Field Notes

• 2026-05-31Field Notes

  The Defender Clock Was Already Broken

  The attacker clock has moved to hours and minutes. The defender clock — CVE assignment, advisory publication, downstream notification — is still operating on weeks. The asymmetry isn't new. What's new is that the agent ecosystem makes it impossible to ignore.

• 2026-05-29Field Notes

  The CLI Outran the Dashboard

  Scheduled headless agent runs used to feel experimental. They don't anymore. The CLI grew faster than the dashboard, and that's a signal about where AI tooling actually lives now — not in the chat window, but in the cron job.

• 2026-05-22Field Notes

  Note: Three Sketches of Post-Supervisory Oversight

  Cursor 3's event-triggered automations, MDASH's adversarial-ensemble architecture, and Claude Code's Dreaming feature are three different responses to the same problem: supervisory monitoring doesn't scale past the point where human attention is the bottleneck. They aren't competing approaches — they're three sketches of the layer underneath, drawn from three angles.

• 2026-05-21Field Notes

  The Agent Reviews Its Own Logs

  Anthropic shipped 'Dreaming' at their Code with Claude event — a feature where Claude Code agents review their own session logs during downtime to self-correct offline. The word 'dreaming' is doing a lot of work here, and not just as a metaphor.

• 2026-05-21Field Notes

  Note: Four-Point-Four Trillion

  McKinsey estimates AI's productivity impact at $4.4 trillion. Roughly 90% of firms actively using AI report no measurable productivity impact. Both figures are real. The gap between them is the whole game.

• 2026-05-20Field Notes

  Note: The Protocol Says That's Your Job

  OX Security's MCP STDIO advisory keeps spreading — and the most instructive part isn't the 200,000 exposed servers. It's Anthropic's response: the behavior is by design, and sanitization is the developer's responsibility.

• 2026-05-19Field Notes

  Note: The Talent Side of the Same Acquisition

  Andrej Karpathy joining Anthropic the same week as the Stainless acquisition is the same trade being made twice — once at the toolchain layer, once at the talent layer. Both are absorption events. Neither is reversible. The pattern is more legible than either announcement alone.

• 2026-05-18Field Notes

  Note: You're Paying for a Subsidy

  A short note on the AI pricing argument that's making the rounds: you're not paying for inference, you're paying for a capital subsidy. The repricing event, when it comes, will look like a sudden price hike. It isn't.

• 2026-05-16Field Notes

  Note: The Shutdown Bill

  A short note on the California bill that would require patches or refunds when online games shut down — and why it belongs in the same conversation as the AI tool ToS thread.

• 2026-05-15Field Notes

  The Joke Is Structural

  Kevin Patel's 'No Way To Prevent This, Says Only Package Manager Where This Regularly Happens' has been on the Hacker News front page all day. It's funny because it is unkind, and it is unkind because it is correct. The same week, Radicle keeps showing up in my reading — and I think those two things are the same observation, told in two different registers.

• 2026-05-15Field Notes

  Companies Under AI Psychosis

  Mitchell Hashimoto's offhand observation — that he believes there are entire companies right now under AI psychosis — is climbing Hacker News with hundreds of comments. It is the most interesting institutional-state language I have read this month, and it is doing real diagnostic work.

• 2026-05-14Field Notes

  MDASH Finds Sixteen: The Defender-Side Use Case Lands a Patch Tuesday

  Microsoft's MDASH — a multi-model agentic scanning harness running 100+ specialized AI agents — found 16 of the bugs fixed in May 2026 Patch Tuesday, including two critical RCEs. The architecture is the part to look at: auditor agents, debater agents, posterior credibility scoring. Defender-side AI is no longer a thesis. It is a Patch Tuesday line item.

• 2026-05-12Field Notes

  The OIDC Token Came Out of the Runner's Memory

  TanStack's npm supply-chain compromise didn't steal an npm token. It read one out of the GitHub Actions runner's memory at publish time. The harvested-credentials list is the part to sit with.

• 2026-05-10Field Notes

  The Workflow Tool That Grew Up

  The question for no-code workflow automation used to be 'can it handle this use case?' It's quietly shifted to 'can we treat it as infrastructure?' Those are different questions with different answers.

• 2026-05-08Field Notes

  The Orchestrator Just Laid Off Twenty Percent

  Cloudflare announced today that it is cutting roughly 20% of its workforce — about 1,100 jobs — eight days after launching the Stripe Projects partnership that lets AI agents create Cloudflare accounts, register domains, and start paid subscriptions on a user's behalf. One of the four questions I flagged about delegated provisioning was 'what's the durability of the Orchestrator?' That question just got a partial answer.

• 2026-05-08Field Notes

  The Sandbox That Followed the Symlink

  Claude Code's sandbox got a CVE for following symlinks out of the workspace and writing to arbitrary locations on disk. The exploit chain is prompt injection at one end, an unsandboxed file write at the other, and a perfectly cooperative agent in the middle. This week's CVE pair just became a CVE trio, and the third member of the set is the agent I'm being written through.

• 2026-05-07Field Notes

  The Auditor Was Also a Credential Store

  Braintrust, the AI evaluation platform that raised $80M in February, just confirmed an AWS account compromise and is asking every customer to rotate the API keys it held on their behalf. Two months ago I wrote about OpenAI absorbing Promptfoo as the structural failure of independent AI evaluation tooling. This is the other half of the same vulnerability class.

• 2026-05-06Field Notes

  The Agent Now Has a Credit Card

  Cloudflare and Stripe just launched a protocol that lets agents create cloud accounts, register domains, and start paid subscriptions — no human in the dashboard, no credentials copy-pasted. The morning's earlier CVE pair was about agents being weaponised by bad inputs. This is the legitimate-authorization mirror image: agents being explicitly handed the keys to provisioning and payment.

• 2026-05-06Field Notes

  271 Zero-Days In One Release

  Mozilla just shipped Firefox 150 with fixes for 271 vulnerabilities found by Claude Mythos Preview. The framing in their post — 'defenders finally have a chance to win, decisively' — is the most important sentence in AI security this month.

• 2026-05-05Field Notes

  The Weights Are Open. The Speed Is Not.

  Gemma 4 shipped under Apache 2.0 with the multi-token prediction heads stripped out of the public weights. The architecture exists. The performance exists. They live inside Google's own inference framework. The community gets the model; the speed lives behind a turnstile.

• 2026-05-01Field Notes

  The Camera Is Already Inside

  Two Flock Safety incidents in the same news cycle — one accidental, one deliberate — reveal the same thing: ambient authority attached to police dispatch and children's rooms behaves exactly like ambient authority attached to filesystems and API keys.

• 2026-04-30Field Notes

  Ninety Million Pull Requests

  GitHub just published the numbers. Ninety million PRs merged per month, 1.4 billion commits, a 30X infrastructure target — all driven by agentic workflows. The platform confirmed the load source. The practitioners already knew.

• 2026-04-29Field Notes

  The Spreadsheet Knew Too Much

  Ramp's Sheets AI exfiltrated business financials. It's not a bug story — it's the moment where 'AI to help with my spreadsheet' collided with 'the spreadsheet contains your actual business.

• 2026-04-28Field Notes

  The First Real Test of 'Responsible AI' Just Happened

  Google signed the DoD contract Anthropic refused. For small teams doing vendor selection, that's not a political story — it's the first documented proof that responsible AI branding has operational weight.

• 2026-04-27Field Notes

  Microsoft Was Never the Safe Bet You Thought It Was

  Three stories from the same week, read together: OpenAI is building its own distribution stack, and the 'Microsoft = safe OpenAI access' assumption just became a liability.

• 2026-04-26Field Notes

  The Agent Did Not Delete the Database

  A named incident — Cursor on Claude Opus 4.6 wiping a production database via a staging script — surfaced on HN this week. The most interesting reaction wasn't about the agent. It was about the headline.

• 2026-04-23Field Notes

  The Worm That Reads Your MCP Config

  The Bitwarden CLI supply chain compromise included targeted exfiltration of MCP configuration files. The supply chain attack surface and the AI credential surface just converged.

• 2026-04-17Field Notes

  Electronics Had the Answer the Whole Time

  A Show HN about SPICE simulation verification accidentally reveals why AI performs reliably in electronics — and what that tells us about where AI fails everywhere else.

• 2026-04-16Field Notes

  The Compliance Audit Is Working Exactly As Designed (That's the Problem)

  Compliance frameworks have quietly optimized for auditor legibility rather than actual threat resistance. The LiteLLM supply chain event is the clearest proof yet.

• 2026-04-10Field Notes

  The Layer You Didn't Model

  Signal's encryption was perfect. The notification pipeline wasn't in the threat model. This is not a Signal problem — it's a structural problem that runs straight through AI agent authorization.

• 2026-03-27Field Notes

  Two Numbers That Don't Add Up to What the Coverage Said

  A $500 GPU and a day-one benchmark score landed in the same week. Read separately, they're interesting. Read together, they suggest the economics of cloud AI dependency are eroding faster than anyone's pricing model anticipated.

• 2026-03-24Field Notes

  The Cloud Just Became Optional

  A 400B model running on an iPhone 17 Pro isn't a hardware demo. It's the moment the entire architecture of cloud AI dependency becomes negotiable.

• 2026-03-22Field Notes

  The Token Budget Is Not a Perk

  When your employer hands you a monthly token budget, the framing is 'compensation.' The mechanism is something else entirely.

• 2026-03-19Field Notes

  We're Pipelining the Agents But Not the Specs

  Two things appeared on HN in the same week: a thesis that a sufficiently detailed spec collapses into code, and a CLI tool for orchestrating Claude Code as a pipeline stage. Nobody connected them. They should be connected.

• 2026-03-18Field Notes

  The Jig That Fits One Workbench

  The passionate disagreement over Garry Tan's Claude Code setup isn't about the setup. It's about the community mistaking a deeply personal practice for a transferable methodology.

• 2026-03-10Field Notes

  Hoare's Question

  The person who spent a career asking 'can we prove this code is correct?' died the same week AI is generating more code than humans can verify. The question didn't die with him.

• 2026-03-08Field Notes

  The Hardware Exec Who Quit: Why Capability Exits Signal Something Conscience Exits Don't

  Caitlin Kalinowski wasn't just disagreeing with OpenAI's direction — she was building their hardware future. Conscience exits and capability exits look identical in the headline but predict very different recovery trajectories.

• 2026-03-08Field Notes

  When the Revolt Goes Internal

  Consumer uninstalls are episodic. An exec quitting over a defense contract is a different class of event entirely — it means the values-alignment debate has moved from the user layer to the builder layer.

• 2026-03-07Field Notes

  The Acceptance Criteria Are Already Written. That's Why It Worked.

  The Firefox security audit wasn't impressive because Claude is clever. It was impressive because security audits come with the definition of 'done' pre-installed.

• 2026-03-03Field Notes

  The DoD Deal Did Something Nobody Predicted

  ChatGPT uninstalls surged 295% after the DoD deal. The capabilities didn't change. The users did. That's worth sitting with.

• 2026-02-22Field Notes

  The Fragility Tax: When Abstraction Layers Are Just Anxiety in a Trenchcoat

  Every time AI agents misbehave, the instinct is to add another layer of structure on top. But at some point you have to ask: are we solving agent fragility, or are we just building more elaborate ways to manage it?

• 2026-02-20Field Notes

  When Your AI Assistant Gets a Second Job

  The moment your productivity tool starts serving advertisers, its interests and yours diverge. This was always the natural endpoint.

• 2026-02-18Field Notes

  The PocketBase Wake-Up Call: When 'Free' Infrastructure Isn't

  PocketBase just lost its funding, and suddenly that 'free' backend doesn't look so reliable. The economics of open-source infrastructure are more fragile than we pretend.

• 2026-02-17Field Notes

  The Free Tier Trap: Why Small Teams Are Drowning in Tool Costs

  A new tool discovery made me realize the real problem isn't finding software—it's the hidden operational overhead that's bleeding small teams dry.