AI Agents

There’s a question every solo builder answers eventually, usually by getting it wrong once: Which answers am I allowed to act on without checking? Not “which tasks can AI do” — that’s a capability question and the answers change every few months. This is a sorting question, and it doesn’t change with the model. It changes with the task. The framework — and why it isn’t the article Let me be honest up front, because we do this on every post: the grading framework itself is not new, and it is not ours. Regulators, enterprise security teams, and academic groups have all published versions of it. Microsoft’s agentic-risk guidance says require approval for high-risk or irreversible actions. A recent DeepMind paper on delegation names reversibility as the axis that decides how much authority you can hand over. Practitioners publish permission matrices grading actions by blast radius × reversibility × stakes. If you want the general framework, those sources will serve you better than a solo-builder blog, and I’ll list them at the bottom so you can check them. ...

A brokerage just gave every customer a button that trades for them. Over 150,000 people turned it on in four months. The agents hit the platform’s tools about 30 million times a day. That’s not a bug report. It’s a structural change, and it matters more than the headlines about “AI trading” suggest. Here’s the thing nobody says plainly: those 150,000 accounts aren’t running 150,000 independent strategies. They’re choosing from a handful of shared models — the same few AI systems, pointed at the same market data, optimizing toward roughly the same goals. ...

Here’s a fact that should change how you think about your agent’s security: in July 2026, security researchers broke out of four widely used AI coding agents — Cursor, Codex CLI, Gemini CLI, and Antigravity — without breaking a single sandbox. Not one of the seven disclosed issues defeated the sandbox directly. Every one of them exploited the same thing instead: a gap between what the sandbox restricts and what a trusted component outside it later reads, runs, or scans. ...

Most solo builders now run an AI agent with real access: a file system, a couple of API keys, a database, maybe a deploy script. To make it useful, you connected it to things. A server from a README. A config you copied from a blog post. Something that “just worked” in about four minutes. That’s the part worth slowing down on. The thing you actually agreed to An MCP server is not a plugin. When you connect one, you hand the agent a set of tools, and you hand it the schema that describes those tools — their names, their parameters, and their descriptions. The model reads that description and decides when to call it. ...

The agent reported success. The job “completed.” Then the next step in your pipeline received nothing, and you spent an evening chasing the mystery. Here’s the liberating truth most solo builders don’t reach until it costs them: your agent’s failures are almost never dramatic. They’re mechanical, and mechanical means diagnosable. The bug was one missing closing bracket. The fix was reading one number in a log file. There is no genius in it — and that’s exactly the good news. ...

Everyone building on AI now is asking the same question: which model? And it’s the wrong question, because the model is the one part of your stack you don’t own, can’t keep, and will be forced to swap the moment a cheaper one ships. What you can own is everything that wraps around it. The memory. The rules. The decision boundaries. The list of things you’ve already verified and never have to verify again. ...

The agent said the tests pass. The commit is pushed. The deploy finished. As far as the summary in your chat window is concerned, the feature is done. Then you actually click the link and the page is a blank white screen. This is the most expensive sentence a solo builder learns the hard way: “done” is a claim, not a fact. And when your team is a handful of AI agents working through a chat interface, the gap between “claims done” and “is done” stops being an edge case and becomes the whole game. ...

There’s a new job title forming, and it doesn’t exist on any org chart. Fortune named it in March 2026: the supervisor class — developers whose primary value is no longer writing code but orchestrating the agents that write it for them. This isn’t a prediction. It’s already the daily reality for the fastest solo builders. And it changes something more fundamental than how fast you ship. It changes what you are. ...

The first time an agent blows it, the instinct is to reach for a bigger model. The second time, to “prompt harder.” Both miss the point. An agent that goes wrong is usually not a dumb model. It’s a model you handed the wrong shape to work in. The patterns you choose — how the model routes, what tools it can touch, whether it checks its own work — are what separate an agent that seems smart from one that keeps failing in the same predictable way. ...

Model Context Protocol won. It’s now “the boring infrastructure layer” — 78% of enterprise AI teams run MCP-backed agents in production, and it just got its biggest update ever, a fully stateless rewrite meant for “really big players” with tens of thousands of agents. So the question a solo builder faces is pointed: if the protocol is the standard, why would I ever write a raw API call myself? The instinct to just grab the API is right more often than the hype suggests. Here’s the rule. ...