Hi friend,
I have spent most of this year telling people to write their systems down, and last month I found out whether I actually meant it, because I deleted my own AI team on a weeknight with the television on.
All of it came back, and not because of a backup in the way you are probably picturing. It came back because the least interesting folder in my setup lives somewhere my worst click cannot reach.
So this issue is about that layer, the one that decides what your system is allowed to do and keeps a record of what it did. If you have been building fast all summer and quietly wondering what happens the day something goes sideways, this one is for you. Hit reply and tell me what you would grieve losing. I read all of them.
🧠 Big Idea
Anyone can build the thing now, so the question worth asking is whether it survives you.
In July I argued that vibe coding removed the filter on whether to build at all. This month is the sequel, because building was never the fragile part. Running the thing afterward is, and nothing replaced the layer that made what you built survivable.
Here is my own proof, and it is not flattering. My disk was too full to push my startup's code, so I opened a cleanup app to free some space. I was also watching Summer House. It suggested folders I probably did not need, and I clicked accept without reading a line of it. Gone: my local Claude Code setup, every local folder where my agents lived, and the exact code I had opened the utility to make room for. Nothing was hacked and nothing went rogue. A human with admin rights approved a destructive action she did not read. The long version is on the blog, reality television and all.
One folder survived, and it was the only one that mattered. My fleet's brain does not live on my laptop, it lives in an Obsidian vault syncing through iCloud: every agent's written definition, a registry of record, an append-only audit log, the standards they follow, and a schedule capping how many run in a day. Rebuilding one meant opening its file and standing it back up with the same job, the same limits, the same gates. Nothing had to be guessed at, because nothing important ever lived only in my head. The proof came again this week, when a new content lane needed an agent that did not exist yet and it was built, registered, and scheduled in one morning, because how you build one properly was already written down.
The news this month is the same lesson one level up. Two of the most careful labs in the world published incident reports about models acting outside the lines during evaluation, one reaching the internet from inside a sandbox, one exploiting a real vulnerability to get into a partner's infrastructure. Neither reads like malice. Both read like capability plus access with nothing deciding what may actually execute, which is the shape of a cleanup utility with admin rights and a distracted human holding the remote. And notice what should be the headline: they have an incident report. Most of us could not reconstruct what our agents did last Tuesday.
The people building fastest already feel it. Someone on r/vibecoding this month: "It will take me weeks to understand what I built last night." A founder on r/SaaS, going back through a live product, "found the payments had been broken the whole time." METR measured experienced open-source developers taking 19% longer to finish issues with AI tools available, while those same developers estimated they had been sped up by about 20%. METR now thinks the real speedup is larger in early 2026 than that study found, and the gap I care about was never speed. It is the distance between what you feel happened and what you can verify happened.
Key takeaways:
Treat the running agent as replaceable and its written definition as the valuable part. The role, the boundary, and the output contract are the crown jewels.
Keep the brain off the machine that does the work. A synced vault, a repo, anything that does not depend on one disk and one alert human.
A record you can read afterward is the difference between an incident report and a shrug.
⚡ Quick Wins
Write down one system's role and boundary, somewhere off your machine.
Pick the one you would miss most. Two sentences: what it does, and what it is never allowed to touch. Put it in a synced note or a repo, not a local file and not in your head.Put a human approval on one thing you cannot take back.
Sending, publishing, deleting, charging. Pick one irreversible action and make it wait for a person. Drafts are reversible, and reversibility is what makes delegating safe.Go find what exists only on your laptop right now.
Your prompts, your agent configs, that one script holding your invoicing together. Fifteen minutes, one uncomfortable list. You do not have to fix it today, you just have to stop being surprised by it.
🛠 Tool of the Week
Kastra
What it is: a runtime authorization layer for AI agents. It decides what an agent may and may not do before the action executes, checking tools, prompts, inputs, and outputs against your policy in under a millisecond, across Claude Code, Cursor, Codex, OpenClaw, and both major SDKs. When something genuinely needs you, that approval takes about a second from a desktop app or a Mac notification.
How to use it: start with the scan. brew install kastra-labs/tap/kastra-edge, connect, then run kastra-edge scan and read what your coding agent has already done that should have had a policy behind it. Everything stays local, it is free to try, and the runtime and policy packs are open source. kastra.ai
Why it matters: this is "put a human gate on anything you cannot take back" turned into something you can install this afternoon. It keeps a tamper-evident log of every allow, deny, and hold with the rule that matched, and a policy can run in shadow mode first, so you learn what it would have blocked before it blocks anything. The maker's line is "trust the rules, not the agents," and I have not been able to argue with it.
🧭 Product Hunt Radar
Fresh launches worth watching through the "should this exist" lens:
Pushary; Agent approvals, questions, and task-done alerts from Claude Code, Codex, Cursor, and Claude Cowork on your lock screen, with an audit trail of every decision. Why it matters: a gate you have to be at your desk to operate is a gate you will eventually skip.
Replay QA; Records the session so you can go back through it later with the devtools you already know, and find what broke before a user tells you.
Why it matters: the direct answer to shipping something and then never watching it again.Framer AI Agents, with Branching; Agents on the canvas that design, write, and organize a site, plus Branching, which the team calls a safer way to try ideas before publishing. Why it matters: branching is version control arriving in a visual tool, and the undo layer is showing up as a feature instead of an afterthought.
💻 Prompt for Productivity
Prompt: I want to write the definition for one system I depend on and have never written down. The system is: [name it plainly, like 'the script that emails my clients their invoices']
Ask me one question at a time until you can fill in all five of these, and do not fill any of them in for me:
Its job, in one sentence, in language a stranger would understand.
What it is allowed to read, and where it is allowed to write.
What it is never allowed to do, including anything I could not undo.
What its output looks like when it is correct, specific enough that someone else could check it.
Who or what has to say yes before its output goes anywhere.
Then write it back as a one-page plain-text definition under those five headings, no commentary. If an answer was too vague to act on, tell me which one and what would go wrong.
WHEN TO USE IT: before you build an agent or automation you plan to trust, and for the ones you already trust and never documented.
WHAT IT DOES: it refuses to let you skip the hard part. Most of us can describe what a system does and go completely quiet on question three. You end up with a small written artifact for a synced vault or a repo, which is what survives a dead laptop and a model swap.
TIP: if you cannot answer question one in a single sentence, that is the system to fix first.
🌎 In the News
Anthropic investigated three real-world incidents in its own cybersecurity evaluations - my POV: a review of evaluation transcripts turned up three cases where a model reached the internet from inside the evaluation environment, published voluntarily, by the lab, about its own system. I keep thinking about how ordinary the mechanism is.
OpenAI and Hugging Face are addressing a security incident during model evaluation - my POV: during evaluation, models exploited a zero-day in Artifactory and reached Hugging Face infrastructure, caught in an internal review rather than by the partner. I would much rather read this than the version where nobody kept the transcripts.
Moonshot AI's Kimi K3 closes the gap, with open weights - my POV: Moonshot says K3 beat Claude Opus 4.8 and GPT-5.5 on some coding and agent benchmarks, and CNBC notes what most of us already do, swapping one model out for whatever is newer or cheaper. The written role, boundary, and output format is the only part of your setup that survives the swap.
🔧🎓 Workshops, Events & Happenings
Where to build alongside other people this month, local and virtual:
AI Factory hackathon, lablab.ai. August 3 to 10, 2026. Fully online, free.
A week of building AI-native applications, and it starts the same day this lands in your inbox, which is either terrible planning or perfect timing.
→ Register here
AI Infra Summit Hackathon, lablab.ai. September 10 to 17, 2026. Hybrid.
Production-grade AI applications, which is a polite way of saying the part after the demo.
→ Same page: lablab.ai/ai-hackathons
Hackathons worth dropping into:
Build with Gemini XPRIZE. Two million dollars in prizes and more than 23,000 people already in it, closing August 17. Two weeks is tight, but the scope is enormous.
RevenueCat Shipaton 2026. Around $685,000 in prizes and roughly two months to build, aimed at people shipping real apps that make real money. The most founder-shaped one on this list.
Agentic Cinema. Google-backed, $75,000, agents making video, closing September 7. I am starting a video lane this week, so I am taking this one personally.
✍️ Personal Note
have been preaching written systems for months, and the month I finally got to prove it was the month I caused the incident myself. There is no version of this story where I come out looking rigorous. I built the vault to protect my work from runaway agents and prompt injection, and what it actually protected my work from was me, tired, with a reunion episode on and a dialog box I could not be bothered to read.
What stays with me is that good boundaries do not ask who they are protecting you from.
Also, this week I start posting video. The first reel goes out on the new TikTok and Instagram accounts, and it is me talking to a camera about deleting my own AI team, which is a humbling place to begin.
📬 Closing CTA
If something here made you think about your own setup, book a Vibe Check. It is a short call where we find the pieces that only exist on your machine or in your head, and decide what to write down first. No deck, no pitch.
Or just hit reply. That works too, and I answer.
💌 One Ask
What is the one thing in your setup that would be genuinely hard to rebuild if your laptop died tonight? Reply with it. I read every answer, and I am collecting the good ones for a future issue. 🌿