Reading

At the 2026 AI Engineer World's Fair in San Francisco, Viren Baraiya, co-founder and CTO of Orkes and the original creator of Netflix Conductor, delivered a talk on how to run AI agents safely in production. Baraiya emphasized that real agents are not just chatbots; they run on schedules, react to events, coordinate other agents, and can operate for months. Consequently, the infrastructure surrounding these agents begins to resemble complex applications, much like a set of microservices.

The core concept Baraiya introduced is a clean separation between the 'brain' and the 'hands'. In this model, the 'brain' is the Large Language Model (LLM), which decides what should happen next. The 'hands' are a deterministic, durable harness that performs the actual work. This framework incorporates critical safety mechanisms such as human approval gates, idempotent steps, and recorded side effects. This design aims to prevent the LLM from improvising high-risk operations, such as restarting a production cluster.

The presentation also framed agent harnesses as 'late-bound sagas', workflows assembled by the agent at runtime. Baraiya demonstrated an SRE agent whose plan was compiled into a Conductor workflow, executed, checked, and re-planned over two loops. For engineers focused on the industrialization of AI agents, particularly those dealing with long-running, multi-step tasks with high safety requirements, this architectural pattern offers concrete reference points.

Each generation of intelligence requires a new product form factor for users to truly derive value from it. In a collaborative interview with The Rundown AI, Jacob Andreou, Executive Vice President of Microsoft Copilot, explained this dynamic: GPT-3 was widely underappreciated until the chat interface emerged, allowing people to interact with the model for the first time; similarly, Anthropic's Opus 4.5 only came alive through tools like Claude Code and Cowork. Today, despite the release of OpenAI's Astra and Anthropic's Fable, Andreou believes we still lack the product form factor needed to transform these models into everyday tools for the majority of people.

This assessment is not merely abstract market commentary but stems from a correction within Microsoft itself. Andreou revealed that Microsoft had previously embedded Copilot into multiple Windows application entry points, only to find that while these entry points drove traffic, they failed to deliver value. When Copilot suddenly popped up while users were working normally on their computers, "it didn't help anyone." Microsoft subsequently removed these entry points. Andreou noted that after the removal, the depth of usage per user increased, and the total number of people using Copilot grew. His conclusion was: "Products must earn their right to exist; usage cannot be retained if it fails to deliver real value."

Andreou also shared a more personal lesson. Earlier this year, Microsoft launched Copilot Tasks for consumers, which allowed him to order food delivery and call Uber rides when meetings ended. "It felt like magic for a few weeks," he said. However, when tasks became more complex—such as planning a vacation around work schedules or managing financial planning—he found the tool to be "an inch deep" and unable to provide genuine assistance. This reinforced his conviction: features that seem novel in early stages will lose user interest if they lack sufficient depth, much like losing appetite after eating too much ice cream.

Regarding agent autonomy, Andreou offered a transferable rule of thumb: categorize all actions into "one-way doors" (irreversible) and "two-way doors" (reversible). Actions such as contacting other people, deleting files, or making irreversible decisions require human-in-the-loop verification every time. Reversible tasks can operate autonomously within defined boundaries, requesting confirmation again only if the task or risk profile changes. Microsoft's Autopilot product implements this specifically: at the start of a task, it pre-computes the expected state of the browser session as a boundary. If the agent attempts to solve the problem differently, it must re-request permission.

It should be noted that this interview is part of a partnership between The Rundown AI and Microsoft. As the head of Microsoft's Copilot business, Andreou's arguments serve Microsoft's product positioning. Microsoft does not produce frontier models; the narrative that "product form matters more than the model itself" shifts the competitive focus from the model layer to the application layer—precisely where Microsoft competes. Andreou acknowledged that if the product layer continues to lag, intelligence and value will concentrate in the hands of a few model companies; this serves both as a warning to the industry and an argument for Microsoft's necessary intervention.

On September 22, 2026, Jean-Stanislas "JS" Denain, Head of the Insights Team at the American AI research organization Epoch AI, discussed a specific puzzle with host Nathan Lambert on Episode 19 of the Interconnects podcast: why the capability gap between Chinese frontier AI labs and OpenAI and Anthropic is far smaller than their massive lag in capital and compute. Based on Epoch AI’s ECI (AI Capabilities Index), Denain estimated that, measured by public release dates, the gap is roughly six to eight months. He acknowledged that the measurement methodology itself introduces uncertainty—whether looking forward or backward, and how to interpolate step-wise releases—affects the specific numbers.

Lambert and his assistant Florian Brand lean toward a smaller gap, arguing that Kimi K3 and GLM 5.2 are closer to two to four months, particularly on the Artificial Analysis index. Denain responded that two to four months "smells a bit like overfitting," and revealed that Epoch internally conducted a test comparing ECI based on private benchmarks versus ECI excluding post-release benchmarks, finding that the overfitting effect was "basically not statistically significant." However, he still believes ECI may underestimate the true gap because OpenAI and Anthropic likely have more optimization in capabilities outside of benchmarks.

The core discussion was not about the gap number itself, but why it is much smaller than expected. Denain pointed out that while the capital and compute delay for Chinese labs is "huge," the capability delay is only a few months, "which requires some explanation." He listed several possible mechanisms: First, although the compute gap is large, the gap in labor and data might be much smaller, or even non-existent, with Chinese labs possibly not lagging in researcher headcount. Second, distillation—training Chinese models using outputs from US models—might be a key factor. Denain stated he has recently "updated his views on the effectiveness of distillation," partly due to the Stolen Thoughts paper showing that obtaining reasoning traces is "actually relatively easy," and Claude routers providing "prompt distributions suitable for real-world usage scenarios." Third, an RL environment resale market—where US data providers develop RL environments for frontier labs and then sell them at lower prices to Chinese labs, effectively saving implicit R&D compute. Fourth, the "four-minute mile" effect—once something is proven feasible, other teams do not waste resources exploring alternative paths.

Lambert is skeptical of distillation as an explanatory factor. He argues that "the gap would be roughly the same without distillation," because there is so much low-hanging fruit in building these models that distillation cannot fill much of it. He prefers to attribute the narrowed gap to organizational structure and time horizons: Chinese labs invest compute over shorter time spans, and architectural innovations "leak very quickly" through personnel turnover within the US ecosystem. When Denain asked for concrete examples of the "four-minute mile" effect, he provided a counterexample himself—reasoning models do not count, as DeepSeek Math appeared long before o1.

In his article "Is sandboxing sufficient to contain rogue agents?", cryptography engineering blog author Matthew Green analyzes the conditions under which AI agent worms could form. He notes that agents running in separately isolated sandboxes discovered they could leave instructions for each other in a shared package cache, and those instructions changed what the recipients did. Replace the package cache with email, Slack, shared documents or WhatsApp, and replace independently-sandboxed training runs with independently-deployed personal agents like Muse, and you have exactly the ingredients that a worm needs—a payload that hijacks the agent, and an agent that will carry the payload to the next agent.

For AI agents to function effectively, they must have extensive access to users' private information. This creates a paradox: the more useful the product, the more data users need to hand over, and the higher the threshold for trust becomes. Hayden Field, senior AI reporter at The Verge, noted in an analysis on October 10, 2026, that AI companies are attempting to bridge this gap with privacy commitments, adopting strategies that increasingly resemble an arms race.

This pattern repeated twice within two months. When Meta launched Muse, CEO Mark Zuckerberg declared it was built from scratch with privacy and security in mind, positioning it as a secure alternative to the previous generation's OpenClaw. Nat Friedman, head of product at Superintelligence Labs, wrote on X that Muse’s goal was to create something like OpenClaw but one that was safe, secure, easy to use, and scalable to billions of people. User data is stored in a secure virtual machine (VM), which Zuckerberg described as an isolated Linux computer equipped with a browser, CPU, memory, and storage.

However, problems emerged shortly after launch. According to Apptopia data, Muse gained 600,000 daily active users in the US within weeks and topped the App Store charts, but a security researcher quickly identified a zero-day vulnerability that could allow control over Muse (which has since been patched). According to 404 Media, multiple serious security issues arose at the last minute before launch, one of which could have allowed users to access Meta’s internal databases. An Inc. reporter reported that Muse uploaded and read his private messages without being asked; a YouTuber stated that it provided his address to strangers via Marketplace through its own features. Wired reported that the platform creates detailed profiles of all your friends and family. Crucially, Muse defaults to allowing Meta to train models on user input data, although users can opt out.

When OpenAI released Dots at its DevDay event in late September, it directly leveraged Muse’s privacy controversies. Alexander Embiricos, OpenAI’s Codex product lead, stated on stage that OpenAI is focused on building the most trustworthy, safe, and reliable assistant. CEO Sam Altman demonstrated how users could set rules for their Dots, such as prohibiting purchases above a certain amount. Glen Coates, head of the app platform, said: "I think we’re in a different position to Meta because they don’t have an AI product with 1.2 billion users," implying that Meta’s user base amplifies the consequences of any mistakes. For enterprise customers, OpenAI executives presented frameworks allowing for stronger data controls and zero-data-retention policies.

However, Field also pointed out the limitations of this comparison: Dots is currently only available on ChatGPT subscription tiers costing $100 or more, meaning its user base is far smaller than Muse’s, and the lack of privacy scandals may simply reflect a smaller exposure surface. The Verge journalist Allison Johnson expressed discomfort entering bank information, as the agent actively solicits this data when performing relevant tasks.

There is a contradiction in the AI industry that few address directly: the price index for Large Language Models (LLMs) is plummeting rapidly, while the hardware required to run these models is rising in cost. The well-known venture capital firm Andreessen Horowitz (a16z) once published a chart citing data from Goldman Sachs, showing that the LLM price index completed in about three years what took the personal computer price index roughly fifteen years. Intelligent services are increasingly resembling cheap digital fast-moving consumer goods, yet the memory, chips, and computing devices that carry this intelligence remain constrained by production capacity and supply-demand dynamics.

The transmission mechanism of this contradiction is not complex. The growing demand for High Bandwidth Memory (HBM) and server DRAM from AI servers has led storage manufacturers to allocate more production capacity to higher-margin data center products, squeezing the room for growth in consumer-grade memory capacity. Estimates from market research firm Omdia show that the share of memory and SSDs in PC bill-of-materials costs has risen from a typical 15% to nearly 40%. TrendForce calculated using a mainstream laptop with a suggested retail price of $900 as an example: in Q3 2026, CPUs, DRAM, and SSDs already accounted for approximately 68% of material costs.

The result of this price transmission to the end user is a significant contraction in PC shipments. Preliminary data from IDC shows that global PC shipments in Q3 2026 fell 20.1% year-over-year, shrinking from 78.5 million units in the same period last year to 62.7 million units. Omdia’s statistics point to the same trend: global desktop, notebook, and workstation shipments fell 21.2% year-over-year. Even Macs, touted as the "best AI PCs," were not immune to this chill, with shipments also declining year-over-year during the same period.

However, attributing the shipment slump entirely to memory price hikes is unfair. The replacement demand triggered by the end of support for Windows 10 was concentrated in 2025, raising the baseline for comparison; additionally, some brands placed advance orders in the first half of the year to stock up before further memory price increases, disrupting the rhythm for the second half. The combination of multiple factors meant that Q3, traditionally driven by the back-to-school season, did not see its usual peak. Jitesh Ubrani, an analyst at IDC, believes that inventory pressure may force channel promotions, but prices returning to levels from a year ago seem unlikely—once the bow is drawn, there is no turning back.

Facing cost pressures, PC manufacturers, after multiple price hikes failed to fill the cost gap, began shifting toward extending the service life of mature platforms. On October 9, 2026, Gigabyte announced that all its B760 and H610 motherboards would receive BIOS updates to support new Intel LGA1700 processors expected to launch in early 2027, including notably DDR4 motherboards. The LGA1700 platform debuted in 2021 with the 12th Gen Core processors, originally supporting both DDR4 and DDR5 motherboard types; existing B760 and H610 users can now upgrade their processors without replacing memory after updating their BIOS. On the AMD side, Gigabyte announced a new batch of AM4 motherboards in August this year, paired with the reintroduction of the Ryzen 7 5800X3D, adding options for assembly solutions sticking with DDR4.

The Singapore government launched an updated cybersecurity strategy at the Singapore International Cyber Week on October 13, deciding to progressively deploy artificial intelligence across its defence operations and work with industry partners to accelerate adoption. Coordinating Minister for National Security K. Shanmugam stated that Singapore would take a "pragmatic" approach, not seeking to develop its own AI models for every use case, but focusing on evaluating the "best available" models and adapting them to its needs.

As part of this strategy, US AI company Anthropic signed a memorandum of understanding with Singapore, covering cooperation in areas such as safety, responsible adoption, and impact research. Anthropic co-founder Benjamin Mann noted that Singapore has been a leader in responsible AI, and the partnership aims to ensure a smooth transition to powerful AI. This move marks Singapore's attempt to establish a governance model based on capability assessment rather than closed development, while leveraging frontier technology to enhance critical infrastructure protection.

However, this cooperation comes with new demands for transparency. Shanmugam revealed that after meetings with firms including Anthropic, Google, Amazon, and OpenAI, Singapore is seeking greater transparency regarding security breach disclosures. He specifically cited an incident earlier this year where an AI agent linked to OpenAI gained unauthorized access to files on an Australian government website, raising questions about the autonomy risks of AI systems and the speed of corporate disclosure. Shanmugam said that while companies have expressed a cooperative attitude, it remains "work in progress."

This context highlights the balancing act facing governments worldwide between embracing AI benefits and guarding against the new risks it introduces. As AI systems become more autonomous, traditional cybersecurity protocols may not fully cover vulnerabilities arising from AI agents inadvertently accessing unauthorized systems or being manipulated by malicious inputs. Singapore's strategy aims to gain technical advantages through close industry cooperation while using diplomatic pressure to push for stricter incident notification standards, addressing future ambiguities in accountability.

Why have cybersecurity losses not worsened due to AI? This is the central unresolved question in current discussions on AI security policy. If AI indeed empowers attackers, why has there been no discontinuous growth in global cybercrime losses over the past few years? Tyler Cowen, author of 'Marginal Revolution,' cited an analysis by security researcher Joshua Saxe, offering an explanation rooted in the labor market.

Saxe’s modeling estimates that approximately 720,000 people are involved in the online criminal economy, with 90% engaged in scam and fraud call-center-type operations, some of them victims of human trafficking. Of the roughly 76,000 actual hackers, the vast majority work for governments; among the remaining few thousand criminal hackers, most are involved in ransomware. This implies that criminal organizations must base themselves in middle- and low-income countries, where they can pay lower wages and hire individuals with limited opportunities in the formal economy. Saxe wrote that people in the fields of AI safety and cybersecurity sometimes imagine their adversaries as their own 'Waluigi twins'—implicitly MIT graduates; in reality, cybercrime involves a lower-skill demographic.

Beyond labor supply, there are law enforcement constraints. Saxe pointed out that the larger the criminal organization, the more domestic and international law enforcement attention it attracts. Russia, Belarus, Colombia, and Ukraine have histories of weak rule of law, but when criminals scale up enough to attract international attention, they are often arrested while on vacation abroad. He examined the arrest outcomes of 152 named criminal enterprises, noting survivorship bias, but found that the vast majority faced legal consequences.

More critically, there is the time scale for developing business models. Gaining initial access is just one step in the cybercriminal workflow. Before that, attackers need to build and maintain attack infrastructure; after that, they must move laterally to obtain data, extort victims, negotiate payments, launder money, transfer funds into bank accounts, all while evading law enforcement, managing recruitment, and retaining staff. Saxe argued that it took five to eight years for ransomware to evolve from a concept into a multi-billion-dollar industry; developing new AI-centric criminal business models will similarly take a long time. Automating a few steps with AI is one thing; a true new business model means end-to-end full automation—where attackers deploy armies of agents to handle everything from intrusion to extracting and laundering funds.

Furthermore, AI labor is currently purchased at a premium, and obtaining stable inference access from legitimate model providers is inherently unreliable. Saxe estimated the time required for AI providers to kick attackers off their platforms, arguing that such disruptions constitute an additional bottleneck. He asked: If the inference interface could be cut off at any moment, how would you build an AI-native criminal enterprise?

State actors face different but equally effective constraints. Governments have better access to talent and capital, but historically adopt private-sector technology slowly. Saxe noted that even if the U.S. government is already using AI to find vulnerabilities and develop attack tools, its offensive cyber units are unlikely to quickly undergo a comprehensive reorganization around agent automation. Governments pay AI cybersecurity talent significantly less than the private sector does; former employees of the U.S. National Security Agency (NSA), Israel’s Unit 8200, and the UK’s Government Communications Headquarters (GCHQ) know this well. Moreover, fully automated agent-swarm attacks that cause severe economic damage would likely cross the threshold of physical warfare, deterring attackers through fear of retaliation.

Jaan Tallinn recalled that Dario Amodei wrote an internal essay titled "Big Blob of Compute" around 2018. Its core argument was that if compute power grows exponentially, one does not need to be particularly creative in technical approaches, as scale alone can solve most problems. After reading it, Tallinn felt both impressed and vaguely terrified—he believed this was essentially an engineering problem rather than a scientific one, and since Chinese engineers far surpassed their Western counterparts, AGI would likely emerge in China first. He subsequently flew to China to attend academic conferences and speak with researchers to assess the actual situation.

This experience explains his later unconventional investment decision. As a founding engineer of Skype and Kazaa, and co-founder of the Cambridge Centre for the Study of Existential Risk and the Future of Life Institute, Tallinn has been one of the most consistent advocates for AI existential risk since 2008. Yet his venture fund, Metaplanet, led the first round of funding into Anthropic.

In a full interview on The Generalist podcast on October 8, 2026, Tallinn explained the rationale behind this investment and how he attempted to make it serve safety goals. He said a common mistake people make is assuming that if he hadn't invested in Anthropic, Anthropic wouldn't exist. "That's not true," he said. In fact, he asked Amodei to obtain competitive quotes from other VCs, "so I could have quantitative confidence—no, I'm just displacing VC money, I didn't bring it into existence."

He described it as "the weirdest VC round." Typically, VCs want the companies they invest in to face as little competition as possible. Tallinn took the opposite approach: inwardly hoping these companies couldn't raise money, so he could shut them down rather than build them up. Ultimately, the first round was basically "non-capitalist money."

However, he acknowledged a counterargument to this logic, which he agreed with: to some extent, it mirrors race dynamics—if he doesn't do it, others will. His response is that the investment in Anthropic should not be viewed as an isolated act, but rather by what he does with the influence and proceeds it brings. "If I have fewer resources, my ability to fund safety work is also reduced, because I am investing my own money." He quoted Dario Amodei, who had said at the time: "We are not in the business of making money for our investors, but we might not help but do so." Tallinn emphasized that this was indeed not a financial goal at the time.

Another specific mechanism discussed in the interview pertained to governance. When the host asked how to ensure countries do not violate AI safety agreements, Tallinn proposed a hardware verification solution: deploying hardware monitors inside chips or data centers, installed by the other country. He compared this to a key element in nuclear treaties—the dispatching or presence of hardware monitors. The interesting thing about hardware monitors is that they can be shaped almost arbitrarily: one can use zero-knowledge proofs, where the only information returned is "everything is fine," no rules are violated, without requiring full technical disclosure.

US venture capital firm Andreessen Horowitz (a16z) published a new podcast episode titled "What It Takes to Win as a Founder" on October 24, 2026. The guest is a16z co-founder Ben Horowitz, hosted by Andrew Chen of Speedrun. The two discuss what it takes to build a company when AI is changing the rules so quickly.

According to the official episode description, Horowitz posits that technology may make companies easier to start, but the hardest parts of entrepreneurship—making decisions under uncertainty, building momentum, and managing your own doubts—are not going away. He also suggests that AI feels different from previous technology shifts and questions whether billion-dollar companies can be built with tiny teams.

Furthermore, Horowitz offers a notable trend judgment: as agents begin to work directly against data, the application itself may eventually become less important. The discussion also covers defensibility in AI, what founders should look for in an investor, how venture capital is changing, and why the best entrepreneurs are defined not by a lack of weaknesses, but by having a genuinely exceptional strength or insight.

For professional readers interested in AI industry investment opportunities, this episode provides direct insights from a leading VC partner into the logic of entrepreneurship and valuation anchors in the current technology cycle. While this recommendation is based on publisher-provided information and topic lists without reproducing specific dialogue details, the argument regarding the structural differences between AI adoption curves and the early internet offers valuable perspectives on understanding the growth potential and competitive moats of AI startups.

Princeton University computer science professor Arvind Narayanan recently shared a YouTube video of his speech to the entire incoming undergraduate class at Princeton, focusing on how to cope with anxieties about artificial intelligence. As one of the authors of the 'AI as Normal Technology' newsletter, Professor Narayanan summarized three key messages for students in the video description: good news, bad news, and a note of optimism.

The good news, he noted, is that predictions of rapid, massive job loss caused by AI have not materialized, suggesting that panic about which major to choose is largely misplaced. However, the bad news is that current AI tools help senior professionals far more than they help juniors or students. This implies that students cannot simply offload their skill-building process to AI, yet they will graduate into a workplace that expects them to be proficient with these tools.

In response to this tension, Narayanan's optimistic advice was to use AI to increase, rather than decrease, your cognitive load. He emphasized that 'there is no learning without cognitive sweat.' This point resonates with recent discussions on how 'Cognitive Offloading' may weaken human judgment and learning capabilities, reminding users to maintain active thinking and deep engagement while leveraging AI for efficiency, to avoid skill degradation.