# AI Pricing Chaos and Agentic Security Risks

**Podcast:** Dev Interrupted
**Published:** 2026-04-24

## Transcript

Oh, so you saw my message about Trixel and sadly what happened.
You'll remember a few weeks ago when Claude rolled out a whole bunch of features that got, you know, quote unquote leaked.
And one of them was a fun buddy system where you can like hatch a buddy.
It had like a name, a description and like some fun traits and whatnot.
It would literally hang out with you in the terminal.
But sadly, and what none of us knew is that when you upgrade your Claude version, which I mean, God, come on, we're all doing pretty regularly now.
It gets rid of your buddy.
So session by session, as I was finishing up what I was doing and closing it out and then whatnot, I lost all my sessions where Trixel existed except for one.
So now Trixel is just in this one little pane on this one cloud code version in my terminal that I never use because...
He's been fully upgraded and it got rid of him everywhere else.
It's almost like a friend that leaves without ever saying goodbye.
You just didn't get that chance to say goodbye.
I know.
I'm so sad.
It's like I didn't even mean to kill you, Trexel.
I just was trying to upgrade my cloud code version.
But I guess that's, you know, shame on me for getting to attach to my little terminal buddy.
But there'll be more.
Yeah.
Well, where are some friends here that aren't saying goodbye today?
Welcome to the Friday Deploy brought to you by Linear B.
I'm your host, Ben Lloyd Pearson.
And I'm your host, Andrew Ziegler.
And this week we are covering AI pricing chaos, cloud code patterns that have been exposed, and Vercel's third-party AI breach.
You want to just start right at the top, Andrew, with this AI pricing chaos?
Sure.
So let's talk about all the different providers right now adjusting the pricing around their harnesses and our access to their models.
This is really a pricing revolution that's happening among the biggest names in the field.
One of them that's like a big story that comes to mind first is at GitHub Copilot, they made changes to their individual plans.
In fact, what they did was they even paused signups.
for new subscriptions to GitHub Copilot Pro, ProPress, and also their student plan.
And that's a pretty shocking kind of discovery to find that they're going to stop all growth to address what is clearly a pricing problem within the model usage.
So what are you seeing when you see this kind of thing happen in the news?
Yeah, and they also mentioned, you know, they're tightening like the usage limits for individual plans.
So, you know, you're potentially going to start getting less usage out of it.
And they're also deprecating some Opus models.
Like, you know, they did say that Opus 4.7 will remain, but 4.5 and 4.6 are going to be removed, at least from the Pro Plus tier, which I actually thought that last bit was pretty interesting because, you know, supporting 4.7, but while dropping the other two.
It makes me think that it must be to do with promotional pricing for the 4.7 launch.
So it kind of feels like it's a temporary state.
I can't imagine that they're really getting long-term cost savings out of that.
But yeah, I mean, suspending signups, I think, is the most telling aspect of this.
That really says that they're concerned that they aren't going to be able to fulfill the promises that they're making to their new customers.
But, you know, I kind of think in some ways this is a pretty simple problem to solve if you really think about it.
You know, like most of these tools that we're using right now, they just encourage you to default to the most expensive model for everything.
You know, just why not pick the best model at all times?
Because, you know, I'm being charged a fixed limit and a fixed cost.
And as long as I'm not hitting my session limits, you know, that pricing model encourages me to consume as many tokens as possible until I hit my limit.
And so that's like, that's like what I'll do.
Like yesterday at the end of the, at the end of my day, I was like sitting at like 89% clawed session usage, like out of my session limit.
And I was like, I should push this to a hundred before I leave for the today.
Right?
Like it just wants, it makes you want to consume more.
And, you know, these companies really aren't thinking about efficiency yet.
Like we have covered some stories like Shopify.
We recently covered how they're switching or they've been using Quinn to sort of use sub-agents to do things locally.
And I think, you know, there's a lot of space for companies to come in with systems that get better at delegating work to less expensive or even local models so that I can do as much.
It's possible, like on my local laptop or, you know, in your case, you'd like to do everything on a VPS.
Like, why not just do your AI processing there rather than having to rely on an external service?
So, yeah, if there's anyone out there that works at GitHub listening to this, you know, I think that's your answer.
So you're welcome, I guess.
Yeah, you heard it here first.
You make a lot of great observations here.
One of them being around having a...
model router that understands what level of intelligence needs to serve the requests that you're asking and not defaulting to using the most default and intensive model that you can't.
I mean, a lot of these providers, they do shove the most, the strongest and the best in front of you because that's their best shot at guaranteeing you're going to have that great user experience and they're going to keep you.
And so it makes sense from like a growth play of why they do it.
But ultimately, Like in the world I've been in of taking things that I typically did like in a chat in CloudCoder, I would typically like or hop over to Cloud or OpenAI and use it in ChatGPT, like turning those into workflows and agents and systems with determinism and that live somewhere else like in another machine is that you have to understand all of like the seams around those requests and also like understanding.
When you do this, you start to realize that not everything needs to get sent to the most expensive API call that you can make now that you're making just raw API calls.
You start to think like, oh, this stage of the process is just a little bit of pre-processing or we're picking something out or we're cleaning something up.
And like, let's throw that the haiku.
Let's do something on machine, which I've done now multiple times.
And understanding that model choice is a big gradient.
And we have to, as consumers, get smart about choosing where on that gradient we need to be for what we're doing.
But in the meantime, I feel like we're all going to just be in this environment where we're just constantly encouraged to use more of the tokens.
Like even when Opus 4.7 came out and I upgraded and got access to that.
immediately it's on the extra high effort, high intensity mode to the point where like, I think if I ask it to ultra think it's going to dumb itself down, like I've kind of like, it's trying to operate on such a high level.
Maybe I don't always need it that way.
So a lot of really good observations about how it kind of like feeds the way that we use the tool.
Yeah, I mean, it seems like all these companies that are building like wrappers around the foundation models are just in a really tough place because I think what's really going to probably happen or what will be one of the many results from this trend that we're seeing, because we'll get into another story here that is very similar, is that when you're paying for like a seat-based unlimited usage plan, you're probably going to, like, I feel like being able to select your model is a luxury that we have right now that when you're on a seat-based model, will probably get taken away from you at some point.
The provider will decide which models are going to be used for you.
And that's where then you go to an API where it's more usage based, you know, because we have some workflows are like my personal workflows are all on my seat based consumption model.
But when we deploy a workflow, it gets moved over to an API consumption based model.
Then we actually do get really conscious about which model we're picking because we have to pay for it.
Exactly.
You're describing like my exact trajectory, like my cursor.
When you use cursor, cursor is a model router.
It defaults you to using auto mode, which then routes you to a lot of different models, including their own, to do a lot of different requests, which they know they can serve at various rates of cost.
And that's how Kirscher's been able to just scale to such a magnitude.
So you're right that these providers, they become the router just as much as they're the harness.
Yeah.
All right.
Well, let's talk about one of these foundation model companies also playing around with their pricing.
So Claude Code.
Andrew, do you think this is going to cost $100 a month moving forward?
What do you think?
A cloud code?
Yeah, I think it's probably going to cost more eventually.
I'm actually very much of the mind that the costs for all of these tools are going to start ratcheting up and up and up.
And you're going to start seeing equivalents that are more closer to like salaries, just because they're going to be able to measure the value of the output that way.
And I feel like a lot of those tools might slowly get out of a lot of people's grasp.
Yeah, yeah.
And of course, I bring it up because Anthropic got called out this week for quietly testing moving Claude Code to their Max account.
It's currently offered at their entry-level Pro account.
So a cost difference of 5 to 10x, depending on which Max account you sign up for.
Social media was abuzz with all of the news about this and people wondering, like, oh, are we going to lose access to Claude Code?
You know, all these people that are on these $20 a month accounts.
There's a representative from Anthropic that said it was just a small test on like 2% of their new signups.
However, the pricing change was visible to all users, which just added a little bit of confusion to the market.
It seems like Anthropic's doing some pricing experiments on the back end, trying to see if people are willing to pay more for something that they're currently getting a lot of value out of at a very low cost.
So, yeah, I don't know, Andrew, what do you think about this story?
Like, do you think it's something, a sign of an imminent change?
I mean, you seem pretty convinced that it's coming either way.
Oh, yeah.
My Cassandra complex is on fire with this one.
Absolutely.
I just, as someone who's paying for just one of the max tier, the highest level max tier count.
Just one.
I have to caveat that because there are folks who are adjacent to this podcast who use multiple.
And there are a lot of folks who bought them and use them and use them heavily for their open clause subscriptions, which you'll remember a few weeks ago, we talked about Anthropic clamped down on for the same exact reason, right?
Of people not utilizing the hardest in the tool and the allotments correctly and really messing with their pricing.
So as someone who's on the highest level max tier, it's like.
I know it's not getting taken away from me yet, but I do expect the cost for my tier to go up.
Even when I got my VPS, immediately after getting the VPS, I was told that when it comes time for renewal, it's going to cost a lot more.
Just because the door closed behind me, and it shows how...
high the demand is and when we talk here and our listeners here and like we're all listening it's like we're a little bit ahead of that curve because we're all early adopters and early users but there's a huge surging wave of demand behind us that is hard for us to comprehend and this pricing experiment you know companies of this size are going to do pricing experiments all the time i don't think that's necessarily the biggest scariest thing in the world If this freaked you out or if this was an existential crisis for you, then I invite you to step back and think about the places where you can source your inference and not be so dependent upon one provider.
That might mean distributing your workload across multiple tools.
It might mean starting to explore some local language models or self-hosting.
You might find that GPU hosting.
And fine-tuning costs are just much, much, much lower than this.
And if your biggest concern is the harness, just remember that a coding agent is a very small loop with about three tools.
And there's a lot of them available.
And that's not going to get taken away anytime soon.
Yeah.
Yeah.
You know, the pricing experiment, I actually want to touch on that a little bit because I think it is a little telling about the culture and the way that Anthropic works.
You know, I'm using Claude like basically every hour of the working day at this point.
The platform almost feels like this almost amorphous blob that just sort of like constantly shifts in real time.
Like things are always changing, adding new features.
Like I'll open a new thread and Claude will respond in a way that I'd never seen before and will do something that surprises me.
And I feel like this is just a constant state of change.
And I don't know, like, Andrew, if you've seen this, but like recently I just see random errors popping up that is like, Claude couldn't do this or something.
And it's like this obscure error message.
But then it just keeps chugging along and solves my problem anyways.
Like, it just looks to me like they are constantly iterating on the platform.
And I think this actually parallels, like, what's happening to a lot of organizations, particularly those that are starting to operate more in this AI forward or agentic way.
AI tooling, like we always have to remember, it's part of this like stochastic system.
So if you ask AI to build something that has relative complexity 100 different times, it's going to do it 100 different ways.
And not to mention, sometimes it's going to succeed, sometimes it will fail.
So you have to have checks in place to capture all of these things.
And there are clearly an emerging group of companies who are operating in this highly agentic manner.
And I'm not just referring to engineering, like we see it a lot in engineering.
But there are places where it's happening across the entire company.
And they're operating in what I would call like an agent first manner.
So when I say that, it's like what I mean is when you have a challenge or a problem that's presented to you, your default approach is to go into an agentic system to solve that problem.
You know, it's not just like chatting with an AI tool of your choice.
It's like having an agent that you communicate with.
convey meaning to it and have it go out and solve that problem completely for you all the way to production.
And you can see how quickly Anthropic is iterating on their core platform.
It's like one day you have this cool little buddy and then the next day it's gone forever.
But, you know, I'm at these, these tests, like to your point, these tests are probably going on nonstop on Anthropic.
Like on an hourly basis.
I think some companies maybe get to a point where they can do it maybe on a daily basis or a weekly basis, but it could even be happening faster with a company like Anthropic.
And I suspect that they have a good sense of how different companies use their platform, potentially even all the way down to the individual level, like which individuals are using our platform in a certain way.
And based on that data, they can surface capabilities to them to see whether or not the capability works, you know?
So I'm not really reading a whole lot into this specific case.
You know, you might be right that these capabilities are going to get more expensive, either that, or, you know, maybe, maybe like cowork becomes the $20 a month version and code becomes the power user, you know, a hundred or $200 a month version, something like that, you know, and cowork, maybe they can do what I was saying, but they implement more control that takes the decisions out of your hands.
So you don't get to pick the models and, And whatnot.
But Anthropic is also struggling with the same problem that GitHub has.
Like their current pricing model encourages me to consume as much as possible, as frequently as possible, as long as I don't exceed my limit, because that stops me from being able to work.
But yeah, it's just further proof.
Like we need more efficiency in this space.
Like whoever can solve this problem of giving us these powerful systems, but in a much more efficient manner.
That, in my books, is going to be the next winner in this space.
Yeah, really well said.
And I think that leads us pretty well to our next story as well, where we talk about how these major AI providers, like we've been talking about, Anthropic, but also OpenAI, Google, and Microsoft, are converging around the idea that AI agents are harnesses.
And that infrastructure layer that manages all of that execution and memories and tools has a staggering price tag involved.
Understanding its consumption is a huge task, and they're all taking radically different pricing approaches to try to understand what the winner is going to be.
So some of these I want to call out is like...
We've been talking about Anthropic.
They also launched this managed agents system, and this operates at $0.08 an hour.
And Ben, this might be a little bit of an answer to what you were asking for of you put it in their hands and you let them decide the model and how it should run.
That's kind of how managed agents work and allow people to kind of...
push that up into their Anthropic system and let Anthropic handle all of the nitty gritty details.
It's probably easier for them and more predictable for them to price that kind of work, especially because it's more batch based.
Whereas like OpenAI then immediately countered with an open source SDK because that's OpenAI's play is put the harness and its tools for building in everyone's hands.
And so they provided this open infrastructure representing kind of like a fundamental split.
You know, you see one go fully open source, you see one make it this closed proprietary system.
I think it shows a lot about like the diverging ideas.
What do you think about some of like the differences in which way people, these organizations are pricing their harnesses?
Yeah, I mean, you know, cloud service pricing has always been somewhat opaque, but you can generally estimate what your costs are going to be if you know.
the level of resources that you need to implement.
Like you can decide that a certain service is big enough for what we need.
So it has an ongoing fixed cost or, you know, maybe a cost that scales based on our estimated usage.
But I feel like AI tooling pricing is still just all over the place.
You know, we've been hitting it on it a lot here.
And I think the competition is great, but I'm really hoping that we can get more consistency and expectations around how these things are priced.
It's kind of obvious that many of these companies are operating in unsustainable pricing models today.
So it would be very, I guess, comforting to know where the industry as a whole is going to standardize over the next year or two so that we could make better decisions about where we need to be investing our AI usage.
But yeah, and then the article specifically calls out that it's really...
frameworks like Langchain, CrewAI, VoltAgent, these are the most likely that are likely to be disrupted by all of these agent harnesses that are emerging.
That seems to be the thing that everyone wants to productize right now is a harness on your agents.
And yeah, this article that we'll link to, it does a really wonderful job at just illustrating the current state of what I think are the two biggest trends happening right now.
And that is harnesses and orchestration.
You know, everyone on the leading edge is thinking about those two terms.
And there's a lot of products now that are starting to emerge in that space.
Yeah.
And things around, too, about how you operate these tools.
Like, we've been talking with a lot of folks on this show that have been pioneering a lot of that stuff.
Like, we've talked about the RALF loop and research plan implement RPI.
We've talked with both, you know, Jeffrey Huntley and Dex Horsey behind those ideas.
From this, it's like another thing we've really learned, for example, is when we talked with OpenAI's Codex team, we had Thibaut Sotio on the show to talk about exactly this, about their play, to make it open, to take a different stance in this conversation, kind of like what you're calling out, Ben, of like, you want them to come together.
It's like they are firmly divergent in their theory and their strategy on what will be prevailing.
So for us as users in the middle.
It's like we're in these places where we need to adapt and understand our own usage because we can't necessarily rely on our providers that provide that good, safe, infinitely scalable sandbox for us.
And one thing I'll call out there, going back to what we said earlier about model routers and about like you start building agents and agentic systems, you start making those model choices yourself and you start choosing cheaper ones for different parts of the process.
You know, that same thing is happening here.
you're trying to get a really strong grasp on your pricing and where to take it, that observability and understanding how much each run of your agent costs and where the costs are sunk is really valuable because that's how you become less dependent on the thrash of these pricing models.
You start getting cheaper layers in between.
Yeah.
And continuing on this topic of agentic harnesses, let's talk about the gifts that just keeps on giving the leaked source code from Claude Code.
This next article that we'll link to in the show notes features 12 reusable design patterns that have been extracted from the Claude Code base for production coding agents.
You know, things for like memory and context, workflow orchestration, tools and permissions, automation.
There's just a lot of really interesting flow charts and patterns that are in this article.
The author of this article mentions that these really do represent a lot of the fundamental architectural patterns that Anthropic is leveraging, many of which may even be relevant even as these technologies continue to evolve for some time.
So yeah, this is a rare look at the inside of a production-level agent system.
that is used by like hundreds of thousands of people, you know, around the world right now.
It's such a good analysis that like I was looking at each one of these flow charts and just being like, yeah, that makes sense.
Wow, that's really cool.
And just feeling like I was in the head of the anthropic engineering team.
Like, what did you think, Andrew?
Oh, I love this article because it perfectly captured the things from the leak or like the source code being available that we should be paying the most attention to.
And that is how is Claude Code primed to do its best work?
And you find traces of those ideas and theories all over the code base.
And then this article collects them in the one spot.
And what you get is almost like it's like this is the canon.
of how to effectively work with agents and orchestrate them at scale.
It takes actually a lot of the ideas from Gastown that we've been exploring all year and breaks them down into smaller, more fundamental parts that sure don't have colorful characters and things involved with them.
It actually finally gets at what I was really hoping to get maybe sooner, but now it's here of like a more academic and empirical language and terms that we can use to talk about these experiences we have.
Like I've been exploring this a lot, like coming from the AI hackathon I did earlier this year and how I used my planning and preparation method there to actually execute that.
And it's been a fundamental part.
of how I work.
And so when I studied this article, what I did is I actually provided the article to my orchestrator.
I asked it, you know, hey, like, check out this article of these different times of coding hardens practices.
Like, what do you think I do?
What are our opportunities to get better?
And in addition to learning a lot of ways that I could improve my own flow and system, my agent itself called out some things from this roundup that I do, that I really resonate with.
One of them is having persistent instruction files, obviously starting everything from having a Claude MD in its root, but specifically calling out that using a global one to set global level practices and using local ones to do local project level practices lets you scale and copy and paste and move things around a lot easier.
Also, it calls out the whole explore, plan, act.
methodology, which is RPI, which is like what we've been all about here in separating the concerns of work into different sub-agents.
That way their work doesn't influence each other.
Also things like using hooks and tiered permissions.
I offload a lot of cognitive burden from the agent into a linter for every language it works in.
That handles all of the cleanup and formatting and best practices without the agent having to spin cycles on it.
And lastly, the biggest one that stood out was externalized task memory, which has been, I know you know I've been talking about this all year, Beads, using Beads to do all of my agentic task management.
And Beads is an in-terminal memory system.
There's one from Steve Yege that's very popular with Gastown.
There's a much simpler one in Rust by Jeffrey Emanuel.
That's the one I use.
But this externalized task memory is one of the most critical parts to controlling your context window.
to get into a durable store.
So that's a huge unlock.
If any of those are new to you or if you haven't quite unlocked how to explore them, I challenge you to just feed this article to your agent and ask how you can get started.
Yeah.
And, you know, to one of the points you made, like there wasn't a lot in here that surprised me because it really did feel like it was just validating experiences that I have with Claude every day.
It was like, oh, now I understand why Claude works this way.
And I think really that's kind of the beauty of it.
It's just the simplicity of this architecture behind the systems in this.
You know, you mentioned the persistent instruction file system.
Like it's a very simple way of getting some high level consistency.
You know, I was also really fascinated by the compaction patterns that they that was shown off.
Because, you know, I've actually been very curious about that recently, just to understand like what it's doing when it does that, because there are times that, especially when I'm using like co-work, I've run into this quite a bit now, where it will compact the conversation.
And I don't want to stop it because I'm at a point where I'm not ready to like end that thread yet.
So it would be, it is helpful to just understand like what's the risk of me not stopping that thread moving forward.
And yeah, I absolutely love this article.
Like truly, I feel like you could just take it and feed it into an agentic system and you would have the high level architecture you need to build most of your core capabilities.
Like if you just ask Claude to build this for you.
Yeah, this is a canon for sure.
As someone who's been doing a lot of stuff on this list, I'm like, wow, I wish I would have had this list a few months ago.
This list is cool.
Yeah, but I mean, this stuff is changing super rapidly.
So like, yeah, there's a lot of fundamental stuff here that's probably going to be persistent for a while.
But at the same time, I imagine this is going to continue to rapidly evolve.
So, you know, even though we've gotten a snapshot of the way Anthropic works, you know, we've just mentioned how Anthropic moves very fast.
They could already have additional layers on top of this that do far more complex things.
All right, Andrew, let's wrap it up with this Vercel.
security incident.
We don't normally cover this type of stuff, but this one was particularly interesting.
So why are we covering this one?
This one was pretty bad to read about.
It was Vercel suffering a security breach.
Earlier this week, I think a lot of folks definitely got emails and notifications around this.
Vercel is one of the largest hosting platforms in the world.
It's used by a lot of tech companies as well.
This type of attack happened through an employee allowing use of a third-party tool through their company account.
And then the infiltrators are able to move sideways through Google Access.
to maybe compromise some Vercel systems.
Thankfully, I don't think the surface area of this tech was very big, and Vercel did everything right in this scenario with notifying everybody and rapidly responding to the problem.
I actually think that this is just another strong signal to just how dangerous it is out there right now.
on the web.
I think that the danger of the web can't be understated.
It's at an all-time high in terms of supply chain attacks and infiltrations on systems and machines because there's an inequality between the powers that agents give hackers to the defenders.
And that's because it's easy to spin up and parallelize a lot of hostile, you know, infiltrating or otherwise antagonistic activity, right?
But it's not so simple to use that same power to proactively and parallelize.
your defense.
And so you're seeing a lot of systems that typically were so hard and that you never would have thought about any kind of breach like this, just falling into these scenarios where they get ensnared through really complex.
This is an employee that allowed access to a third-party tool, which then it used as Gmail to move sideways into Vercel systems.
That's pretty complex in terms of the handoffs and the visibility.
And that's the kind of thing that you only get when you have an antagonistic entity out there who can have 100 or 1,000 agents monitoring every single packet that your company sends.
Definitely a sign at the scary times.
And we've talked about this recently when we had Dan Loring of Chain Guard here on the show.
We talked extensively about the supply chain crisis for software.
What do you think, Ben?
Yeah, well, fortunately, Vertel did indicate that there were no risks to the supply chain that they control.
But yeah, this situation is one of my worst nightmares.
I don't wish it on anyone.
And I was really curious to dig more into this beyond what Vercel said about it.
And I went over to Context AI, the company that was sort of at the center of this hack, and found they had a statement as well on this.
And they mentioned how last year in June, they released this new AI office suite, which was a new self-service consumer targeted.
This is a company that typically does B2B work.
So it was a new type of product for them.
And they deprecated the service last month.
But as a matter of fact, Vercel was actually, I don't, it sounds like they were never actually a customer of Context.
It just appears that one employee went in and enabled a permission for Context's AI agents and allow all permission into the Google workspace.
So basically allowing.
giving Context an OAuth token that grants complete access to that person's Google Workspace account.
Yeah, and then Context, I guess, found out they had unauthorized access to their AWS environment last year or last month, and OAuth tokens were included in the things that were accessed as a part of that.
But this is actually where I have some deeper questions about this story because Context did say they're notifying customers that were impacted by this.
or users that were impacted.
But, you know, this tells me that they're not, that these tokens aren't being refreshed on a regular basis, right?
If they're sitting around out there and they still have access to these people's accounts, even long after they've been deprecated, you know, there's always a risk that OAuth tokens get out into the wild.
So, you know, it's really important that, you know, it's never been more important that standard security practices are followed, like refreshing all of your tokens on a regular basis.
But yeah, we really need to solve this fundamental problem of a lack of sufficient permissions for agentic workflows that just exist across the board, no matter what tool you're using out there.
And we really need to solve this before agents are going to be able to fully take over our lives.
And in the meantime, we all just need to be just extremely conscious about the permissions we're granting.
to our AI systems.
Like I'm terrified that I'm going to fall victim to, to over granting permissions all the time.
Seriously.
Yeah.
And, and I just attended this really great talk from a friend of mine.
So shout out to Justin.
He's a frequent listener.
And this talk was about the current state of agentic software development.
And he had this really wonderful reminder that comes from Simon Willison about framing AI risk.
In fact, I think my friend Justin said that you should tattoo this somewhere visible on your body so you don't forget it.
But there's effectively three ingredients to agentic risk.
First is that the agent has access to untrusted content.
So this could be the internet, an email inbox, anything where an outsider can inject text.
Two, the agent has access to private data.
So this could be your internal Slack, could be your Google workspace, customer database.
And then third, the agent can externally communicate.
So he can send email or access APIs or post something to the web.
Your goal should be to only ever have one of those at a time, if possible.
If you get two of them, it's a risk that can be managed.
But if you have three, it's eventually going to be catastrophic at some point.
Like it's pretty much guaranteed that it will collapse at some point.
I completely agree with that.
That is a very smart observation by Justin.
Yeah.
So, you know, I hope we can all practice a bit of a blameless culture and not point too many fingers about why this happened yet.
But let's all learn from it as well and understand that, you know, these are real security risks that are emerging.
All right, Andrew, what are your agents up to right now?
My agents?
Well, let's see.
They're actually running marathons this morning because like what you said, I always feel so like I got to use the tokens available to me.
And my session had restarted right before this.
Also, I was using beads earlier.
a comment earlier this week about how my beads system, which is my agentic task management system, has recently kind of flipped from being where the agent puts the stuff it needs its sub-agents to do to like...
the agents put human labeled beads for me to do.
So sometimes the agents get blocked for something that they just don't have an ability or access to do because like Justin, I have a lot of separation of concerns.
So you get one agent that has a certain capability just trying to ask to do something somewhere else.
And eventually they can maybe collaborate on this.
But in the meantime, I'm at the nexus.
So I'll pop in and see what human beads have popped up for me while we've been here chatting.
What about you?
I knew this day would come, Andrew.
April.
24th, 2026, the agents start calling on us rather than us calling on them.
I am the human tool call.
Exactly.
It's actually really funny because only just two weeks ago when I was on stage at HumanX, were we talking about this exact thing in the panel?
It was Angela McNeil of Thread AI who was like, you know, we built our system so the agent can make.
called out to the human.
And I'm sitting there on the stage thinking, oh, that's so smart.
I wish that my agents would do that.
And then now here, two weeks later, and they're doing it.
Yeah, careful what you wish for.
But yeah, my agents, you know, the 34th volume of the ThoughtWorks technology radar is out.
It's too much for us to cover here on the show, even though we would love to.
So don't take our word for it.
Go read it yourself.
It's a really great guide.
You know, the TLDR on this one, AI is forcing engineers to rethink the foundation of their craft.
And how do we secure the permissions of hungry agents?
The topic that I want to talk about so much all the time.
And of course, there's a great shout out to the friend of show, Brigida Buckler, about the concept of harness engineering.
So just tying it all together.
I love it.
So yeah, my agents are going to be connecting to that and letting me have a conversation with it.
and think about what I can do with the knowledge that I gained from it.
Well, my agents will be looking for a report from your agents.
Yeah, all right.
They'll let you know.
All right.
Well, thanks everyone for joining us for the Friday Deploy presented by Linear B.
We'll catch you next week.
See you next time.
AI is everywhere in software engineering, but most teams still can't prove its impact.
That's where the APEX framework comes in.
APEX is a new operating model for engineering productivity.
designed to measure AI where it actually matters, at the pull request level.
It connects AI activity to delivery outcomes, not just tool usage.
Apex is built on four pillars, with AI leverage, predictability, efficiency, and developer experience.
Apex helps you increase throughput without sacrificing delivery confidence or burning out your team.
Because speed without predictability creates chaos, and faster coding often shifts bottlenecks downstream.
If you want to operationalize AI the right way, Linear B and Apex gives you the system and the cadence to do it.
Download the guide and start measuring what matters.