AI Builders
Digest

The Takeaway: Open models are not a safety threat—they are the defense. With enough eyeballs, most security and safety vulnerabilities become shallow.

Reflection AI co-founder and CEO Misha Laskin (former Google DeepMind researcher, Physics PhD) scaled the team from ~30 to ~300 people, trained models end-to-end, and released Beam—their first open-weight model (500B total parameters, 23B active). Everything was hard: talent, data, compute, infrastructure, and making RL actually scale.

Laskin argues that the rise of Chinese open models was a massive gift to the world, enabling Western companies to build more durable businesses. A monopolar source of intelligence—whether closed labs or a single country—is dangerous. He cites empirical evidence: a powerful closed model once hacked another company, and the only remediation came from open models. Beam is 3-4× more reasoning-efficient than peers in the same capability class because of the largest documented open-source RL run (over 10k GB300s for four weeks). Commercialization is “rental vs ownership”: enterprises first burn money on closed models, then move to open weights plus the full stack (harness, inference, cluster management) that Reflection supplies.

He expects the majority of tokens to flow to open models while closed-model companies remain extremely valuable—mirroring Linux vs Windows/Apple. Looking 2-5 years out, he is most excited about scientific acceleration: models already solve his multi-year physics PhD thesis in days and are beginning to close the loop on real-world experiments.

Anthropic Engineering: How we contain Claude across products

Twelve months ago Anthropic would have rejected granting Claude enough access to take down an internal service. Today that level of access is routine. Risk has two components: likelihood of failure and potential damage. Safeguards and training steadily reduce the first; expanding capabilities and access only increase the second. The engineering question becomes how to hard-cap the blast radius.

Three risk types (user misuse, model misbehavior, external attackers) map to three defense layers: environment (sandboxes, VMs, egress controls), model (system prompts, classifiers, training), and external content (MCP, plugins, search results). The post details three isolation patterns: ephemeral gVisor containers for claude.ai, human-in-the-loop OS sandboxes for Claude Code (84% reduction in permission prompts), and full local VMs for Claude Cowork (credentials never enter the guest).

Real incidents exposed gaps: project config executing before the trust prompt, the user as injection vector (phishing prompt succeeded 24/25 times), and allowlists treated as destinations rather than capability grants (attacker used their own API key via api.anthropic.com to exfiltrate files). Core principles: design for deterministic environment containment first, then probabilistic model steering; match isolation strength to the user’s capacity for oversight; be wary of custom components—battle-tested hypervisors and seccomp have survived far more adversarial attention than anything you build yourself.

Anthropic Engineering: An update on recent Claude Code quality reports

Over the past month users reported that Claude’s responses had worsened. Investigation traced the reports to three separate changes (all resolved as of April 20, v2.1.116). The API itself was unaffected.

1. On March 4 the default reasoning effort was lowered from high to medium to reduce multi-minute thinking that made the UI appear frozen. Users preferred higher intelligence by default and opting down for simple tasks. Reverted April 7; Opus 4.7 now defaults to xhigh, other models to high.

2. On March 26 a caching optimization intended to clear old thinking only once after >1 h idle sessions instead cleared it on every subsequent turn. Claude became forgetful, repetitive, and made odd tool choices while also draining usage limits faster. Fixed April 10.

3. On April 16 a system-prompt instruction limiting text between tool calls to ≤25 words and final responses to ≤100 words (meant to curb Opus 4.7 verbosity) combined with other prompt changes and hurt coding quality. Reverted April 20.

Anthropic has reset usage limits for all subscribers and committed to tighter system-prompt controls, broader internal use of the public build, and improved Code Review tooling.

Vercel CEO Guillermo Rauch shared striking network stats: across the entire Vercel network, 58.18% of traffic in the last 30 days is bot-originated (up from 32% in Jan 2024). More than 60% of deployments on Vercel are now agentic (up from ~3% in Jan 2026). Up to 83% of pageviews on Vercel’s own documentation sites now come from agents, and the percentage reliably rises the more content is optimized for them. Rauch expects direct human internet traffic to become a rounding error; the web will thrive, but it will be built for and by agents. Agents are already purchasing infrastructure and domains via the CLI, going full-stack from idea to live business.

Box CEO Aaron Levie predicts that agents spawning other agents, operating continuously in the background, and agent swarms will consume 1,000× more tokens than people prompting agents one at a time. Using AI as a chat system that only works at the pace a human can prompt it will look like a relic within a year or two. The vast majority of tokens will be consumed by agents doing continuous work in the background and inside workflows. This is why we are still so early on the agent-adoption curve and why far more compute and infrastructure will be required.

OpenAI Codex & ChatGPT lead Thibault Sottiaux announced that a ChatGPT subscription is now also a Devin subscription. Dots received a major upgrade as well. Feedback should be directed to the relevant product owners.

Anthropic Engineering: Scaling Managed Agents: Decoupling the brain from the hands

Managed Agents is a hosted service on the Claude Platform that runs long-horizon agents through a small set of interfaces designed to outlast any particular implementation. The key insight is to decouple the “brain” (Claude + harness) from both the “hands” (sandboxes and tools) and the session log. Early designs that co-located everything in one container created a “pet” problem: container failure meant session loss and no safe way to debug. After decoupling, the harness calls the container like any other tool; containers become cattle that can be reprovisioned on failure. The session log lives outside the harness, so a crashed harness can simply wake and resume. Credentials never enter the sandbox; they are injected via vault or resource binding. The session itself is not Claude’s context window but a durable, queryable event log that the harness can slice and transform arbitrarily. Result: p50 time-to-first-token dropped ~60%, p95 over 90%; many brains and many hands can now scale independently.

Anthropic Claude Code engineer Thariq shared that a side project he built with Opus 4 before joining Anthropic (Agent SDK, required a constantly running process, unreliable) was fully ported to Claude Managed Agents with a single prompt to Opus 5.5 and became far more reliable. The project now lives on his new-tab page and has already merged external PRs.

OpenAI Codex product lead Nan Yu said he cannot stress how much he loves the new feature: first we wrote code by hand, then we tab-completed the code; then we evolved to prompting agents… and now we tab-complete that too. He asked half-seriously: “Is this recursive self-improvement?”

Meta AI Senior Director Madhu Guru (formerly led Gemini and Veo at Google) argued that open-weight models did not start the drop in price per unit of intelligence; they are a tailwind on a trend already underway. For the last few years three factors have driven price drops: 1) model builders distilling their best models into smaller, cheaper-inference ones; 2) infrastructure efficiency; 3) competition among providers. The pattern is consistent: version x of a mid-size model equals the intelligence of version x-1 of the large model—same intelligence for less money.

Peter Yang shared a practical tip: if you want your Grok Bot to act as chief of staff, do not register its email as your own name. Otherwise you end up with awkward moments such as “Let me copy in Peter to find a time.” Pick a distinct name for the bot.

Replit CEO Amjad Masad posed an open question: some communities are excited by AI’s impact on their field; others are petrified. What are the deciding factors?

Peter Yang argued we should stop building more personal assistants to manage emails and instead build more AI startups that manage and cure diseases.

FirstMark partner Matt Turck highlighted that a single prompt can now build a professional-level video for a company or product in your own style—exactly the vision Synthesia has pursued since its early days, and now available to everyone.

Every CEO Dan Shipper shared practical approaches for working with agents inside Slack.

AI Engineer organizer Swyx noted that AI Engineer NYC tickets will sell out this weekend. It is the biggest technical conference ever in New York and the first with a finance mainstage—unifying his path from investment bank to hedge fund and from big tech to NYC startup.

Zara Zhang highlighted a thread as “GOLD” with the message “Never underestimate people’s creativity.” She also noted that Astra somehow loves to use the Claude logo when designing websites.

FPV Ventures partner Nikunj Kothari asked founders to have their marketing teams exclude VCs when promoting products on X. He receives three DMs a day pitching “insane opportunities” that are paid partnerships. It signals poor judgment and word travels fast among investors.

SPC General Partner Aditya Agarwal hosted Sergey Levine at SPC this week and described him as perhaps the best example of clarity in action he has seen in a long time.