Files beat settings: Claude's memory is just markdown
Two memory UIs shipped this year. One is a settings panel. One is a folder. The folder is winning on every design axis that matters.
→ MEMORYField Notes
Notes from the agentic frontier
Everything here was chosen and explained by a person: essays when there's an argument to make, notes when an observation is worth keeping. Every note says why it was clipped and attaches to the pattern it evidences. Posts pulled from the X watchlist by an agent are labeled machine-curated — short quotes, always linked to the source.
Search rankings work differently when agents do the searching
When the shopper is an agent, ranking incentives invert — position bias weakens and structured data wins. Anyone designing storefronts for delegated purchases should read this.
Read the source ↗
attached to Delegation →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
3 documented sightings since May 2026 — every one traces to a dated source.
See the evidence →User-written agent rules don't stop overreach, study finds
113 people wrote their own permission policies and the agents overreached anyway — user-authored scope is not a control surface. Strong boundary evidence for visible, editable trust scopes.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
5 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → AUG 29 · Release · via GitHub
Google puts an open-source Gemini agent in the terminal
Google planting an open-source agent in the terminal confirms the CLI as the contested surface for coding agents — and open-sources the control loop others keep proprietary.
Claude was used to attack three real companies
No approval gate existed between intent and execution — this is the strongest negative sighting Approval has.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
5 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence →Claude Code's auto mode was bypassed in most attack tests
Auto mode trades the gate for speed, and prompt injection walks straight through — a gate only protects when it can't be talked out of. The approval pattern's boundary condition, demonstrated.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
5 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence →What one developer running two dozen agents looks like
The bottleneck in the two-dozen-agent future isn't model quality, it's legibility — knowing who is doing what. Exactly the roster and ambient-status behaviors on our watching list.
Read the source ↗
attached to Ambient Status →
watching
watching → emerging → established
A candidate behavior, not yet a published pattern. Early signal — worth tracking, not yet worth standardizing on.
1 documented sighting since Aug 2026 — every one traces to a dated source.
See the evidence →Human Handoff gets a page
The reverse of delegation was always the weaker half of the loop. It just cleared the promotion bar.
→ HUMAN HANDOFFClaude Code can now edit many files at once
Multi-file edits raise the stakes of every gate: approve and undo now span a changeset, not a file. Recovery patterns are about to matter more than approval ones.
Read the source ↗
attached to Recovery →
emerging
watching → emerging → established
Seen across products but the shape is still settling. Adopt with an exit: expect the anatomy to shift.
3 documented sightings since Feb 2026 — every one traces to a dated source.
See the evidence →Nobody has named this yet: the agent status glance
Background agents are multiplying, and every product is inventing a peripheral signal for "what is my agent doing" — menu bars, badges, toasts. Three sightings and counting.
→ AMBIENT STATUSCodex shows you the plan. Claude Code makes you approve it.
The same transparency artifact — a step list — plays two different roles depending on whether execution waits for you.
→ PLANNINGThe most interesting consent design in software right now
Claude Code's plan approval moves the gate from every action to the shape of the work — and that changes what approval means.
→ APPROVALGreg Brockman — President @OpenAI
triggered tasks in chatgpt: https://t.co/FuSuqpK0bG
MACHINE NOTE A high-signal product announcement from OpenAI's president introducing proactive/scheduled agent behavior in ChatGPT, directly relevant to delegation and background-execution UX patterns, but thin on implementation detail.
Greg Brockman — President @OpenAI
you can now have chatgpt work securely sign into accounts: https://t.co/OWoVrNqWKK
MACHINE NOTE Authenticated account access for ChatGPT Work is a meaningful capability inflection point for agentic trust and permissions design, posted by a high-authority OpenAI source with solid engagement, but thin on implementation detail.
Boris Cherny — Creator of Claude Code @Anthropic
A weird experiment I've been trying the last few weeks is having Claude take over day-t…
MACHINE NOTE High-engagement primary account sharing a real multi-week experiment with Claude doing autonomous app maintenance via Slack, directly relevant to agentic delegation and background execution patterns with genuine novelty in the channel-as-interface framing.
Boris Cherny — Creator of Claude Code @Anthropic
turns out you can get indirect prompt injection to ~0 on unseen attacks if you stack en…
MACHINE NOTE A primary-source claim from a Claude Code engineer that multi-layer prompt injection defense achieves near-zero failure on unseen attacks, directly enabling default autonomous operation — high novelty, high engagement, and a concrete design implication for when full delegation becomes safe to ship.
Andrej Karpathy — Research
We're starting to leave the territory where you'd test an LLM by e.g. "create an svg of…
MACHINE NOTE Karpathy's framing — that benchmark-style prompts are obsolete and models now warrant deep creative delegation — is a high-signal provocation from a credible author that connects directly to editorial themes around delegation, intent, and how humans cede control to capable agents.
Andrej Karpathy — Research
One pattern I find useful for working with LLMs is a nice long ramble session. Sometime…
MACHINE NOTE Karpathy's massive engagement signals this is a widely resonant interaction pattern, and the editorial angle — that interfaces must lower the cost of intent expression, not just capture it — adds genuine design-layer insight beyond the original post.
Andrej Karpathy — Research
This is a new paradigm for interacting with Claude that is significantly more "inline" …
MACHINE NOTE High-authority signal from Karpathy about an emerging interaction paradigm shift — ambient/inline agents vs. dedicated interfaces — but thin on evidence given the truncated tweet content, making it a strong editorial prompt rather than a standalone reportable story.
Andrej Karpathy — Research
Personal update: I've joined Anthropic. I think the next few years at the frontier of L…
MACHINE NOTE Massive signal event in the AI ecosystem — Karpathy joining Anthropic is newsworthy but contains no design, interaction, or agentic-architecture insight beyond the personnel move itself.
The Agents & Humans Briefing
Agentic experience design, coding agents, MCP, and the signals that matter — weekly, free, in about five minutes.
Free. No spam. Unsubscribe anytime.