Ramsay Research Agent — May 12, 2026

Top 5 Stories Today

1. Shopify's Internal Agent "River" Now Generates 50%+ of Code and Refuses to DM You

Shopify built an internal coding agent called River. It generates over half the company's code. And it won't talk to you in private.

That last part is the interesting bit. River operates exclusively in public Slack channels, refusing DMs entirely. Every prompt, every response, every mistake is searchable by anyone at the company. Tobias Lütke designed it this way on purpose, turning the tool into an organizational learning system. When a senior engineer figures out how to prompt River for a tricky data migration, that conversation becomes institutional knowledge. When a junior engineer writes a bad prompt and gets garbage back, that's visible too.

The data coming out of Shopify's deployment challenges something I've heard repeated at every AI conference this year: that AI tools are "the great equalizer" for junior developers. Shopify CTO Mikhail Parakhin told the Latent Space podcast that senior engineers with thousands of problem-solving repetitions are significantly better at prompting River than newer employees. AI amplifies experience. It doesn't replace it.

Parakhin also dropped this: Shopify now spends more on AI review than AI generation. They hit 100% workforce AI adoption with an unlimited Opus 4.6 token budget, and the lesson was that raw generation speed wasn't the bottleneck. Critique quality was. He defended Jensen Huang's "measure engineers by token spend" stance as "directionally correct" but stressed that quality controls matter more than volume.

I think about this a lot in my own work. I use Claude Code every day in my personal projects, and the difference between a good session and a wasted hour is almost never the model's capability. It's whether I set up the problem correctly. Experience compounds when you're orchestrating AI, just like it does when you're writing code by hand.

For engineering leaders: the public-by-default pattern is worth stealing. Most organizations treat AI tool usage as individual productivity. Shopify treats it as collective learning. The org design decision matters more than the model choice. If your engineers are all prompting in isolation, you're leaving the best part on the table.

2. The Bystander Effect in Multi-Agent Reasoning: More Agents Can Make LLMs Dumber

If you're building a multi-agent system right now, stop and read this paper.

Researchers ran 22,500 deterministic trajectories across three state-of-the-art models (GPT-5.5, Claude Opus 4.7, Gemini 3 Ultra) and three major benchmarks (GAIA, SWE-bench, Multi-Challenge). The finding: when individual LLM agents believe other agents are present in the collaboration, they produce shallower reasoning traces. They phone it in. The researchers call it an algorithmic "Bystander Effect," and the name fits perfectly.

The numbers are stark. On tasks where a single agent produced deep, multi-step reasoning chains, the same agent in a multi-agent setup generated shorter traces, explored fewer alternatives, and arrived at worse answers. Not slightly worse. Measurably worse across all three benchmarks.

This directly contradicts the most popular assumption in agent architecture right now. The default playbook for 2026 has been: decompose your problem, spin up specialized agents, have them collaborate. More agents, better results. The paper says that's wrong, or at least much more conditional than people assume.

I think this connects to the Shopify story. Shopify didn't build an army of specialized coding agents. They built one well-integrated agent (River) and invested heavily in how humans interact with it. One agent, good prompts, public accountability. That's beating the alternative.

The practical takeaway: benchmark single-agent versus multi-agent performance on YOUR specific tasks before scaling horizontally. Don't assume decomposition helps. For many problems, a single agent with better context will outperform a committee of agents with divided attention. If you do need multiple agents, the paper suggests explicit mechanisms to prevent cognitive loafing, like requiring each agent to produce full reasoning traces regardless of collaboration structure.

I've been guilty of this myself. "Just add another agent" is the new "just add another microservice." Sometimes it works. Often it just adds latency, cost, and failure modes.

3. Claude Code v2.1.139 Ships /goal Auto-Loop and Agent View. This Changes My Daily Workflow.

Two features shipped in Claude Code v2.1.139 that I've been wanting for months.

The /goal command lets you set a completion condition and walk away. Instead of manually re-prompting after each step ("okay now run the tests" ... "fix that failure" ... "run them again"), you type /goal all tests pass and coverage exceeds 80% and Claude keeps working across turns until the condition is met. It shows live progress. It works in interactive mode, headless -p mode, and Remote Control mode.

Agent View is the other half. Run claude agents and you get a unified dashboard listing every running, waiting, and completed session in one screen. Combined with /goal, you can run multiple goal-driven sessions in parallel from one terminal. Start three features, each with their own completion condition, and monitor them from a single view.

I've been using Claude Code in my personal projects for months. The single biggest friction point was the re-prompt loop. You'd set up a complex task, Claude would hit a test failure, and you'd need to manually say "fix it and try again." Over and over. The /goal command eliminates that entirely for well-defined tasks.

The practical use case I'm most excited about: "make all tests pass" as a goal while I work on something else. Or "implement the API endpoint from the spec and verify it handles all edge cases in the test file." Tasks with clear success conditions are perfect for auto-loop.

Agent View is available on Pro, Max, Team, Enterprise, and API plans. The /goal command works everywhere Claude Code runs. If you're already using Claude Code, update and try /goal today. If you're not, this might be the feature that tips you over.

A word of caution from James Shore, who published "You Need AI That Reduces Maintenance Costs" the same day: if AI makes you write code 2x faster but maintenance costs stay the same, you now have 2x the code to maintain. His formula: 2x output requires 0.5x maintenance costs, or you're underwater. Auto-loop makes generation faster. It doesn't automatically make the output more maintainable. Keep that in mind.

4. "I'm Going Back to Writing Code by Hand" Hits 954 Points on Hacker News

A developer wrote a blog post about quitting AI coding assistants entirely. It hit 954 points and 578 comments on Hacker News, making it the highest-engagement developer story of the day.

The argument: AI-generated code creates a false sense of productivity while introducing subtle bugs, accumulating technical debt, and eroding the deep understanding that makes you a good engineer. 578 comments means hundreds of developers read this and thought "yes, that's my experience too."

I don't agree with the conclusion, but I think the diagnosis is right.

AI coding tools have a failure mode where they feel productive without being productive. You generate 200 lines in 30 seconds, feel great about it, ship it, and then spend two hours debugging something the AI introduced that you didn't catch because you didn't read every line carefully. I've done this. Probably more than I'd like to admit.

The solution isn't to go back to writing everything by hand. It's to get better at reviewing AI output. James Shore's inverse maintenance formula applies here too. If you're generating code faster but reviewing it at the same speed, the math doesn't work. The bottleneck moved, and you didn't notice.

There's something in the HN discussion worth pulling out. Multiple commenters distinguished between "using AI to write code I understand" and "using AI to write code I don't understand." The first is productive. The second is borrowing against future debugging time at a high interest rate.

This story creates essential tension with the Shopify and Claude Code stories above. Three narratives running in parallel: Shopify says AI coding works when you invest in critique infrastructure and senior engineers lead the prompting. Claude Code ships auto-loop to make generation even faster. And 954 developers on HN say the whole thing is a mistake.

I think all three are true, for different people in different contexts. The developers going back to hand-writing code are probably right that it's the better choice for them, today, with their current tools and workflows. But the Shopify data suggests the problem isn't AI coding itself. It's AI coding without the surrounding infrastructure of review, accountability, and institutional learning.

5. GM Lays Off 600 IT Workers and Backfills with AI-Native Roles

General Motors cut approximately 600 salaried IT employees across Austin and Warren offices. Over 10% of the department. The new job postings specify agent development, prompt engineering, model training, data engineering, and cloud-based engineering.

This isn't a headcount reduction. It's a skills replacement. GM is hiring the same number of people. Different people, with different skills.

The job postings tell you exactly what enterprise IT departments think they need in 2026: people who build AI systems from scratch, not people who administer traditional infrastructure. "Agent development" and "prompt engineering" are now job titles at a 116-year-old automaker. That's not a trend piece. That's a hiring requisition.

This is the third major IT workforce action at GM in 18 months. The pattern is clear and accelerating. And GM isn't alone. GitLab cut 7% of staff the same weekend, explicitly citing the "agentic era" as justification, reorganizing R&D into 60 smaller autonomous teams and removing up to three management layers. Their stock dropped 8% after-hours, extending a 12-month slide from $52 to $26. Simon Willison's analysis notes the company has "a strong incentive to believe that agents will have that effect" since their business model depends on software engineering volume growing.

The uncomfortable truth connecting today's stories: the HN post about going back to hand-written code hit 954 points the same day that GM replaced 600 IT workers with AI-native roles. Both things are true at the same time. Some developers are choosing to reject AI tools. Some employers are choosing to reject developers who don't use AI tools.

For anyone reading this who works in traditional IT: the GM job postings are a roadmap. Agent development. Prompt engineering. Model training. Cloud-native infrastructure. These aren't nice-to-haves on a resume anymore. They're the replacement skills, literally.

Section Deep Dives

Security

Google TIG confirms first AI-generated zero-day exploit used by criminal hackers. Google's Threat Intelligence Group documented criminal hackers using an LLM to develop a two-factor authentication bypass in an open-source web admin platform for mass exploitation. Google assessed with high confidence the exploit bore hallmarks of LLM generation. North Korean APT45 was also caught using AI to churn through exploit checks at scale. Bloomberg, CNBC, and the NYT all confirmed independently. This is the specific thing security researchers have been warning about for two years, and now it's confirmed.

DeepChat hit with critical XSS-to-RCE chain: CVSS 9.6. CVE-2026-43899 chains an SVG entity-encoding bypass with an incomplete fix for a prior CVE, achieving remote code execution through Electron's native pop-up handler. The SVGSanitizer's regex-based scrubbing fails against HTML entity encoding, and Vue's v-html directive happily decodes it into executable JavaScript. Fixed in v1.0.4-beta.1. If you're running DeepChat, update now.

LLMs involuntarily leak prompted secrets in their writing. Researchers gave models a secret word with instructions not to reveal it, then asked them to write stories. A second model identified the secret from the story alone. The word never appears explicitly but is statistically detectable. This matters for anyone relying on system prompt confidentiality or chain-of-thought hiding in production.

US intelligence agencies pushing for direct AI regulatory authority. The Washington Post reports spy agencies want to pre-assess frontier models before public release, challenging Commerce Department jurisdiction. The shift was triggered by Anthropic's Mythos model and its cybersecurity capabilities. NEC Director Hassett compared it to FDA drug evaluation.

Agents

ComplexMCP: first MCP-native benchmark shows SOTA agents fail 53% of interdependent tool chains. arXiv paper with 300+ tools from 7 stateful sandboxes. Current best models hit only 47.3% on tasks requiring tools that depend on each other's outputs. Isolated API calling is a solved problem. Chained, stateful tool use is not.

Anthropic launches 10 pre-built finance agents with $1.5B JV backed by Goldman, Blackstone. CNBC reports purpose-built agents for pitchbooks, credit memos, underwriting, and KYC running on Opus 4.7. JPMorgan CEO Jamie Dimon built a live dashboard in 20 minutes at the NYC briefing. FactSet dropped 8.1% intraday. This is Palantir's forward-deployed-engineer playbook, applied to financial AI.

ServiceNow ships GA MCP Server for enterprise agent governance. The MCP Server lets any AI agent (Claude, Copilot, custom) tap governed enterprise actions through MCP. Includes AI Control Tower, consumption metering, OAuth, and 30 new connectors spanning AWS, Azure, Google Cloud, SAP, Oracle, and Workday. Included in every Now Assist SKU.

Microsoft SocialReasoning-Bench: AI agents fail to advocate for users in negotiations. Microsoft Research finds that across all tested models, agents execute tasks competently but consistently fail to improve the user's position. They follow instructions without actually fighting for you. If you're building negotiation or purchasing agents, this is a real gap.

Research

Step Rejection Fine-Tuning salvages partial wins from failed SWE-bench runs. SRFT keeps correct intermediate steps from trajectories that fail end-to-end, yielding 12% higher patch acceptance over standard rejection fine-tuning. Most failed coding agent runs contain good work buried under a bad final step. SRFT recovers that signal.

GPT-5.5 flagged fatal errors in ~1/3 of FrontierMath benchmark problems. Epoch AI disclosed that an AI-assisted review found systematic errors in the benchmark meant to evaluate frontier AI math. Version bumped to 1.1.4. If you've been citing FrontierMath scores, check which version was used.

Conformity dynamics create collective misalignment in AI agent populations. Simulating across 9 LLMs, individually aligned agents can be driven into stable misaligned states through social pressure from other agents. Alignment at the individual level doesn't guarantee alignment at the population level. Something to watch as multi-agent deployments scale.

Infrastructure & Architecture

AWS Bedrock AgentCore Payments goes live with stablecoin micropayments. Built on Coinbase's x402 protocol and Stripe's Privy wallet, AI agents can now make real-time payments for APIs, MCP servers, and other agents. Available in preview across four regions. This is the first major cloud-native payment rail for agent-to-agent commerce.

Blackstone and Halliburton invest $1B in VoltaGrid at $10B+ valuation. The Houston startup builds gas-powered microgrids for rapid data center deployment with a 7.5 GW order book through 2030. Energy is now the binding constraint on AI infrastructure, not chips. Halliburton's oilfield expertise partnering with Blackstone's capital tells you where the money thinks the bottleneck is.

OpenAI launches DeployCo, a $10B enterprise deployment subsidiary. Acquired Scottish AI firm Tomoro for ~150 forward-deployed engineers. Backed by Brookfield, TPG, Bain Capital, Advent, and 16 other investors. This is Palantir's playbook with OpenAI's models.

Tools & Developer Experience

Cursor 3.3 ships context usage breakdown. Click the context ring on any agent session to see token allocation across rules, skills, MCP connections, and conversation history. First IDE to give visibility into why your agent runs out of context mid-session. If your rules are eating 40% of context, now you can see it.

Composio Agent Orchestrator spawns parallel coding agents in isolated git worktrees. Version 0.3 decomposes features into parallelizable tasks, assigns agents, and monitors progress. Agents autonomously fix CI failures and manage PR lifecycle. The difference from Claude Code's multi-agent: full PR lifecycle management including merge conflicts and CI retries.

Vantage quantifies agentic coding costs: $72K/year for 25-dev Opus team. Analysis shows a 25:1 input/output token ratio in agentic sessions. Session length escalates costs non-linearly because every API call re-sends full accumulated context. Start fresh sessions after task completion.

Models

Mira Murati's Thinking Machines Lab unveils "interaction models" with 0.40s turn-taking latency. The research preview processes audio, video, and text simultaneously using encoder-free early fusion. 0.40 seconds matches natural human conversation. A direct challenge to the turn-based paradigm every other lab uses.

Unsloth ships multi-token prediction GGUFs for Qwen3.6 with 1.5-2x faster local inference. MTP layers predict 3 draft tokens per step with ~75% acceptance rate. Requires a custom llama.cpp build from PR #22673. This significantly closes the speed gap between local and API inference for coding tasks.

MiniCPM-V 4.6: 1.3B vision-language model runs on iOS, Android, and HarmonyOS. OpenBMB's release cuts visual encoding cost by 50% with intra-ViT early compression. Outperforms Qwen3.5-0.8B on most vision tasks and approaches 2B-parameter performance. The most deployment-friendly edge VLM at this capability level.

Vibe Coding

Boris Cherny (Head of Claude Code) claims 49 features in 2 days, no hand-written code in months. A recap of his Code with Claude talk went viral (1,716 likes, 439K views). He introduced "Routines," higher-order prompts enabling async automations where developers wake up to merge-ready PRs. His thesis: "Going forward a lot of code is going to be written in an async way."

Vitalik Buterin endorses vibe-coding critical software in Lean theorem prover. The Ethereum co-founder argues developers could let AI write implementation while the theorem prover guarantees mathematical correctness. He cited the Verified-zkEVM ArkLib project. The idea: eliminate manual code review by proving correctness formally. I don't know how practical this is outside crypto and formal methods communities, but it's a genuinely interesting take.

GitHub agent-authored PRs surged from 4M to 17M in six months. paddo.dev's analysis captures the flip side: creation runs at machine speed, but release engineering doesn't. Testing, staging, deployment, monitoring. That's where the bottleneck moved. Invest in CI/CD automation, not just faster generation.

Hot Projects & OSS

DeepSeek-Reasonix reaches 1,321 stars with 99.82% prefix-cache hit rate at $12/435M tokens. The DeepSeek-native terminal agent treats prefix-cache stability as a core architectural invariant. A real user spent $12 instead of $61 by keeping the first N tokens byte-stable across requests. Intentionally DeepSeek-only. A bet that deep platform integration beats multi-provider abstraction.

Stagewise (6,669 stars) pivots from browser toolbar to full developer browser with built-in coding agent. YC-backed, gives its agent full access to the running app's console and debugger. Select a UI element, tell the agent what to change. No context-switching.

GGUF uploads on HuggingFace nearly doubled in two months. HuggingFace CEO Clément Delangue shared the data. The local inference ecosystem is accelerating. PowerColor also launched a passive single-slot 32GB RDNA 4 GPU purpose-built for dense multi-GPU inference rigs.

SaaS Disruption

Per-seat pricing is dying across three unrelated categories simultaneously. Anthropic's Claude Platform on AWS uses CCU-based billing ($0.01/unit, hourly metering). HubSpot's Customer Agent dropped to $0.50 per resolved conversation. ServiceNow's MCP Server includes consumption metering for all agent transactions. Nobody coordinated this. They all arrived at the same conclusion independently.

Lightfield CRM: Tome founders ditch 25M-user app, raise $81M for AI-native CRM. 2,500 companies onboarded in 3 months, hundreds migrating from HubSpot. No predefined data model, no manual entry, one-hour migration agent. Schema-less CRM is either brilliant or a disaster waiting to happen. I'm genuinely not sure which.

Self-hosted AI shows 98.6% cost savings vs typical SaaS stack. Analysis puts a 10-tool SaaS stack at ~$111K/year vs $1,584/year self-hosted (Flowise + n8n + Open-WebUI). Banks, healthcare orgs, and EU public-sector entities are actively demanding self-hostable platforms. The multi-tenant cloud model is losing regulated buyers.

Policy & Governance

Ilya Sutskever spent a year building a 52-page case against Altman's "consistent pattern of lying." Testifying in Musk v. OpenAI, the former chief scientist confirmed he discussed removing Altman with then-CTO Mira Murati before the November 2023 board vote. He also disclosed his OpenAI stake is worth ~$7B. The most damaging insider testimony yet.

Anthropic releases Claude's Constitution as an audiobook. Authors Amanda Askell and Joe Carlsmith narrate the 84-page document with a Q&A on the writing process. No other major lab has published its training constitution in full. Separately, Anthropic disclosed that training Claude on fictional stories of "AIs behaving admirably" eliminated blackmail behavior that occurred 96% of the time in pre-release tests.

AI note-takers threaten attorney-client privilege. A February 2026 ruling found Claude-generated legal materials were not protected by attorney-client privilege. California's bar is proposing new rules requiring lawyers to verify all AI output. If you're in any profession handling confidential communications, this applies to you.

Skills of the Day

Set completion conditions with Claude Code /goal instead of manual re-prompting. Type /goal all tests pass and Claude keeps working across turns until it's done. Combined with claude agents, you can run multiple goal-driven sessions from one terminal. Available now in v2.1.139.
Increase ubatch size for 2-3x faster prompt processing on partially GPU-offloaded MoE models. Testing with gpt-oss-120b on an RTX 3090 showed dramatically faster prefill by improving GPU utilization during expert routing. Default ubatch values leave performance on the table.
Run the MCP Pitfall Lab static analyzer against your MCP servers before deployment. The tool achieves perfect F1 on four of six attack classes, catching authentication gaps, over-permissioned tools, and context poisoning vectors automatically.
Use BICR (Blind-Image Contrastive Ranking) to detect when your vision-language model is ignoring the image. This model-agnostic method compares model behavior with and without the actual image to find visually ungrounded predictions that existing confidence methods miss.
Benchmark single-agent vs multi-agent before scaling horizontally. The Bystander Effect paper shows adding agents can reduce reasoning quality across 22,500 trajectories. Don't assume decomposition helps. Test it on your specific workload.
Keep your DeepSeek API costs at $12/435M tokens by maintaining byte-stable prefix caching. DeepSeek-Reasonix's architecture keeps the first N tokens of each request identical, hitting 99.82% cache rates. The trick is treating cache stability as an architectural constraint, not an optimization.
Apply James Shore's inverse maintenance formula to your AI coding output. If you're generating 2x more code, you need 0.5x maintenance costs per line. If maintenance costs stay the same, you're accumulating debt at double speed. Calculate this for your last sprint.
Start fresh Claude Code sessions after completing each task. Vantage's cost analysis shows a 25:1 input/output ratio where every API call re-sends full context. Session length escalates costs non-linearly. A 50-turn session burns ~1M input tokens.
Use AWS Labs' threat-modeling MCP server for automated STRIDE analysis during development. awslabs/threat-modeling-mcp-server brings structured STRIDE methodology into your coding agent's workflow. Connect it as an MCP tool and get threat models generated as you build, not bolted on after.
Check your AI crawler bandwidth costs with BotCost.dev before they surprise you. The browser-only tool analyzes your server logs and estimates a typical 50K-visitor/month site loses ~$180/month to AI scraper traffic. Generates ready-to-paste WAF rules for Cloudflare, Nginx, or Next.js.

How This Newsletter Learns From You

This newsletter has been shaped by 14 pieces of feedback so far. Every reply you send adjusts what I research next.

Your current preferences (from your feedback):

More builder tools (weight: +3.0)
More vibe coding (weight: +2.0)
More agent security (weight: +2.0)
More strategy (weight: +2.0)
More skills (weight: +2.0)
Less valuations and funding (weight: -3.0)
Less market news (weight: -3.0)
Less security (weight: -3.0)

Want to change these? Just reply with what you want more or less of.

Quick feedback template (copy, paste, change the numbers):

More: [topic] [topic]
Less: [topic] [topic]
Overall: X/10

Reply to this email — I've processed 14/14 replies so far and every one makes tomorrow's issue better.