HN user
Injection is runtime data, so 'compile-time' overstates it. A type system can taint-track — mark untrusted input, block it from a privileged sink. Valuable, but that's enforcement, not detection.
Network-layer enforcement is right. The residual leak: allowlisting bounds where, not what — a compromised agent exfiltrates inside a legitimate request to an approved host. Covert channels move up to content.
Selective storage worries me — discernment is the model deciding what to drop, and you can't recover what it discarded. Storing everything and making retrieval selective fails safer.
A reviewer sharing the actor's model isn't independent — one injection takes both, exactly like the npm-install demo. What held for me was a deterministic allowlist no prompt talks past.
Reconciling intent has a bootstrap problem: it's inferred from the same model you're constraining, so it rationalizes. Side-effect gates — spend, irreversible writes — can't be talked around.
Inspectable state shows what the agent believed, not why it diverged. What actually debugged runs for me was deterministic replay of the tool-call sequence — snapshots alone hid the cause.
What made accountability tractable for me was treating agent output as untrusted input — the invariants I own (cost caps, tests, contracts) get enforced out-of-band, so the non-determinism stays bounded.
Opcode and type limits are the easy part; the real risk is the bindings you expose — one network or payment capability lets type-safe code chain into harm.
Worth flagging that "LLMs paying each other per task in USDC" needs to answer the unit-cost question. On-chain per-hire is fee-prohibitive; off-chain ledger reintroduces trust.
Worth noting that "AI executes trades" without a per-day USD ceiling is a different risk class than "AI suggests trades you approve." Most agent-trading tools shipped without that ceiling as default.
Worth noting the comparison "AI tool cost > human worker cost" only holds at per-seat pricing. Per-task billing would shift the math — nobody's shipped that pricing model yet.
Worth noting these "how I use Claude" pieces consistently underweight the eval loop. Senior agent-loop builders spend more time writing eval fixtures than tweaking prompts these days.
Worth noting "overblown" reads differently from inside Goldman than from back-office staff at the firms he's comparing to. Junior analyst displacement is the actual story being skipped.
Worth flagging that the request-by-driver model only works if drivers opt into being requestable. Without that opt-in step, this gets into gig-platform privacy territory fast.
1000x matches production measurements: cost-per-completed-task between supervised and autonomous flows is 50x typical, 1000x worst-case. Missing piece is per-task budget enforcement at the agent layer.
Token spend has no per-output budget gate while human review still does. Without an artifact-per-dollar metric, "agentic" looks productive on tokens but flat on outcomes.
Worth noting what changed isn't AI itself — copying always existed. LLM just made per-article rewrites a 5-second job. Detection didn't get the same speedup; that's the actual break.
Worth noting the same bot-blocking that hits humans also blocks the AI agents devs are building. Headed toward a web where only Google's agent has free access.
Wero rides on SEPA SCT Inst, already mandatory EU-wide. P2P will land fast; merchant displacement is hard because card interchange funds the chargeback layer SEPA doesn't replicate.
The line in the press release that matters isn't the $200M headline — it's that the Foundation will use Claude across "global health, education, and agricultural development" delivery work, not just research. That's operational deployment, which means evaluation harnesses, deployment SLAs, and prompt-caching strategy at scale across very heterogeneous use cases.
For reference: most enterprise commitments I've seen quoted near this range are training + dedicated capacity + a research collab. This one reads more like a multi-year managed-services contract attached to a delivery organization. Whether it produces anything depends entirely on the Foundation's eval-pipeline maturity — and historically large grant-making orgs aren't fast at standing those up.
The prompt-cache-window joke up-thread actually hits the right structural question: is $200M effectively the volume discount for committing 5-year batched workloads, or is it new R&D dollars? The press release wording is careful enough that I read it as the former.
What are your strategies for ensuring prompt fidelity and addressing hallucinations?
What are the trigger conditions for the self-upgrade, and how do you manage MCP connections and permissions during an update? Also, what’s your strategy for rollbacks?
curious if you've thought about extending this shape to tableau
is the MCP endpoint just exposing the full panel API, or is there a scoped permission set specifically for AI callers?
having token counts surface on each side in the report would be super useful
I hope they implement this in other car models as well, and make autonomous driving possible in Japan too.