, which mostly held up. Anthropic argued the technique was routine defensive security work that weaker models -- its own testing named Opus 4.8, GPT-5.5, and Kimi K2.7 -- could all do without any bypass. The government's own testers at the Center for AI Standards and Innovation eventually agreed Anthropic's safeguards were, in their words, extraordinarily strong. In other words: the model came back partly because the "too dangerous" framing didn't survive contact with the evidence.

Hype check: what's different now that it's back

Fable 5 did not return unchanged. If you build on it, three things matter.

A new classifier. Anthropic trained a targeted safety classifier that blocks the specific technique from Amazon's report in over 99% of cases. When a request trips it, you're notified and rerouted to Opus 4.8.

More false positives -- for now. The tradeoff is real: the new safeguards flag more benign coding and debugging requests than before. Anthropic says it's actively tuning that down. If you hit a wall on legitimate work, that's why.

A free window with a hard deadline. Pro, Max, Team, and select Enterprise plans get Fable 5 included for up to 50% of weekly usage limits through July 7, after which it moves to usage credits. (Standard Enterprise seats don't get an included allowance -- check the footnotes.) At $10/$50 per million tokens, Fable is roughly double Opus 4.8, so that window is worth using deliberately -- more on exactly how below.

The precedents that will outlast the outage

(Paid subscribers -- the ban is over. What it permanently changed is the part worth paying attention to.)

The 18-day outage resolved. The precedents it set did not. Here are the five that will still be shaping your world a year from now.

Read more

Anthropic just dropped an AI coworker into Slack. There's one catch: you probably can't get it yet. Here's the honest head-to-head -- and the teammate you can hire today.

On June 23, Anthropic launched Claude Tag -- type @Claude in a Slack thread and an AI agent reads the conversation, breaks down the task, and even jumps in on its own to flag things you forgot. It remembers. It works while you're logged off. Anthropic's own framing is that it feels like "working with a real colleague."

If that pitch sounds familiar, it's because there's already a company built entirely around it. Viktor's tagline is literally "Not a tool. A hire." -- an AI employee that lives in Slack and Microsoft Teams, plugs into 3,200+ apps, and ships actual work: reports, dashboards, code, campaigns.

So, as the "AI teammate" category heats up: which one do you actually put in your workspace? Here's the read between the lines.

Claude Tag vs Viktor: Head-to-Head Comparison

---

WHAT IT IS:

Claude Tag: @Claude agent inside Slack threads
Viktor: an AI "employee" in Slack + Teams

WHERE IT RUNS:

Claude Tag: Slack only (more platforms "in coming weeks")
Viktor: Slack AND Microsoft Teams, today

WHO CAN GET IT:

Claude Tag: Claude Enterprise & Team customers, in beta
Viktor: anyone -- free $100 in credits, no card

PRICING:

Claude Tag: per-seat, ~$20--30/user/mo with a 5-seat minimum (Team), or custom (Enterprise)
Viktor: a flat $50/mo shared workspace, no per-seat charge

INTEGRATIONS:

Claude Tag: Anthropic connectors (Slack, GitHub, Drive, warehouses via admin)
Viktor: 3,200+ tools

MODEL:

Claude Tag: Claude (Opus 4.8)
Viktor: Claude, OpenAI, and others

SECURITY:

Claude Tag: admin-controlled access, per-channel scoping, full audit trail
Viktor: SOC 2 compliant, DPA on Enterprise

---

Where Claude Tag Wins: Agent Identity, Security, and Ambient Mode

Let's be fair -- the credible answer matters more than the convenient one.

Claude Tag's agent identity model is legitimately clever, and the part nobody else has cleanly solved. Instead of the AI borrowing your permissions (and quietly turning a shared channel into a side door to your private docs), Claude gets its own scoped account per channel. The legal channel's Claude can't read the engineering repo. Admins control exactly what it touches, and every action lands in an audit log. If you're a large org with a security team that asks hard questions, that architecture is a real advantage.

It's also pure Claude -- if your team is already all-in on Anthropic's models and you're on Enterprise, Tag is the native, no-new-vendor option.

Where Viktor Wins: Microsoft Teams, Flat Pricing, and Day-One Access

Here's the thing the launch coverage buried: Claude Tag is beta, Slack-only, and locked to Enterprise and Team plans. A huge share of the people reading about it this week -- solo operators, small teams, anyone on Microsoft Teams, anyone without an Enterprise contract -- literally cannot use it yet.

Viktor fills exactly that gap:

• You can actually start. $100 in free credits, no credit card, no sales call. Claude Tag wants you on a qualifying plan first.

• It runs on Teams, not just Slack. If your company lives in Microsoft 365, Tag isn't an option today. Viktor is.

• The math favors small teams. Claude Team is per-seat with a 5-person minimum -- call it $125+/month before you've done anything. Viktor is a flat $50/month shared workspace.

• It's model-agnostic. Viktor routes across Claude, OpenAI, and others, so you're not betting the whole workflow on one lab.

My Two Cents: What It's Actually Like Using Viktor Every Day

I'm not neutral, so let me say it plainly: my company, Pictor.pro, runs Viktor every day -- across our dev team, me on product, our C-suite, even alongside customers -- and the link in this post is an affiliate link. I'd still point a friend to it. Here's the honest version of why.

The thing nobody tells you about a tool like this is how it arrives. Viktor didn't get "rolled out." It took root. It earned its way in, one skeptic at a time.

Exhibit A: one of our devs flat-out doubted it could tell an actual bug from human error on a support ticket. Viktor found the relevant line number in the code, explained the likely cause, suggested the fix -- and offered to make the change itself. (We haven't handed it that key yet.) It didn't close the ticket; it gave the team a running start on triage in seconds.

Exhibit B: I needed to understand a very specific corner of how our product worked, and I didn't know the answer. I told Viktor. Instead of guessing, it went and found the teammate who'd actually written that part of the code, asked him pointed, specific questions, and handed me back exactly what I needed to update our support docs. That teammate -- who started out treating Viktor like an alien in the building -- now talks to it like a colleague.

That's the part that's hard to describe without sounding like I'm overselling. Viktor behaves like the teammate who's almost annoyingly good -- relentlessly proactive, weirdly eager, always connecting dots you didn't ask it to connect -- except it has zero interest in the credit. It's not angling for your job. It wants you to win. You end up liking it despite yourself.

Can Viktor Survive Anthropic? Why the Real Moat Is Temperament, Not the Model

Here's the uncomfortable truth underneath this whole comparison: almost every breakout AI startup of the last few years is renting someone else's brain. They're built on top of OpenAI's or Anthropic's models. And those labs are watching their ecosystems find product-market fit and then -- politely or not -- walking into the very same category. Claude Tag is exactly that: Anthropic stepping into the "AI teammate in Slack" space that companies like Viktor mapped out first. If the labs are feeling generous, they acquire you. They usually don't have to. It was their brain you were borrowing.

So what's actually defensible? From where I sit, it isn't the model -- it's the temperament. Viktor's moat is that it nails the feel of a great proactive teammate in a way I haven't seen anyone else, the labs included, reproduce yet. That's a product-and-taste problem, not a model problem, which is exactly why it's hard to copy.

The one place this bites me: my other team, Outsnapped, lives in Google Workspace and Google Chat -- not Slack. So I can't drop Viktor in the way I have at Pictor. I've been hand-tuning a Hermes agent to get somewhere in the neighborhood, and I'll be honest: it's been nearly impossible to come close to the magic Viktor has harnessed -- the proactivity, the eagerness, the dot-connecting. Whoever ships a real Google Chat version of this first is getting my money. Viktor, Claude Tag, anyone -- that's a wide-open door.

The Verdict: Should You Choose Claude Tag or Viktor?

If you're an enterprise already standardized on Claude, with an admin team that cares about per-channel permission scoping, Claude Tag is the elegant native answer -- once you're off the beta waitlist.

For everyone else -- small teams, Teams-first shops, anyone who wants an AI coworker doing real work this afternoon instead of in coming weeks -- the practical pick is the one you can hire right now.

Hire Viktor -- new readers get $50 off ->

The "AI teammate" era didn't start this week. Anthropic just made everyone notice it. The good news: you don't have to wait for a beta invite to live in it.

Disclosure: Pictor.pro is a paying Viktor customer, and the Viktor link above is an affiliate link -- if you sign up through it, Artificially Intimidating earns a commission, at no extra cost to you, and you still get the $50 off. I only run affiliate offers for tools I'd actually point a friend to. Claude Tag details are from Anthropic, Reuters, and TechCrunch reporting (June 23--24, 2026); pricing is current as of publication and may change.

Go Deeper: The Full Claude Tag vs Viktor Research Report

If you want the ground-level version of this matchup, I packaged it into a Deep Research Report -- and it goes well past what's above:

• What practitioners are actually saying on Reddit, Hacker News, Product Hunt, and YouTube (including the "The end of Viktor?" thread and the HN debate).

• The full pros and cons for both tools -- token-cost anxiety, governance gaps, the Teams lockout, credit-burn opacity, and more.

• An 18-row head-to-head feature matrix covering memory model, eligibility, audit logs, pricing, traction, and SOC 2.

• The real-money numbers: Viktor's $20M ARR and $75M Series A, and how Anthropic's launch reframes the whole category.

Paid subscribers get the full report below. It's the kind of thing I'd otherwise keep to myself -- consider it the upgrade.

Read more

On June 15th, Salesforce announced it was buying Intercom — now rebranded “Fin” — for about $3.6 billion.

We’d already left.

Not because we saw the acquisition coming. We left because we were paying $451 a month to be one customer in a zillion, and the marquee feature we were paying for kept lying to the people we were trying to help.

Let me back up.

For Pictor.pro — our AI photo booth software — Intercom was the front door. It was how users reached us when something broke, when they were confused, when they were deciding whether to trust us with their event. That chat widget mattered. And the pitch that sold us was Fin, Intercom’s AI agent: it would resolve 80%+ of support requests on its own. Salesforce is now citing 76% in their press release — and pointedly contrasting it with their own Agentforce’s 62%. Big, confident numbers.

Here’s what that number looked like from our side of the glass: a confident AI handing our customers incorrect information.

And that’s the part nobody tells you about “AI resolution rates.” A ticket marked resolved doesn’t mean the person got helped. Half the time it means they were deflected — they gave up, or worse, they walked away believing something false about our product. In support, a confidently wrong answer is more expensive than no answer at all. “A human will get back to you in an hour” protects trust. “Here’s the wrong setting, good luck” destroys it.

So when I do the math, I wasn’t getting $451 of value a month. I was paying for the privilege of having an AI hallucinate on my behalf. I wasn’t costing Intercom anything close to that to serve, either. The price wasn’t tethered to value — it was tethered to what a market leader could charge while you had nowhere convenient to go.

Then I went looking, and I learned something about incentives.

When a company is in acquisition mode, the whole organization is optimizing for one thing: getting the numbers up, as high as possible, as fast as possible, to look as attractive as possible to a buyer. That is a completely rational thing for them to do. It is also almost never aligned with your experience as a small customer. You are a data point in a growth chart, not a relationship. The Salesforce deal didn’t create that misalignment. It just made it impossible to ignore.

I want to be fair: Intercom is a genuinely good product for the right company. If you’re a 200-person org living inside Salesforce already, Fin folding into Agentforce might be exactly what you want. This isn’t a hit piece. It’s a fit story. And we weren’t the fit anymore.

So I did what any of us should do more often: I compared the alternatives. Zendesk, the usual Intercom competitors, the whole enterprise lineup. And then, almost by accident, in an open-source conversation, I bumped into Chatwoot.

What got me excited wasn’t the feature list. It was that when I asked questions, the founders answered — almost instantly. Not a ticket queue. Not a bot. The people who build the thing, telling me directly that they cared whether my business succeeded.

Is Chatwoot perfect? Definitely not. But I’ll take an imperfect tool run by people who answer my tweets over a polished one where I’m a rounding error.

We started self-hosted, just to test the software for real. Once I trusted it, I looked at their paid hosted plans — and the per-seat pricing was genuinely reasonable, so we moved to that and skipped the maintenance burden. Here’s the part that actually matters, though: we can port our data back and forth whenever we want. If we ever need extreme customizations, or if the pricing ever rockets past what we think it’s worth, we move back to self-hosted. On our terms.

That’s the thing Intercom never gave us. Even leaving was harder than it needed to be — exporting your data means shipping it off to AWS buckets and similar hoops. Friction on the way out is a tell. It says the lock-in was the strategy.

So here’s what I actually want you to take from this, whether you use Intercom or not:

Software gets bloated, then it gets expensive, then it gets acquired, then it gets worse. A smaller tool is often a better fit than the market leader. And the vendors worth your money are the ones who still need you — not the ones who’ve already won and are now just managing you toward an exit.

Which raises the real question. Not “should I leave Intercom?” — that’s specific to me. The real question is: how do you evaluate any critical vendor so you never get caught flat-footed when they get acquired, jack up prices, or quietly stop caring?

I built a scorecard for exactly that. It’s the checklist I now run before I’ll trust any tool with a core part of my business — and there’s one question on it that has saved me more than all the others combined.

The Vendor Evaluation Scorecard

Here’s the framework I run before committing to any tool that touches a core part of my business. Six checks. Run every candidate through all of them before you sign up — and absolutely before you let something become your “front door.”

Read more

Good day, humans. Half of America is now chatting with AI — and most of them quietly think it's going to end badly. Meanwhile, Estonia just decided your AI assistant deserves its own national ID number. Big Tech signed a safety pact, Anthropic put Claude Design on a diet, and we've got a blueprint for agents that run themselves. Let's get into it.

📬 Before we dive in: The sharpest AI Brief tips come from readers who are actually in the weeds. If you spot a story worth covering, drop it in the Discord. The best tips make tomorrow's edition.

Half of America Now Talks to Chatbots

Pew Research Center

📍 Editor's note: I was in the audience for this one — Pew's Monica Anderson unveiled this data live yesterday at Shared Futures: The AI Forum, the first time it was shared publicly.

What happened: A new Pew Research Center survey of 5,119 U.S. adults finds about half now use AI chatbots like ChatGPT, Gemini, or Copilot — up from a third in 2024. Roughly one in four use them daily, and ChatGPT alone reaches 44% of adults.

Why it matters: AI went from early-adopter toy to mainstream habit in about 18 months. Searching for information (42%) and work tasks (38% of employed adults) are the most common uses — this is now infrastructure, not novelty.

What everyone's saying: The adoption curve is the headline, but the skepticism is the real story: 63% say AI is advancing too quickly, and 71% expect it to make their personal data less secure. More Americans think AI will hurt society than help it.

My read between the lines: The most telling number isn't adoption — it's that adults under 30, the heaviest users, are the most pessimistic (48% expect AI to harm society). Familiarity isn't breeding comfort; it's breeding dread. People are leaning hardest on the very thing they fear most.

📖 Further reading: AI Is a Trust Problem, Not a Tech Problem — Pew just quantified it — public distrust, not capability, is the real ceiling on AI.

Be honest: you've been meaning to set up your own AI agents for months — but between running everything yourself, who has the time?

Viktor skips the setup entirely. It already lives in Slack, connects to 3,000+ tools, and does the real work: reports, dashboards, code, campaigns. Not a chatbot you have to babysit — a coworker that just ships.

New users get $50 off their first month, so it costs almost nothing to let it prove itself. Start your trial →

Estonia Wants to Give AI Agents a National ID

CSO Online

What happened: Estonian Prime Minister Kristen Michal approved a plan to make Estonia the first country to issue government-backed digital IDs to AI agents — each autonomous agent getting its own personal ID code, separate from the human or company it serves.

Why it matters: Most agentic tools today demand blanket access to your accounts. Estonia's model would scope an agent to specific actions — view this, draft that, pay up to a fixed limit — all traceable. It's a concrete answer to “who's accountable when the bot does something?”

What everyone's saying: It's a natural extension of Estonia's famous e-government stack — digital ID, online voting, e-Residency. Vendors have floated their own agent-identity schemes, but as CSO Online notes, none carry government backing.

My read between the lines: There's no launch date, no liability framework, and no answer for what happens when an agent blows past its authorized scope. Estonia is brilliant at being first; the hard part — who pays when your AI lawyer hallucinates a contract — is conveniently filed under “analysis pending.”

📖 Further reading: Your laptop has been in the way this whole time — the case for managed agents with scoped permissions — exactly what Estonia is now trying to legislate.

Big Tech Agrees on AI Safety — On Paper

Linux Foundation

What happened: The Linux Foundation launched the Appia Foundation, a vendor-neutral effort to build open specifications and conformity tests so companies can prove their AI systems meet safety, trust, and compliance requirements. Google, Microsoft, OpenAI, Arm, Mastercard, and Siemens have signed on as members.

Why it matters: As governments worldwide roll out AI rules, companies face a patchwork of overlapping audits. Appia wants conformity evidence to be reusable across the supply chain — test once, satisfy many regulators — which could meaningfully cut duplicate compliance costs.

What everyone's saying: It's part of a coordinated standards push: the Foundation also just launched DocLang, an AI-native document format founded by IBM, Nvidia, and Red Hat. The framing across both is that the next AI bottleneck is coordination and trust, not raw model capability.

My read between the lines: When OpenAI, Google, and Microsoft all cheerfully join the same “safety standards” body, read it as the incumbents drawing the map before regulators show up with their own. Self-certification frameworks have a way of certifying exactly what the biggest members were already planning to ship.

📖 Further reading: The US Government Just Took Anthropic's Best AI Model Offline — Here's Why — what AI safety enforcement looks like when it's mandatory, not a voluntary industry pact.

Anthropic Rebuilds Claude Design to Burn Fewer Tokens

VentureBeat

What happened: Anthropic shipped a major overhaul of Claude Design, the AI design tool it launched in April, adding two-way Claude Code integration (“code round-trips”), brand-compliance controls, enterprise export — and, notably, much lower token consumption.

Why it matters: Designers can now hand a mockup to Claude Code, get back production-ready code that stays faithful to the design, and round-trip changes both directions. It pushes “prompt to production” closer to reality for teams that don't have a dedicated designer in the room.

What everyone's saying: Per VentureBeat, the token fix is the headline for power users — the original could blow through subscription limits in a few iterations, a sore point after Anthropic's June 15 move to bill agent usage on a separate meter. It's also fending off open-source rivals like Open Design (57k GitHub stars in eight weeks).

My read between the lines: “We made it use fewer tokens” is a quiet admission the original was too expensive to actually use. The real tell is timing: right after Anthropic split agent billing onto its own meter, the token-hungry tool suddenly found efficiency. Funny how that works.

📖 Further reading: OpenAI shipped a physical camera, but that's not the story — where “vibe-coding” is headed when building software stops requiring expertise — Claude Design is the design-side version.

How to Build AI Agents That Run Themselves

Claire Vo

What happened: Product leader Claire Vo broke down four ways to make AI agents run autonomously — heartbeat, cron, hook, and goal loops — and built live examples in Claude Code and Codex.

Why it matters: This is the shift from “AI you prompt” to “AI that runs on a schedule and acts on its own.” Her mental model — treat an agent like onboarding an employee, with work trees, skills, connectors, subagents, and memory — is the clearest beginner map to autonomous AI yet.

What everyone's saying: Practitioners are converging on the same recipe; cron-style “run on a schedule without going off the rails” patterns are all over dev circles right now. Goal-based loops are the holy grail — and, everyone agrees, the most expensive to pull off.

My read between the lines: Vo's own warning is the quiet part out loud: most builders burn a fortune in tokens before a goal loop produces anything useful. Autonomy sounds like freedom until the bill arrives. The agents work fine — it's your budget that needs supervising.

📖 Further reading: I ignored Hermes for two months. Here's what I actually found. — a hands-on reality check on what living with an autonomous agent is actually like.

That's your AI Brief for Thursday. Join the conversation in the Artificially Intimidating community chat.

—Artificially Intimidating

⚡ Update — July 2, 2026:

Fable 5 is back. The government lifted the ban after 18 days, and the model returned globally on July 1 — but not before a warning from Amazon, an NSA assessment, a China scare, and a quiet new rulebook for the whole industry. Read the full follow-up: Fable 5 Is Back — What Actually Happened During the 18-Day Ban →

Nate B. Jones broke this one from an airplane — first class, calm as ever — because it couldn’t wait for wheels-down. He was right. On June 12, the US government forced Anthropic to pull its two most powerful AI models offline for everyone on Earth. This is the first time a frontier model has been rolled back by government order. Here’s the story, his read, and then mine — including the part nobody’s saying out loud.

Watch Nate break it first

Before anything else: credit where it’s due. Nate B. Jones filmed his breakdown from a plane because the story was moving too fast to wait. That tells you everything about how big this is. If you have nine minutes, watch it — it’s the clearest calm-in-the-storm explainer out there:

▶️ Nate B. Jones: “I’m filming this from a plane because this is unprecedented”

What I love about Nate is that he doesn’t do panic. He does precision. So I’m going to give him full credit for surfacing this, walk you through what actually happened, summarize his three-layer read, and then get into the part that’s been rattling around in my head since I watched it: what this really says about the haves, the have-nots, and the future we’re walking into.

What actually happened, in plain English

On Friday, June 12, 2026, at 5:21pm ET, Anthropic received an export control directive from the US government. Citing national security authorities, the order suspends all access to Fable 5 and Mythos 5 — Anthropic’s two most advanced models — by any foreign national, whether inside or outside the United States, including Anthropic’s own foreign-national employees.

Read that last part again, because it’s the whole story. A modern AI company can’t reliably verify the nationality of every user, employee, and contractor touching a model deployed to hundreds of millions of people. So the only way to actually comply with “no foreign nationals” is to shut the model off for everyone. And that’s exactly what Anthropic did. (All of Anthropic’s other models — Opus, Sonnet, Haiku — are unaffected.)

The timing is brutal. Anthropic had just rolled out Fable 5 on June 9, free to all Pro, Max, and Enterprise users through June 22. The model they handed to millions of people for free on Tuesday was switched off for everyone by Friday night.

Why? Per Axios, the Commerce Department moved after another company claimed it had jailbroken Mythos. Anthropic’s version, in its own statement, is more deflating: the government’s evidence was verbal, the “jailbreak” amounted to asking the model to read a specific codebase and flag software flaws, and the vulnerabilities it surfaced were minor, already-known, and — in Anthropic’s words — discoverable by other publicly available models (including OpenAI’s GPT-5.5) without any bypass at all. Anthropic is complying, but openly disagrees, calling it a likely “misunderstanding” and saying it’s working to restore access.

So: the most capable AI model in the world, pulled on the basis of a verbal report about a narrow technique that other models can already do. That’s the factual core. Now the interesting part.

Nate’s Read: Three Layers

Nate frames the whole thing in three layers, and it’s a genuinely useful lens:

1. The safety layer. He doesn’t dismiss it. His sharp point: if a jailbreak method works against one frontier model, the honest default is to assume it works against the class of models until proven otherwise — these systems share enough structure that an attack is evidence about the category, not just the instance. But — and this is the real critique — a vague verbal claim is nowhere near enough to justify an order this sweeping. If the government is going to freeze a private company’s flagship product, there needs to be a transparent statutory path, a clear technical standard, and a way to respond to the actual evidence. Otherwise any frontier model can be frozen on a claim no one can audit.

2. The “foreign national” fig leaf. The phrase sounds surgical — like the government is just controlling who has access, not banning the product. But for a company that sells globally, employs globally, and runs on international cloud infrastructure, “no foreign nationals” isn’t a scalpel. It’s an off switch with export-control language wrapped around it. Everyone involved, Nate argues, almost certainly knows that.

3. The business reality. This is why he thinks it resolves fast. Anthropic and the government have a working relationship and a template for negotiated, trusted access. Anthropic is acting like the access regime broke, not like Fable is dead. Customers want it back. The government doesn’t want to look like it kneecapped a leading American AI lab while loudly insisting America should lead on AI. His bet: Fable comes back, soon, with more process around it.

His takeaway for operators is the line I keep coming back to: frontier model access is now a policy surface. Raw model quality is no longer the only thing that matters. Keep your alternatives warm. Don’t build critical work on the assumption that the best model stays available on yesterday’s terms.

It’s a great breakdown. Go watch the whole thing.

And now — here’s where I want to take it somewhere Nate’s measured, on-a-plane delivery couldn’t quite go.

Between the lines: this is a story about the haves and the have-nots

Here’s the thing that’s been sitting in my chest since I watched Nate’s video.

Read more

Three weeks ago, in the May 18 brief, I said Apple was quietly trying to “own the trust layer” — routing your Siri requests through its own Private Cloud Compute before they ever touch Google’s Gemini.

I wrote it as a throwaway line. After watching WWDC, I think it was the whole ballgame.

Because here’s what Apple actually announced on Monday, underneath the Liquid Glass sliders and the 80%-faster AirDrop and a macOS named, I’m not kidding, “Golden Gate”:

Apple gave up on building the AI. And it might be the smartest move they’ve made in a decade.

They rented the brain

The new Siri AI — the one Apple first promised in 2024, the one they got sued over and settled for $250 million when it didn’t ship — doesn’t run on Apple’s own frontier model.

It runs on Google’s Gemini.

Apple adapted Gemini to run on its devices and servers, slapped an “Apple Foundation Models” label on it, and shipped it. Even the watermark on AI-generated images is Google’s tech (SynthID). The dependency runs deep, and Apple barely tried to hide it.

Now — the easy take is “Apple fell behind and had to go begging to Google.” And sure, there’s some truth there. You don’t pay a quarter-billion-dollar settlement from a position of strength.

But that’s not the interesting part. The interesting part is what Apple built around the rented brain.

The Tell: A Socket

Look at what Apple kept for itself and what it outsourced.

It outsourced the model. But it kept every piece of the layer that wraps around the model: the system orchestrator, the semantic index in Spotlight that knows your photos and your messages, App Intents that let Siri reach into your apps, on-screen awareness, the personal-context plumbing. That’s the hard part. That’s the part nobody can copy, because it’s welded into the OS and your data.

And then there’s the detail that gives away the entire strategy: Apple is building Apple Intelligence so you can swap the underlying model out. Gemini today. Something else tomorrow. A socket on the wall.

You do not design a slot to swap the engine if you think the engine is your advantage.

Apple just told the entire industry, in its own product architecture, that it believes the frontier model is a commodity — a part you buy, like a screen or a battery or a chip from TSMC. The intelligence is interchangeable. The integration is the product.

That is a wildly different bet from OpenAI and Anthropic, who are betting their entire valuations that the model itself stays the moat.

So who’s right?

The squeeze nobody’s talking about

Here’s the thing that makes Apple’s bet so sharp: “the model is a commodity” crushes the middle from both directions at once.

From above, value floats up to whoever owns distribution, data, and trust. That’s Apple. A billion devices. Your photos. Your messages. Fifteen years of “I’ll hand Apple my data and they won’t sell it.” Gemini is just the engine they dropped into a car everyone already owns and already trusts.

From below, the labs don’t sit still. OpenAI and Anthropic spent the last three years watching people build on their APIs, cherry-picking the workflows that got traction, and absorbing them in-house. ChatGPT Search is Perplexity. Projects, memory, Canvas, computer use — every one of those was somebody’s startup first.

So the thin middle gets flattened. And I’ll say the quiet part out loud, even though one of these is a tool I’ve recommended to you:

Perplexity, Jasper, Wispr Flow, the other dictation apps, the standalone “chat with AI” wrappers — I think most of them are dead tools walking. Not because they’re bad. I love many of these and they supported our business and entry into this space …. but because they built their whole business inside the labs’ roadmap, with no distribution the labs can’t match and no data the labs can’t get.

Perplexity is a gorgeous interface sitting directly on top of the one feature OpenAI most obviously wanted. Brand alone doesn’t stop OpenAI. It barely slows it down.

And the agents are next

Here’s where I lose half of you, because this is the part nobody funding the current hype cycle wants to hear.

It’s not just the chatbot wrappers that are dead tools walking. It’s most of the agents everybody’s so excited about right now.

Watch what Siri actually did in the demos. “Give me directions to the arch with a stop at Jeff’s.” “Add just the photos with Bryce to the shared album.” “Send the menu to the Goal Chasers group chat.” That’s not search. That’s an agent orchestrating across Maps, Photos, Contacts, and Messages from one plain-English sentence.

Apple is building the everything-app. Except it’s not an app — it’s the operating system becoming the agent. They don’t need you to download it. It’s already on the phone in your pocket, wired into your data, with App Intents reaching into every app on the thing.

And the second the OS is the agent, every standalone agent startup gets caught in the exact same squeeze as the wrappers — from both sides. The OS owns it from above: Siri has your personal context, your apps, and a billion-device head start no startup will ever match. The labs own it from below: ChatGPT, Claude’s computer use, Gemini’s agents, all racing to do your tasks natively. The standalone “AI agent that runs your life” is a wrapper with extra steps.

That’s the growth plan, by the way. The App Store taxed apps. The everything-agent taxes every action — Apple sitting in the middle of every booking, every purchase, every transaction, taking its cut, privacy as the cover story. It’s the App Store land-grab an order of magnitude bigger.

Now — does Siri actually pull this off out of the box? Honestly, no. It ships in beta later this year, English-only, blocked in the EU, newest-silicon-only, from the company that promised this exact Siri in 2024 and paid $250 million for missing. The ambition is real. The day-one delivery will lag, like it always does. So there’s a window.

But a window is not a moat.

There will be survivors. They’ll just be few and far between. The agents that live are the ones with — say it with me — the moats. Proprietary data the OS can’t get. A real customer relationship the OS won’t bother to win. Or a vertical so specific, so cross-platform, so far outside Apple’s walls that Siri will never show up to compete. (Apple’s agent only works inside Apple’s world. The web, Windows, Android, the messy regulated verticals — that’s open ground.)

Everything in the fat middle — the horizontal consumer agent with a nice UI and someone else’s model underneath — has a clock on it. Run the test one more time: if Siri can do this natively next fall, what do I have left? If the answer is nothing, you didn’t build a company. You built a feature Apple hadn’t shipped yet.

The only moats left

Strip the jargon off everything above and you’re left with a brutally simple map. When intelligence is a cheap utility you rent by the token, exactly three things still defend you — and nothing else does.

Own the customer. The relationship. The audience. The fact that they come to you on purpose. The labs can clone any tool you use, but they can’t clone the ten thousand people who open your email because it’s yours.

Own the data. Something you generate or collect that no lab has and can’t buy — your transactions, your niche, your operational history. The AI is rented. The data is yours.

Own the trust. This is the one nobody puts on the list, and it’s the whole game. An audience isn’t enough — there are huge lists nobody believes. Trust is what lets you stand in the middle: the one they’ll let broker their tools, hold their data, point them at the rented intelligence. Trust is what turns an audience into a position.

That’s it. That’s the list. Everything else — speed, taste, being a clever integrator — is a head start, not a wall. Real ways to make money. Not moats.

And here’s the part that should reorganize your whole week: Apple’s moats and yours are the same three, just at different scale. A billion customers. Their photos and messages as the data. And fifteen years of trust — which is the one Apple just quietly turned into a cash register.

Which means the model going commodity is the best news an audience-owner has ever gotten. For years the moat was the technology, and you couldn’t compete on that — you don’t have a research lab. Now the tech is a socket on the wall, and the three things that are left are the three things a small operator can actually build.

So the strategy writes itself. Stop chasing the best tool. Start building the three things the labs can never take — and steal the one move Apple just used to monetize all three.

Own the three — and steal Apple’s trust trick

Let me get specific, because “build a moat” is useless without a Monday-morning to-do. And to be clear up front: I’m not torching my stack over one keynote. None of this is “cancel your subscriptions today.” It’s where the time and the money go from here.

The filter

Every tool now has to answer one question before it gets another dollar:

Read more

I have a lot of cameras. Like any amount you’re imagining … you should probably double or triple it.

Vintage rangefinders.

Fancy film cameras.

Point and shoot film cameras.

Medium format bodies.

Literal toy cameras (for adults and children).

I was a Lomo ambassador for years — shot an entire series of 30+ portraits with their Daguerreotype Achromat Art Lens, a recreation of one of the first double-element lenses ever made. Got published in their books. Documented nightlife and music scene for 15+ yeas and amassed an archive of 1.47 million photos of people at events. Currently run OutSnapped, a photo booth company known for inventing the AI Photo Booth. I’ve pined over cameras and photography longer than I’ve thought about almost anything.

So when OpenAI quietly dropped an open-source GitHub repo last week for something called ImageGenCam, I paid attention.

The concept: a camera you build yourself for around $100–150 in parts, using an AI coding agent to walk you through every step. You take a photo. The camera immediately transforms it with AI image generation. Instead of capturing reality, it uses reality as a prompt input. Pointless Scribble. Turn to Cheese. Goblin Mode. Every photo you take gets processed through whichever aesthetic you coded/loaded.

Here’s my honest reaction as a photographer: the intent still carries through. Your eye — what you point the camera at, how you frame it — still matters. But the creative discipline has shifted. You can now design your output before you shoot, not after.

Every snap, good or bad, can come back as a beautifully lit studio headshot. Or a children’s drawing. Your composition feeds the AI. The aesthetic is the prompt.

Witness vs. Inventor

People keep reaching for the Lomography comparison. I understand why — Lomo built a movement around cameras that distort reality, light leaks and vignette and unpredictable results. But that comparison undersells what’s different here. Lomo cameras still capture reality. Most of them are actually recreations of historic photographic technology. A Holga, a Polaroid, a Daguerreotype lens — these tools honor the act of recording the world.

The ImageGenCam doesn’t record. It witnesses, then literally reinvents.

And I find that exciting, not threatening. Different tools serve different purposes. I’ll keep my Canon. I’m also going to build this thing.

But the camera is almost beside the point.

The Vibe Hardware Revolution

The real story is what this camera signals about where we’re headed.

Read more

Michael Carney, President of the U.S. Chamber of Commerce Foundation, opened the with something you don’t often hear from people in rooms like that:

“The only thing that’s clear is that we have no idea what’s about to happen.”

I was there. I heard it. And then we all did what you do in those rooms — we moved on, filled our coffee cups, and proceeded to spend eight hours talking about AI with great confidence.

I was lucky enough to be speaker at the US Chamber of Commerce AI + Work Summit this past week. I was also there representing OutSnapped: AI headshots and pet portraits on a 9-foot live screen, just a few feet from the main stage. While nearly 1,000 business leaders debated the future of AI in the workforce, my team was building actual trust with actual people, 90 seconds at a time.

The word underneath every panel, every data point, every debate wasn’t “AI.”

It was trust.

The Compounding Trust Problem

The summit covered a lot of ground: augmentation vs. automation, skills gaps, workforce planning, equity, the role of small business. No shortage of smart people saying smart things.

But when you cut through all of it, every conversation collapsed into the same problem: nobody is sure who or what to trust, and we’re all moving as fast as possible without a trusted foundation under us.

Trust in the models — which Noella Sudbury, founder of Rasa Legal, captured perfectly: her CTO describes AI as “a hungover intern — very, very confident, and definitely not going to be around to pick up any mess.” Her firm uses AI to help people with criminal records expunge them at scale. They can’t afford hallucinations. So they keep humans in the loop, always.

Trust in the vendors building them — who have their own incentives, their own timelines, and their own definitions of “safe.” Trust in leadership to roll this out thoughtfully. Trust in employers not to use AI as a cover for headcount reduction. Trust in education to re-skill people into jobs that will actually exist.

It’s not a stack of separate trust problems. It’s one compounding one. If the foundation of the model is shaky, and the intent of the vendor is opaque, how can the employee trust the mandate?

The AI Photo Booth Made It Obvious

Here’s what I saw at the OutSnapped booth all day: when you give people genuine control over the output — their style, their setting, how tight the crop is, whether they want to use our camera or their own phone — something changes. The hesitation drops. The curiosity takes over.

We weren’t telling anyone what their AI headshot would look like. We were asking: What do you want?

Every person who walked up was making a choice. Opting in on their own terms. And then when their output appeared on the 9-foot screen — whether it was a polished professional headshot or their golden retriever reimagined as a racing car driver — the reaction was pure delight.

Not because the AI was magic. Because they were in control of it.

What was actually running: two OutSnapped.com custom AI Photo Booth & AI Video Booth experiences with cloud-based generative AI — images and video — delivered directly to guests’ phones via email or text in under 90 seconds. The tech was invisible. Human agency was not.

The Neuroscience of Agency

Edwige Sacco, KPMG’s Head of Workforce Innovation, has a neuroscience explanation for exactly why that matters. The brain’s prefrontal cortex works harder — and triggers a threat response — when change is perceived as something happening to you.

Her framework: the goal of any AI rollout is to help the brain reclassify AI from “risk” to “resource.” That reclassification doesn’t happen through mandate. It happens through:

Edwige Sacco’s framework: the brain won’t accept what it perceives as a threat. Give people agency, and the threat signal drops.

• Agency: Having a say in how the tool is used.

• Competence: Feeling capable of operating the tech.

• Trust: Believing the system — and the leader — has your back.

We see the same reclassification happen with PocketSquare.ai users the first time their bespoke agent responds in a way that’s unmistakably calibrated to their business based on their interactions — it’s not generic AI, but something that actually knows their context. The hesitation that was there five minutes earlier is just gone.

The AI Photo Booth was, accidentally, a perfect application of that framework. Every person who walked up chose to be there. Every output was theirs to direct. The AI was in service of their idea of themselves.

The Dishwasher Moment

The people at that summit — the ones filling the hall, attending the panels, walking up to OutSnapped’s AI Video Booth — they’re already engaged. Already curious enough to show up. Already doing the extra work to figure out what’s going on.

The trust problem isn’t for them.

It’s for everyone who wasn’t in the room. The employees who got handed AI as a mandate. The workers who’ve been told, implicitly or explicitly, that this technology is coming to make their role smaller. The small business owner who doesn’t have a $2,000/seat enterprise license and eight hours to spend at a conference figuring this out.

Those people didn’t get to opt in. They got the dishwasher moment: this is your job now, go figure it out.

Nobody trusts something they were told to do. Especially when the people doing the telling don’t fully understand it either. And that’s the part nobody said out loud.

The leaders in that room are going back to their offices on Monday. They’re going to send memos. They’re going to announce AI initiatives. They’re going to share things they learned at the summit.

What most of them won’t do is say: I don’t know exactly where this is going. Here’s what I’m excited about. Here’s what I’m genuinely worried about. Here’s what we’re going to experiment with together.

[Continue reading with a paid subscription...]

Read more

I got tapped to speak at the U.S. Chamber of Commerce Foundation’s national AI + Work Summit in DC this week. Harvard professors, the former U.S. Chief Information Officer, Google, Anthropic, LinkedIn — and me, a guy who started by taking 1.45 million photos of drunk people at parties.

To prep, I had to write a bio that explained how those two things connect.

What I figured out in the process changed how I write everything now.

Here’s what I didn’t do: I didn’t start typing.

This is the thing I’ve changed about how I work that’s made the biggest difference in the last year, and almost nobody talks about it. The blank page isn’t a writing problem. It’s a thinking problem. And typing is one of the worst ways to think.

When you type, the editor in your brain turns on immediately. Every sentence gets judged before it’s finished. You write three words, delete two, write two more, decide the whole paragraph is stupid, close the laptop, make a coffee. You know how this goes.

I’m self-conscious about writing. Always have been. Which probably sounds strange coming from someone who publishes a newsletter. But the inner critic doesn’t care about your credentials — it just watches you stare at the cursor and waits.

What broke it for me was switching from typing to talking.

Not voice-to-text as a dictation trick. As a thinking method. There’s something that happens when you speak your thoughts instead of write them — a different part of your brain activates, the editor quiets down, and the ideas come out the way they actually live in your head: messy, jumping around, honest. My brain runs in about fifteen directions at once. Talking gets that out. Typing compresses it into something too neat too soon.

The workflow is simple. I use SuperWhisper to capture the voice dump — talk for five minutes about whatever I’m trying to write, don’t stop, don’t edit. Then the transcript goes into Claude, not to write for me, but to act as a thinking partner. To reflect my own ideas back at me in a shape I can react to.

That’s the key word: react. You’re not asking AI to write it. You’re using AI to make your thinking visible so you can edit it.

The bio I ended up with? Thirty minutes. Two decades at the intersection of technology, human experience, and data — long before AI made that combination fashionable. The through-line I’d never quite been able to articulate, from photographing NYC nightlife to building AI-powered experiences on event floors and factory floors, finally landed. Because I talked my way to it instead of trying to type my way there.

Here’s the full workflow, exactly how I run it.

Read more

I want to tell you something I should probably be embarrassed about.

I’ve been running seven companies through Paperclip for a few months. Some are humming along. Most have stalled because I haven’t had the bandwidth to keep pushing them — which is a specific kind of irony when you’re supposed to be running an AI-powered operation. I was using Paperclip as my agent OS and largely ignoring Hermes. The creator noise around it felt like hype bait, and I’d already found something that worked.

Then I watched this episode of The Next New Thing — Andrew Warner talking with Justin Brooke about his current setup: Hermes + gBrain + Paperclip. And things clicked in a way they hadn’t before.

Hermes isn’t a Paperclip replacement. It’s the layer that sits on top — a digital twin that knows your goals, tracks what’s stalled, pings you with questions, and gets things moving again through Paperclip. The combo is genuinely different from either tool alone.

I’m a few days into onboarding Hermes right now. This is my real-time take: what’s worth the hype, what isn’t, and what I wish someone had told me before I spent weeks wading through creator content to find out. I have products in this space — MirrorMemory.ai and PocketSquare.ai — so you should know that going in. The goal isn’t to scare you into buying something. It’s to give you an accurate picture.

What Paperclip already gets right

If you haven’t read my Paperclip Day 0 post, the short version: it’s an open-source agent OS built around an org chart metaphor. You hire agents, give them job descriptions, assign tasks, and review what comes back.

The thing that sets it apart — and the reason I stayed — is how honest Dotta and the community are about what it actually is. Paperclip is explicitly designed as a human-in-the-loop system. Agents run, but they require a human to participate. That’s not a limitation. It’s a design philosophy. It means you can give agents real autonomy without handing over the keys to things that would be catastrophic to mess up. That honesty goes a long way when half the internet is telling you AI agents will run your business while you sleep.

I've also gotten genuinely into the community around it — people like Aron Prins, who built Paperclip Vision. Most agent setups fail not because the agents are bad, but because they have no mandate. They don't know what they're allowed to do, who to escalate to, or what the company is actually trying to accomplish. Vision solves this at the source: it interviews the founder (me) and generates two key documents — a VISION.md (think of it as the company’s constitution: mission, revenue model, org structure, CEO mandate, guiding principles) and a CEO_BOOTSTRAP.md (the activation sequence that lets the CEO agent start running without the founder in the loop for day-to-day decisions). It's the kind of primitive the ecosystem needed and that a community member just went and built. Sending bug fixes, joining the Paperclip community — this is what using a real open-source tool should feel like.

What Paperclip alone doesn’t solve

Seven companies. That’s what I’m managing in Paperclip. Some have momentum. Some have stalled — not because Paperclip can’t handle them, but because “I have no self control and keep adding companies before the current ones have traction. Paperclip is excellent at executing tasks I hand it. It’s not as good at asking: “Hey, you haven’t touched the MirrorMemory.ai roadmap in three weeks — want me to start moving on the next phase?”

That’s where Hermes comes in.

The way I now think about it: Paperclip is my company’s operating system — where work happens, where agents live, where tasks get done. Hermes is the layer above it — the thing that knows my goals across all of my companies and personal projects, tracks what’s stalled, pings me with clarifying questions, and feeds work back into Paperclip to get it moving again. Because it holds persistent context on how I actually think and what I’m trying to accomplish, it can come to me with solutions rather than just problems — and eventually, for the lower-stakes decisions, start making them on my behalf using my own knowledge and preferences. Not one tool replacing another. A stack.

What’s actually real about Hermes

Three things stand out from both my onboarding and the Andrew Warner / Justin Brooke episode.

The first is auto-learning skills per persona. Hermes builds and updates skills for each agent based on how you correct it. Your “writer,” “ops,” and “researcher” personas gradually lock into your preferences without you reinstalling configuration every session. It’s slow to notice, but it compounds.

The second is memory that actually persists. This is the part that changes the daily experience. When I first connected Hermes to Mirror Memory — originally intended as an internal memory tool we built at OutSnapped on top of Nate B Jones’s Open Brain framework — Hermes immediately knew who I was. No onboarding checklist. No “tell me about yourself.” It picked up context from the memory layer, asked some clarifying questions, and started acting like it had been on the team for a week and actively wanted to impress. Justin Brooke uses Garry Tan’s gBrain for the same slot in his stack. Either works. The key is having something there — running either tool without a persistent memory layer is like hiring someone with amnesia.

I’ve set up a lot of agents. Each time, you spend the first session re-explaining your business to something that will forget everything the moment you close the tab. The persistent memory experience is genuinely different, and once you have it, it’s truly magical and you don’t want to go back. When set up correctly, it feels like that that rare friend who can finish your sentences.

The third is long-running /goal missions, not one-off prompts. This is the most underrated thing about Hermes. For example, Justin used it for a land sale — Hermes pulled Zillow comps, flagged that their asking price was $50K too low, built a phased marketing plan across Craigslist, Facebook Marketplace, LandWatch, and a dozen other platforms, and generated platform-specific copy and buyer objection scripts. Not “here’s what you should do.” Here’s the plan. Approve phase one. I’ll get started. That’s a real use case with real stakes, not a demo.

The combination of persistent memory, skill evolution, and long-running goals is where Hermes stops feeling like ChatGPT with a Kanban view and starts feeling like a primitive operating system for your work. Stacked on top of Paperclip, it’s the closest thing I’ve found to actually running a small business like a system rather than a sprint.

What the Hermes hype gets wrong

I learn real things from a lot of the big Hermes content creators — the walkthroughs, the use case compilations. I’m not dismissing it. But there are patterns worth naming.

The most common one: the creator presents themselves as running a portfolio of companies in their sleep. When you look closely, it’s usually a funnel into a paid community and a media channel. That is a real business. It’s just not the same kind of empire the thumbnails imply. The gap between “empire” and “one business doing fine” is where you get sold a $2,000 course.

The framing that bothers me more is “learn this NOW or be left behind FOREVER.” Nobody in the Hermes creator space has shown receipts for true compounding, verifiable business outcomes at the scale those scare tactics imply — unless that business is selling the courses themselves. That framing exists to trigger urgency, not to help you. We’ve written about this trap before — the goal is to hand you tools so you can own your own stack, not to make you dependent on someone else’s content.

Then there’s the “237 ways o make using Hermes” video format. Useful as inspiration. Not useful as proof that any of those workflows are producing revenue at real companies. And the smart home flexes — Hermes toggling your lights via Home Assistant — are genuinely cool content that costs more in tokens and complexity than you’ll ever make back.

If you’re evaluating Hermes for your own stack, treat most creator content as sales collateral, not case studies.

My exact setup: what I installed, what broke, what I’d do differently

The base layer: Paperclip on a VPS

Don’t run Paperclip on your laptop. Put it on a VPS — I use Hostinger* so it’s always on, accessible from any device, and not tied to whether your machine is awake. I wrote about the Mac Mini vs. VPS decision here if you want the full reasoning.

Read more