CoreWeave Engineers: Should Agents Build Tools, or Be the Tool?
CoreWeave engineer Joël Henry describes their approach to anomaly detection in data centers by dividing agents into two roles—offline construction of deterministic detection pipelines and online reasoning on flagged anomalies—and notes that patterns discovered during inference can be written back as deterministic rules, making the system progressively cheaper as it runs.
A data center is a physical system. Power draw, inlet temperature, coolant flow, fan speed—all sampled continuously. Somewhere in that stream is the node that might interrupt a training run. CoreWeave engineer Joël Henry documented in a blog post published on October 15, 2026, how they decided where to let agents reason and where to replace them with engineering, and how that line moves over time.
There is only one core judgment: agents have two fundamentally different uses. The first is offline construction. An agent receives a harness—not just a simple prompt, but a complete working environment containing telemetry analysis tools, feature engineering, model training, and room for self-checks. It explores data, assembles pipelines, iterates tuning until metrics stop improving. The deliverable is standard machine learning code and fixed model weights, which enter production after human review. The agent itself is not on the execution path; running the same signal twice always yields the same answer.
The second is online reasoning. When a deterministic detector flags an anomaly, the question becomes open-ended: Is this a real failure? What caused it? What should be done? These judgments cannot be pre-written into procedures because useful programs are written after you see the case. Here, the agent is the tool itself—it queries historical telemetry, pulls node information, searches past incidents and operations manuals, returning judgments, recommendations, and reasoning processes.
Why not use just one type? Because the nature of the two tasks is fundamentally different. Anomaly detection processes five million signals daily; at this scale, it is impossible for language models to judge each one individually—even with lowered temperature, the same prompt may return different answers across different runs, whereas operations teams need a detector with completely consistent behavior. Conversely, explaining an anomaly requires comprehensive judgment: whether GPU, network, or storage caused training slowdowns. No pre-written procedure covers all situations.