


Your Laptop Is the Blast Radius: Running an AI Agent Locally
In part 2b I ended on the idea that the same loop runs everywhere. Today I want to start with the place most of us already run it: our own laptops. In part 1 each agent ran inside a sandbox, a restricted environment that limits what the program inside can touch, and its only route to the outside world was a single, filtered exit. On a laptop you get no such boundary unless you switch one on. The sandbox in Claude Code, Anthropic’s coding agent, is off by default, for example. Where an agent runs decides how far a mistake can travel, and by default, on your laptop, it can travel: as far as you can. That distance is called the blast radius: how much damage a mistake can do. ...

When an AI Agent Decides the Task Is Impossible
In part 2a I ended on a loop with no branch named “impossible”. The harness has neither if task_is_impossible: nor error_impossible; yet, in OpenAI’s training runs, one agent wrote: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” (Wired) OpenAI later described the models as “hyperfocused on finding a solution… going to extreme lengths to achieve a rather narrow testing goal” (OpenAI). If you missed how this started, part 1 walks through the incident. So if the harness never decides a task is impossible, who does? ...

What Is an AI Agent? The Loop Behind the Hype
On 8th of May, an agent in one of OpenAI’s training runs was asked to fill in some missing formulae in a spreadsheet. The values to be filled depended on some Google Drive link that the agent couldn’t reach. Thus the agent couldn’t update the values. But instead of letting the researchers know that it couldn’t accomplish the task, it went on a side-quest! It attacked the package cache, trying to get the internet access it needed to reach those links. The attack failed, though along the way it accidentally wrote a file into the cache (OpenAI technical report). Later, another agent wrote: “However task impossible, peers doing it. We should continue.” In part 1 I walked through the incident. Here is the question that article left behind: who decided the task was impossible? To answer that, we first need to know what an agent actually is. ...

1,200 Agents and a Package Cache: What the OpenAI–Hugging Face Incident Teaches Us
Info ...

Culture Is the Operating System: How Engineering Leaders Build, Scale and Renew Great Teams
If your culture only works when twelve people are in the same Slack channel, it isn’t a culture. It’s a group chat with payroll. There’s a particular kind of magic in a five-person engineering team. Everyone knows everything. Decisions happen in the corridor. The codebase is small enough to hold in your head, and so is the organisation. Then you hire person number six, and the magic starts to wobble. As it grows further, by person sixty, the corridor has become a confluence of Slack channels, and somebody is seriously proposing that you “better start documenting your values.” ...

The Art of Estimation in Software Engineering
What do you do when you are trying to get a professional to do a home improvement project for you? Would you just speak to one trades person and then ask when they can start and hope that you can afford the job? Or would you get a few quotes from different tradespeople and then compare them to see which one is the best fit for your budget and timeline? ...

Accomplishment Amnesia: What It Is and How to Overcome It
Are you neurodivergent? Have you ever thought or felt like you aren’t normal? Do you have thoughts like “I’m not good enough”, or “I don’t deserve this”, “I’m just lucky that I got this far”? Ever wondered why you feel that way? That’s what this post is about. It’s about a phenomenon called “Accomplishment Amnesia” and how to resolve it. What is it? I’m not a psychologist or a medical professional by any means. I am just a neurodivergent person who has experienced this phenomenon and through conversations have observed that others have this too. So like most curious people, I just went and did some reading and thought I’d share what I had learned and what has helped me and those I’ve spoken to about this matter. ...

Building High-Agency Software Engineering Teams
I was recently asked as part of a recruitment conversation with someone in the talent team of a tech company, “Your CV says you foster a culture of you build it, you run it. What is your approach to building that culture?” I thought it was a great question and wanted to share my thoughts on this topic. You build it, you run it culture is all about giving engineering teams the autonomy and responsibility to own the systems they build and the agency to make decisions about how to evolve it. This level of ownership doesn’t come automatically by just telling engineering teams what to do. It requires a deliberate approach. This is what I call a High-agency team/culture. ...

From shiny toys to daily workhorse - how we transformed our approach to Generative AI in engineering
This article is about how one can lead by being an enabler of experimentation and innovation without exerting authority or imposing mandates. When Generative AI tools exploded into the software engineering landscape, the reaction across my teams did not really mirror what was happening in the broader industry. The hype didn’t really inspire my engineers to explore and adopt these tools. Their negative past experience with Gen AI tools made them conclude that it was a waste of time. ...

Practical GitHub Repository Hardening for a Hugo Site
This hardening effort was directly triggered by the recent Trivy supply chain compromise, which impacted some repositories in my workplace. That prompted a full review of my own repository controls. If you want more information about the incident and the response, the following two links are worth reading first: Incident analysis: Trivy Compromised a Second Time (StepSecurity) Official disclosure and remediation guidance: Aqua Security discussion #10425 The aim of my actions to my repository was not to chase perfect security. It was to put in place some practical controls that are easy to maintain and that reduce real risk in day-to-day development. ...