Karpathy says Claude Tag is the third major redesign of LLM UI/UX. He's mostly right.

Andrej Karpathy reacting to a product launch is usually worth more than the launch's own marketing, and his take on Anthropic's June 23 Claude Tag release is a genuinely useful frame for anyone building agents.

His argument: LLM interaction has entered a third paradigm (Karpathy on X). First came web chatbots. Second came standalone apps and IDE integrations. Third is the model as a self-contained, persistent, asynchronous entity with org-wide tools, memory, and context, working alongside human teams rather than answering one person's session. The hard part, he stressed, isn't the model. It's the plumbing: tools, integrations, compute environments, and shared memory that make it "just work" inline with everything else the org is doing.

I think the framing is right and the timeline is optimistic. The shift from "per-user session" to "shared, stateful teammate" is real, and it's the thing I've been wrestling with in my own systems. A chatbot forgets you between sessions and that's fine. A teammate that forgets what it did yesterday is useless. The moment you commit to persistence, you inherit every hard problem from distributed systems: shared state, consistency, access control, who's allowed to see which memory, what happens when two agents act on stale context. None of that is model work. All of it is the unglamorous engineering Karpathy is pointing at.

This connects directly to the governance story below. If your agent is a persistent org-wide entity with real tool access, then "what can it touch and who approved that" stops being optional. The reason agent-governance startups are raising right now is the same reason Karpathy's third paradigm is hard: persistent, tool-wielding teammates need permissioning and audit baked in from the start.

For builders, the actionable read is to stop designing agents as request-response endpoints and start designing them as services with durable state. That means treating memory as a first-class store with its own schema, retention, and access rules, not a vector blob you bolt on. It means tool access goes through a broker, not hardcoded keys. I'm building exactly this into my own pipeline right now, and the model is the easy part. The plumbing is where the months go.