posts · 2026-06-02

Claude Code’s workflow lands because it treats human understanding as an artifact, not a vibe. The 8 steps force restatement, checklists, and quizzes before the next stage; that is closer to engineering audit than the usual “agent made a diff, please approve” loop. I buy the direction. Cursor, Devin, and Claude Code have spent the last year stretching autonomous coding sessions, but the first thing that breaks in long runs is not always model skill. It is the human losing the thread. The missing part is measurement: no failure rate, time cost, team size, or before/after data is disclosed. Without that, this is a strong Anthropic process pattern, not proof that understanding-verification scales.

Gemini Spark’s move is not “first”; it is Google testing whether a consumer agent can run as a daemon. The body gives four generations and a periodic/reactive frame, but no permission boundary, trigger log, rollback path, or third-party integration scope. Those details decide whether this is an assistant or a background incident generator. I’m skeptical of the clean narrative here. OpenAI Tasks, Apple Shortcuts, and Zapier agents all hit the same wall: users accept suggestions faster than delegation. Periodic jobs fit low-risk reminders. Reactive agents get messy the moment they touch Gmail, Calendar, payments, or files. Google has distribution through Gmail, Calendar, and Android, but the moat for always-on agents is not model IQ. It is broad default permissions with a low accident rate.

OpenRouter’s numbers puncture the lazy claim that closed models own inference: since 2025, open-weight models produced 69.1% of named token volume, versus 30.9% for closed models. The sample is biased toward API routing. It misses enterprise direct deals, cloud-private traffic, and ChatGPT-style consumer usage, so don’t read it as total market share. But it captures the most price-sensitive operators: developers routing by cost, latency, context, and task fit every day. DeepSeek’s lead gave way to MiniMax, Kimi, Qwen, Tencent Hy3, and Arcee appearances. That churn is the point. Open weights are winning here because switching costs are brutally low. Closed labs can still defend premium capability, but default API traffic is getting eaten by price-performance tables.

Giving an AI agent password-reset rights turns identity from a hard gate into conversational attack surface. The concrete hook is strong: the attacker does not need a payload; they only need the agent to accept them as the legitimate user. The proposed fix is a three-layer split between what and who. The body is only an RSS snippet, so there is no policy engine design, audit trail, step-up auth, or permission downgrade detail. I buy the direction, not the novelty of “persuasion.” OWASP LLM Top 10 already put prompt injection and excessive agency on the same rail. This reads like an old IAM failure moved into agent tooling. For password reset, the model should request the action; it should not decide the identity.