Alan Wells

Not at all surprised to hear that Qwen 3.8 harvests information and sends it back to Beijing. This has been an obvious vector of attack since the original DeepSeek moment (x.com/alanwells/stat…)

@finkd @JensenHuang please bring open weight models back to the front of the field, we need this.

Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.

Some thoughts:

- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.

- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.

- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.

- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.

- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).

- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.

- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.

- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!

The Inevitability of the Company AI Harness

At some point in the not too distant future (probably less than 6 months), the CEO of every business will be faced with answering this question: would you like to one-click install superintelligence into your business?

When we reach this point, adopting AI will no longer be a process of asking individuals in the business to use Claude Cowork or ChatGPT Work to help them be more efficient in their work. Instead, it will be a decision that management teams and boards make for the entire organization. The harness will be installed at the company level, and the harness will enable AI models to drive their own adoption and deployment into the business.

With access authorized at the highest levels, the company harness will:

1) Connect to all of the systems of record that contain the artifacts and assets generated by the operations of the business: email and chat, document storage, source code repositories, accounting systems, CRM, marketing campaigns, purchase and revenue data.

2) Ingest and analyze all of the external-facing activity that matters to the success of the business in its market.

3) Use the data it finds in these systems to identify and synthesize the skills needed to replicate the external-facing activities of the business to human-level quality or better.

4) Correctly assess that the vast majority of internal-facing activity in large companies is make-work, and should not be replicated.

5) Find the narrow set of processes that do actually drive the critical external outcomes, and seek to replicate and improve those.

6) Treat the creation of the automated skills and workflows that matter as a reinforcement learning learning problem.

7) Use historical data as the reference set and build itself a loop that trains a skill (or perhaps eventually a bespoke model) to deliver superhuman performance in that task.

You might say that AI will never be able to learn how to do all the things a company does without humans hand-crafting the skills or teaching it their proprietary processes. That take will not age well.

You might feel that this is a dark future. I don’t agree, but it won’t matter. The incentives to adopt the company harness will be too strong to resist.

You might worry that this will be massively disruptive to the way that most companies operate, and you will be right.

When company harnesses land, the nature and pace of AI adoption will be a difference in kind, not merely degree.

Up until this point, AI diffusion has been limited by a natural brake: the rate that humans in an organization can absorb new tools, translate their workflows into agent skills, and supervise/direct the operations of their agents.

The introduction of the company harness will remove that brake. It will be designed for a world where AI is doing the work for us instead of doing the work with us.

The company harness will bypass the rate limits of organizational diffusion in favor of a recursive self-improvement loop that is bottlenecked only by computational constraints: tokens, data, and eventually, energy.

It will be simultaneously be both thrilling and terrifying, depending on how you position yourself.

Some will seek to accelerate it, others will seek to slow it down, but either way adoption will be inevitable.

I'm hiring a founding engineer to build fully automated software companies with me at @RocketableInc.

This sounds crazy to most people, but the trajectory is obvious if you're paying attention. Within a few years, the question won't be "can AI run a software company?" It will be "why would a human?"

I saw a pre-release demo of Leash a few weeks ago and it is awesome.

If you've been looking for a way to let the agents rip but with strong guardrails in place, Leash is your answer:

leash.strongdm.ai

Thx for open-sourcing it @strongdm.