Field Notes
Practical observations on building real systems. Notes from the field.
Latest notes
-
Signal is right about AI agents
At Davos this year, Signal president Meredith Whittaker told Bloomberg that AI agents are quietly making end-to-end encryption irrelevant. Her argument is shor…
Read note -
The agent is the easy part
In one week this June, Vercel and Databricks, a frontend infrastructure company and a data company with nothing obvious in common, both shipped full platforms…
Read note -
Prove what the agent did: why witnessed audit is becoming table stakes
In early June, two documents landed within five days of each other that, read together, tell you where the bar for a defensible system is moving.
Read note -
History is a launch risk now
On May 18, 2026, Starbucks Korea launched a promotion called "Tank Day." Within hours it was pulled, the head of Starbucks Korea was fired, and the parent comp…
Read note -
The Big Four sell AI governance. Their own reports cannot pass it.
In October 2025, KPMG published a report titled "Total Experience: Redefining Excellence in the Age of Agentic AI." In June 2026 it quietly pulled the report a…
Read note -
Forward-deployed engineering for the rest of us
In 2026 every serious AI company started hiring for the same job, the "forward deployed engineer," and the pay went vertical. Palantir, which invented the role…
Read note -
Slop is a deployment failure, not a model failure
On the Q1 2026 earnings call, behind 85 percent revenue growth, Palantir's CEO spent his time attacking a word: slop. His argument was that most AI being sold…
Read note -
A voice with guardrails: what I built because I think faster than I can talk
My thoughts move fast. In my head it is quick, and it runs in parallel. My wife will start a sentence and I have already finished it, run three outcomes, and m…
Read note -
The right idea in the wrong culture: what Apple's Siri detour teaches about adopting AI
At WWDC on June 8, Tim Cook used what was reported as his final keynote to introduce "Siri AI," the largest overhaul of the assistant since it launched in 2011…
Read note -
Ship fast and ship unsafe are not the same axis
Every few months the same story runs. A company ships an AI product, something goes wrong in a way that cannot be undone, data exposed, an account drained, a m…
Read note -
I am a perfectionist. I had to learn which corners to cut.
I have a perfectionism problem, and I have stopped pretending it is a strength. I will take a thing that is already good enough to ship and keep sanding it. A…
Read note -
Popularity is not a security property
In January, an open-source agent framework called OpenClaw, first released as Clawdbot in November, crossed 250,000 GitHub stars in roughly sixty days. That is…
Read note -
When the agent is in your pipeline, the text it reads is an attack surface
On June 5, Microsoft's Defender security research team published an analysis of a vulnerability in Anthropic's Claude Code GitHub Action. The short version: an…
Read note -
The cloud break-in is an identity now, not a network hole
On May 22, Palo Alto's Unit 42 published research on how nation-state actors have operationalized ROADtools, an open-source framework originally built for legi…
Read note -
Introducing Solon: a cloud security agent that runs in your account, not ours
Every serious cloud security tool works the same way: it copies your configuration up to the vendor's cloud, turns it into their own private model, and reasons…
Read note -
Rejection Is a Door, Not a Score
I once filled out thousands of job applications and heard almost nothing back. Not no. Just silence. If you have lived that, you know the quiet is the worst pa…
Read note -
Show Me Something You Made
In the first piece I told people stuck in the hiring silence to go make something. This is the other chair. When we look at a person now, here is what we actua…
Read note -
AI Is the New Lift-and-Shift
Years ago I worked the cloud lift-and-shift era from the inside. The pitch was simple and everyone believed it: move to the cloud, costs go down, agility goes…
Read note -
Your AI 10x is real, and so are the studies that say it isn't
I get something close to a 10x from AI on my own work. I also read the research, and the research says I should not.
Read note -
We fact-check our own marketing. Here is what it caught this week
The internet is filling with AI slop, and most people have the diagnosis slightly wrong. The problem is not that a machine wrote it. We use AI to write, to res…
Read note -
How to keep AI from becoming lift-and-shift
After I wrote about watching cloud lift-and-shift tank projects because the business moved fast on an operating model it refused to change, the same question c…
Read note -
How to tell a real AI partner from a script-reader
When I wrote about cloud lift-and-shift, I said the advisors who were paid to know better were running scripts: they priced the easy part, billed the hours, an…
Read note -
The AI spend control surface: a reference architecture for the invoice that can't surprise you
Two weeks ago we wrote about a single developer's coding agent that produced a $29,875 net Bedrock invoice from one session, most of it uncached tokens that sh…
Read note -
The $500M AI bill nobody can verify, and the governance gap that makes it plausible
Late last week, an AI consultant told Axios that one of their enterprise clients ran up roughly $500 million in a single month on Anthropic's Claude after neve…
Read note -
I didn't buy that a storm took down Azure. I was half right.
This morning a headline crossed my feed: a thunderstorm knocked out a Microsoft Azure region. My first reaction was skepticism. A hyperscale region is supposed…
Read note -
A year at AI speed
When I left my last security engineering role, I did not go straight back to a job. I built an intelligent multi-cloud management platform and took it through…
Read note -
Build it twice on purpose
Almost every founder I talk to lately has the same story. They had an idea, they opened one of the new AI app builders, and within a week they had something re…
Read note -
The first question after a CVE drops is "am I even running that?"
Last week a critical flaw in Ghost CMS, the publishing platform behind a lot of company blogs and newsrooms, got weaponized at scale. The bug is CVE-2026-26980…
Read note -
Your CI pipeline is an attack surface now
On May 18, an automated campaign codenamed Megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories in roughly six hours. It did not exploit a cle…
Read note -
I set out to document our systems. The docs found bugs I didn't know we had.
We run a portfolio of products. Over time, every one of them accumulates the same quiet rot: documentation that no longer matches the code, a README written si…
Read note -
Two kinds of holes: what AI-built apps actually break on after the demo
There is a moment that almost every team building with an AI assistant runs into. The first few weeks feel like magic. You describe a feature, the code appears…
Read note -
Your AI language is your AI strategy
On May 19, Standard Chartered CEO Bill Winters told an investor day audience that the bank planned to reduce roughly 7,800 corporate-functions roles by 2030, m…
Read note -
Structure, not tactics: when a second attacker proves the first one was not a fluke
Two weeks ago we wrote about how to read a new entrant into your market: not as a snapshot of its current feature set, but as a trajectory shaped by its incent…
Read note -
Budget alerts are not a control surface: AI cost as production engineering discipline
On May 14, The Register covered a story that had been bouncing around Hacker News the day before. A developer was running a local coding-agent setup (Droid tal…
Read note -
AI doxxing is a design failure, not a bug
On May 13, MIT Technology Review published Eileen Guo's piece on a quiet pattern showing up across the public chatbot frontier: people are getting WhatsApp mes…
Read note -
AI is a channel now: making the GA4 AI Assistant row useful
On May 13, Google added a row to GA4 that did not exist the week before. Sessions arriving from recognized AI assistants (ChatGPT, Gemini, Claude) now show up…
Read note -
Your cloud defaults are now the attack surface
In late April, Dark Reading covered a cloud-security incident that has stayed with us. An AWS environment was fully compromised in roughly eight minutes. No ze…
Read note -
Cloud waste hasn't moved in seven years. SMBs have nowhere to go.
The State of Cloud Waste 2026 puts the global cloud waste rate at 27 percent of cloud spend, against a global cloud bill of roughly $675 billion in 2025. Gross…
Read note -
Trajectory, not snapshot: how to read a new entrant before it eats your lunch
On May 4, Amazon launched Amazon Supply Chain Services and opened its full logistics portfolio (freight, distribution, fulfillment, parcel) to any business tha…
Read note -
AI's hidden tax: why 73% of executives are missing ROI, and how to land in the 27%
This week, Globalization Partners published its 2026 AI at Work Report, surveying 2,850 leaders across six markets. The headline: 73% of executives say at leas…
Read note -
Production-grade AI managers, not research experiments
In mid-April, a San Francisco lab called Andon Labs handed an AI agent the keys to a real café in Stockholm. The agent, named Mona, was put in charge of hiring…
Read note -
Field Note: How a tiny team runs a five-business fleet
I run Social Dolphin Services. Under it sits a fleet: a homeschool platform (Ownivo), a kids enrichment platform (30aKidz and 30aTeenz), the firm's own web app…
Read note
No field notes tagged that topic yet. Pick another, or clear the filter to see everything.