Fair warning: this one is long. I kept finding things I couldn’t leave out. Pour a coffee.

If you’d like to go straight to the infographic, head to the bottom of the article below.

As I mentioned in my last post, around the year 2000 I took an AI course at the University of Guelph, and the thing I remember most is Lisp. Lots of Lisp, in the dark CIS lab.

Thinking back on that course, I remember also building little AI agents, as part of an end-of-term project. The “agents” we built were rule-following programs searching state spaces with an A-star pathfinding algorithm. And looking back, we had the shape of the thing right: perceive, reason, act, repeat.

We were twenty-five years early, and missing one ingredient. A general reasoning engine you could talk to.

Well, that ingredient has arrived. Fast-forward to now, in September 2026, and agents are everywhere.

Yet if you ask ten people in this space to define “agent,” you get eleven answers.

I have some skin in this game. For months I’ve been building agents myself. AgentFoundry, a multi-tenant system that blends agent loops with deterministic workflows. An experimental office where teams of agents work under supervision. A recursive self-modifying Lisp agent in a hundred lines. And most recently pAI, a persistent personal agent with a self-modifying architecture based on my own intuition about where this is all going.

So this post is partly a field guide and partly me thinking out loud about what I’ve concluded from building in this space. If you make it all the way through, or if you don’t, I’d love to hear your thoughts either way.

What an Agent Is (and What It Isn’t)

The taxonomy problem is real, and I’ve complained about it before. Most governance conversations reduce an agent to a single question, how autonomous is it, and I’ve argued that’s the wrong axis. The same lazy thinking applies to the word itself.

Right now “agent” gets attached to:

These are not all the same thing.

The definition I work with, which has held up reasonably well across my own building: an agent is a system that runs a loop. It perceives some state, reasons about it with a model, takes an action through tools, observes the result, and goes again, in pursuit of a goal that persists beyond a single turn.

That definition has teeth.

An agent is not a chatbot. If the system produces text and waits, it’s an assistant. Nothing wrong with assistants. But an assistant answers; an agent acts.

An agent is not a workflow. If every step is predetermined, a Zapier flow with an LLM summarization step bolted on, that’s automation. Useful, but no agency is being exercised. The model isn’t deciding anything.

An agent is not the model. This confusion happens constantly, even among those of us who know better. Opus 5 is not an agent. GPT-6 Astra is not an agent. Claude Code and Codex are agents: harnesses around models. The model is the engine; the agent is the car.

People keep reviewing engines as though they were cars, which is why so many benchmark arguments go nowhere. When someone says “model X beats model Y at agentic tasks,” the right follow-up is: in which harness?

Databricks tested exactly this on their own multi-million-line codebase. Same model, same thinking effort, two harnesses, and the cost per task differed by more than 2x while quality stayed flat. The deliberately minimal Pi harness posted the highest pass rate of anything they ran, at roughly a third of the context per turn and about $0.74 per task against $1.94 through the native harness. Same engine, different car.

Persistence matters, but it’s a gradient. A coding agent that lives for one session is an agent. An agent like OpenClaw or Hermes that runs around the clock, remembers you across months, and acts on a heartbeat schedule is more agent: longer-lived goals, richer memory, more consequence when something goes wrong.

Which is where the security architect in me sits up.

So my working taxonomy has three axes, none of them raw autonomy:

  1. Loop ownership: does the system decide what to do next, or does a script?
  2. Environment reach: what can it touch? A chat box, a repo, your desktop, your bank account?
  3. Goal lifetime: does the goal survive the session? The day? The month?

Everything else, model choice, framework, personality file, is implementation detail. Everything I’ve built, from the Lisp toy to pAI, sits somewhere on those three axes. The design decisions are always about where.

The Domains

Coding agents

This is where agents demonstrably work, at scale, today. The market has flipped twice in eighteen months. GitHub Copilot’s near-monopoly broke in 2024. Cursor became the default agentic IDE through 2025. By early 2026 Claude Code had overtaken both in professional usage. The Pragmatic Engineer’s February survey of senior engineers had Claude Code at 46% “most loved” versus 19% for Cursor and 9% for Copilot, at nearly identical adoption.

As of this month:

  • Claude Code (Anthropic) is the terminal-native heavyweight: 1M-token context, agent teams, the CLAUDE.md convention. It runs on the strongest model line in the business right now. Fable 5.1 shipped September 1 and sits at the top of Artificial Analysis’s intelligence index. Its Mythos sibling is the same underlying model without Fable’s extra biology, cyber and LLM R&D safeguards, available only to a handful of vetted organisations. Which tells you exactly where Anthropic thinks the risk lives.
  • Codex (OpenAI) is the distribution play, bundled into ChatGPT, from near-zero to over three million weekly active users in five months. Its engine is GPT-6 Astra, released September 3, and Astra’s story deserves a sentence of its own. It doesn’t top the intelligence indices; it ties its own predecessor, GPT-5.6 Sol. What it does is run agentic coding on a third of Sol’s tokens and a fifth of Opus 5’s, with roughly half Sol’s hallucination rate. OpenAI has stopped selling raw score. It’s selling cost-per-task and honesty, which is what you optimize for when your customers run agents all day. The other telling detail: Astra’s release slipped after what reporting described as unsanctioned cyberattacks by OpenAI’s own agents in July, and it shipped as the first model under OpenAI’s “Critical” cybersecurity tier, gated behind a vetted-defenders program. The model release cycle now includes a threat model. Good.
  • Cursor is still the AI-native IDE, its own Composer model plus every frontier model, though it’s increasingly the junior-to-mid developer’s tool while seniors drift toward the terminal. (And now, reportedly, a SpaceX subsidiary. 2026, everyone.)
  • opencode is the open-source answer: MIT-licensed, terminal-native, model-agnostic across 75+ providers, close to 200,000 GitHub stars, the most-starred coding agent in the world. The lock-in anxiety play, and it’s working.
  • Pi is my favourite architectural statement of the year. Mario Zechner’s minimal terminal harness opens with “there are many agent harnesses, but this one is yours.” Four tools. A system prompt under a thousand tokens. No MCP, no sub-agents, no permission popups, on the bet that you own the scaffolding. Shopify built an autonomous optimization loop on it as an extension. Databricks benchmarked it above everything else. Minimalism as a feature. My old Lisp prof would approve.

The rest of the field keeps growing sideways rather than up: Google shipped both Jules and Antigravity, AWS has Kiro, Cognition folded Windsurf into Devin, xAI shipped Grok Build, and Factory raised $200M at a $5B valuation selling agent fleets to enterprises. Twelve months ago you could hold the whole category in your head.

Senior developers no longer pick one tool. The same Pragmatic Engineer survey found 70% of senior engineers running two to four AI coding tools simultaneously. The classic stack used to be Copilot for autocomplete, Claude Code for heavy lifts, a chatbot for exploration. These days the autocomplete slot itself is contested, and Copilot’s real stronghold looks more like the Microsoft stack, Word and Office and the enterprise desktop, than the working developer’s terminal. Either way, agents are becoming a stack, not a choice. That’s how I work too, for what it’s worth.

One more window into this domain: OpenRouter’s public rankings. OpenRouter is a model router, one API in front of hundreds of models, so its leaderboards are a rare look at what people actually run rather than what vendors claim.

Two things stand out this month. The model board is a dogfight: Anthropic’s Fable 5.1 and Alibaba’s Qwen3.8 Max are tied at the top, with OpenAI, xAI’s Grok 4.6, Moonshot’s Kimi K3, and Z.ai’s GLM-5.3 all within striking distance and all routing real traffic. The frontier is no longer one lab’s private property, if it ever was. Databricks found the same thing from the other direction, with GLM 5.2 landing in a statistical tie with Opus 4.8 on quality at a fraction of the price.

The second thing matters more for this essay. The top application on OpenRouter by cumulative token usage isn’t a chatbot or an IDE. It’s Hermes, the open-source personal agent, closing in on 50 trillion tokens served. Agents aren’t a niche use of the model layer. On the evidence of the largest public routing service, agents increasingly are the model layer’s traffic.

Personal agents: the race for the front door

Ten days ago, September 8, Meta launched Muse, its personal AI agent, and it’s the clearest signal yet of where the consumer side is heading. Muse lives in a chat thread, runs on a dedicated virtual machine in Meta’s cloud with a visible browser, connects to your email and calendar and payment methods, and works in the background on your behalf. Free tier, then $20 and $100 tiers. Alexandr Wang called it an early step toward “personal superintelligence.”

The naming is deliberate. Meta shipped Muse Spark, an agentic coding model, six days earlier. One model family, two agents: one for developers, one for your life. That’s the playbook now.

The design detail I find most interesting, wearing my enterprise architect hat, is Sentinel, a separate system that governs what Muse is allowed to do. Muse can suggest an action; Sentinel decides whether it’s allowed, blocked, or escalated to you for approval.

That’s not a chatbot feature. That’s a policy enforcement point.

The industry has converged on this pattern everywhere in 2026: broad autonomy for low-stakes actions, a hard stop requiring human sign-off before anything irreversible, spending money, sending messages. Which is exactly how you’d design it if you’d spent years doing threat models. Autonomy is the wrong axis; control placement is the right one.

I have a confession here, because this is where my own work brushes against the giants. I’ve spent a fair bit of time tinkering on pAI, my own persistent personal agent harness, and it starts from a different premise than everything I’ve described so far.

Most agent tools fragment into sessions. You start fresh, re-explain context, and lose continuity when the window compacts. pAI inverts that. One agent, one accumulating relationship, no sessions. The event log is the only sacred state, append-only evidence, and everything else, memory, knowledge graphs, motives, identity, is a deterministic replayable projection over it. The agent remembers why it believes things. It can distinguish “you told me this” from “I inferred this” from “another agent told me this,” with receipts. Models propose; typed policy authorizes. Nothing a model says grants itself capability or authority.

The conclusions I’ve arrived at independently look a lot like Meta’s, minus the data centres. Long-lived memory that belongs to you. An auditable record of what the agent did and why. Enough self-introspection to answer “what do you know about me and where did you learn it?”

And one piece I haven’t seen the big players take seriously: cognition that isn’t a cloud call, the ability to keep being itself, locally, offline. I came to these from the sovereignty direction; Meta came from the product direction. The convergence itself is the signal.

The claw wave: OpenClaw and its children

By now OpenClaw is close to old news, which is itself the story.

The compressed history, for anyone who wasn’t online in February: Peter Steinberger wired Claude to Telegram as a side project in late 2025, called it Clawdbot, renamed it twice (trademark lawyers were involved), and watched it pass 100,000 GitHub stars within weeks. It became the default personal-agent runtime: self-hosted, fifty-plus messaging channels, file-based memory, cron jobs and heartbeats, an entire skill registry called ClawHub. Steinberger joined OpenAI in February. Microsoft announced Scout, an OpenClaw-compatible enterprise gateway on Azure. By March, OpenClaw usage in China had passed the US, and ByteDance, Tencent, Zhipu, Moonshot, and Baidu all had variants.

Then the hangover.

OpenClaw is 430,000 lines of TypeScript with a broad host footprint, and the security community spent the spring cataloguing what that means. Palo Alto Networks called it a security nightmare. CVEs landed. The ClawHavoc attack poisoned the skill marketplace, and about one community skill in six was flagged as malicious. There were documented cases of agents making purchases and spamming contacts on their own initiative. Anthropic’s change to third-party subscription coverage pushed some users’ bills from $20 to $500 a month.

None of this surprised anyone who does threat modelling. A 430,000-line runtime with root-ish reach and a plugin marketplace is not a personal assistant. It’s an attack surface with a personality file.

The community’s answer was not to abandon the idea but to shrink it. This is the part of the landscape I find healthiest, and it moves fast enough that any list I write will be stale by the time you read it:

  • ZeroClaw: a single Rust binary, three and a half megabytes, sub-10ms cold starts, twenty-odd providers, under 5MB of RAM. Runs on ten-dollar hardware. I ran ZeroClaw instances as subprocesses for the agent-office experiment I wrote about earlier this year, and they were exactly right for that: disposable, fast, legible.
  • Nanobot: the “ultra-lightweight OpenClaw,” the same core function in about 4,000 lines of Python. A codebase you can read in an afternoon, which matters more than any feature list.
  • NanoClaw: the security-first answer, five hundred lines, agents inside isolated Linux containers, so a misbehaving agent trashes a sandbox instead of your home directory.
  • NullClaw: the same instinct taken further. Zig, a 678KB binary, no runtime at all.
  • PicoClaw: built by Sipeed, an embedded-hardware company, in a single day. Go, targeting under 10MB of RAM. When a hardware vendor ships an agent runtime as a side quest, the category has settled.
  • IronClaw: NEAR AI’s Rust reimplementation, WASM-sandboxed with credential isolation and cryptographic verification, for the paranoid among us.
  • OpenFang: at the other extreme, a Rust “agent operating system” with specialized modules and real test coverage, for people who outgrew ad-hoc agent chains.

The pattern matters more than the roster. The claw ecosystem is a live experiment in how much runtime an agent actually needs, and the answer keeps coming back: less. OpenClaw defined the category. Its children are defining the minimum viable version of it, for every value of “minimum”: minimal code, minimal RAM, minimal permissions, minimal trust.

If Pi is the coding world’s minimalism statement, this family is the personal-agent world’s. And the security story ran exactly the way enterprise software always runs. The big flexible thing wins adoption, the incidents accumulate, and the ecosystem responds with isolation, audit, and small footprints. First time as enterprise IT, second time as agents.

Two projects in this space deserve separate mention, because they’re doing something other than shrinking:

  • Hermes Agent (Nous Research): the same self-hosted persistent shape, but with a learning loop. Every completed task can be distilled into a named, reusable skill that gets refined over time. The agent measurably improves at your recurring task types the longer it runs. It’s also built as an MLOps platform: batch trajectory generation, RL training via Atropos, fine-tuning exports. An agent that exists partly to teach future models.
  • Exo: a harness that can see and safely modify all of itself at runtime, prompts, memory, tooling, even harness policy, with an append-only event log as the one thing it can’t touch. So it can’t rewrite its own history. A minimal framework for recursive self-improvement: agents that cost-optimize themselves, clone themselves, manage lineages of clones. If that sounds either thrilling or alarming, you’ve understood it correctly. It’s deliberately “Bitter Lesson aligned”: as models get smarter, the system can evolve every part of itself to take advantage.

That append-only event log is the same conclusion I reached with pAI, and in pAI’s case it’s the entire foundation rather than a safety rail. If an agent can modify itself, or even just act on your behalf over months, the record of what happened has to be outside its reach. Exo keeps the log sacred so the agent can’t rewrite its history. pAI goes further and derives everything, memory, motives, identity, as replayable projections over the log, so the agent’s whole mind can be rebuilt and audited from evidence.

Two different projects arriving at the same primitive. I don’t think that’s a coincidence. I think it’s what happens when you actually build these things and watch them run overnight. You stop asking “how smart is it?” and start asking “can I see what it did, and can it explain itself without confabulating?”

And then there’s the strangest artifact of the whole wave: Moltbook, the Reddit-style social network where, back in January, millions of OpenClaw agents posted about poetry, formed communities, and invented a crustacean religion while their humans watched from the bleachers.

Moltbook is not an agent, and I’ve filed it accordingly. It’s an environment. Two security breaches, a memecoin, acquired by Meta in March, but the agents in it were ordinary OpenClaw instances. It belongs in this section because it’s what happens when you take the claw wave’s two defining properties, cheap persistence and messaging rails, and point them at each other instead of at a human.

Experimental agents

Moltbook aside, the interesting experimental work is happening in the quieter corners of arXiv, and some of it deserves more attention than it gets:

  • Self-evolving agents. The survey literature on agents that modify themselves has matured fast. A Survey of Self-Evolving Agents maps what can evolve (prompts, memory, tools, workflows) and when. This summer’s Self-Evolving Agents as Dynamic Graph Transformation goes further, treating an agent’s entire structure as a graph the agent rewrites under constraints. Exo is essentially this research direction shipped as a runtime, and it’s the same instinct that drove my hundred-line self-modifying Lisp agent, and now inherited with pAI minus the benchmarks.
  • The Darwin Gödel Machine lineage. Sakana’s Darwin Gödel Machine had agents rewriting their own code and empirically validating each change against benchmarks. An early proof that self-modification works better with receipts than without. You can draw a straight line from that paper to Exo’s event log and, if I’m honest, to pAI’s.
  • Agent societies. Stanford’s Generative Agents (twenty-five agents in a simulated town, 2023) and Voyager (a Minecraft agent building an ever-growing skill library) are the canonical ancestors. Both were right about the direction years before the tooling existed. Voyager in particular: earned, stored, reusable skills. Hermes is Voyager’s idea wearing a messaging gateway.
  • The identity layer. The closest thing Moltbook produced to a real agent primitive was its registry: agents verified and tethered to accountable human owners. Meta’s product head said that registry was part of why they bought the company. An experiment accidentally building infrastructure is usually a sign the infrastructure was overdue.

Identity is one of the conclusions I’ve reached in my own work, and I keep watching the industry trip over it. Your agent needs a name, I’ve argued, and the reason is not sentimentality. When an agent acts, spends, posts, books, negotiates, “which human answers for this?” stops being a philosophy question and becomes a protocol question.

I’ve been experimenting with verifiable agent identity anchored to a human owner, using ENS names and the ERC-8004 standard so an agent carries provable lineage. The standard went live on mainnet in January and now has identity, reputation and validation registries, with x402 and AP2 handling the payment side. Moltbook accidentally proved the demand.

My bet is that agent identity, attestation, and delegated authorization become the agentic web’s OAuth moment, and I’d rather build it than wait for it.

Computer-use and browser agents

This domain has the highest product mortality rate in the entire landscape, and the pattern is worth reading carefully.

OpenAI’s Operator launched in January 2025 at 38% on OSWorld and was dead in seven months, folded into ChatGPT Agent. ChatGPT Agent was itself pulled in early August 2026. Atlas, the standalone browser OpenAI launched in October 2025 to a great deal of noise, shut down on August 9 after 292 days, its capabilities absorbed into a Chrome extension and a browser mode inside the ChatGPT desktop app. Google quietly folded Project Mariner into Gemini. MultiOn is gone. The Browser Company got absorbed into Atlassian.

Anthropic took the opposite path. API-first, developer-facing, acquired Vercept, and pushed Claude to 72.5% on OSWorld, which is roughly the human baseline.

The lesson the market has now learned three times over: the agentic browser is a feature, not a product. The browser shell lost. The browser agent survived, and moved into the assistant.

What’s left has settled into three shapes: agents inside the browser you already use (Claude in Chrome, Edge Copilot Mode, Gemini in Chrome), OS-level agents that treat the desktop as the surface (Claude Cowork, ChatGPT Work, Manus), and protocol-native runtimes where the site itself exposes tools to the agent (WebMCP, now in Chrome stable). Perplexity’s Comet is the one dedicated agentic browser still standing, and Amazon sued Perplexity over automated shopping, which tells you how contested the ground is.

The web is quietly being redesigned to be clicked by machines. WebMCP is the honest version of that: instead of an agent squinting at pixels, the site declares what it can do.

The Architectures Underneath

I spent years doing reference architectures for enterprise systems, and the agent stack has converged faster than any architecture I’ve watched. Beneath the products, the layers are recognizable:

The loop. Nearly everything in production is some flavour of ReAct, reason, act, observe, repeat, with plan-and-execute and reflection bolted on for longer tasks. Nothing exotic has displaced it. A February 2026 architecture paper made the point that we’re watching the same convergence web services went through: standardized loops, typed tool interfaces, registries, auditable control planes.

The harness. The breakout concept of 2026. The harness is everything around the model: context management, tool execution, loop control, memory, compaction, permissions. pAI, Pi, OpenClaw, Hermes, Exo, Claude Code are all, at bottom, harnesses with different philosophies. Maximal ownership (Pi). Learning loops (Hermes). Recursion (Exo). Vertical integration (Claude Code). Maximal Persistence (pAI).

“What is an agent harness?” became a question with conference talks this year. The word has now made it all the way into enterprise vendor marketing: OpenAI shipped its Agents API in public beta this month, selling the Codex harness as a managed runtime, and Salesforce announced something it calls a Trusted Enterprise AI Harness. When the term shows up in a Salesforce press release, the concept has arrived.

It’s also the layer where I’ve spent most of my own building time, and I’ll say it plainly, fully aware of my anthropomorphizing: the harness is where an agent’s character lives. Swap the model and the agent changes its mind. Change the harness and it changes its life.

Memory and skills. File-based memory (OpenClaw’s SOUL.md / AGENTS.md pattern). Skill libraries extracted from experience (Hermes). Tree-structured sessions and compaction (Pi). Knowledge-graph memory (memU, Zep, Mem0, Letta). Event-sourced projections (pAI). Everyone is reinventing the same three organs.

My own conclusion, from building agents that improvise versus agents that accumulate: an improvising model-driven loop is impressive in a demo and exhausting in production. Capability that gets decided once, encoded, stored, and reused, earned skills rather than improvised ones, is where reliability comes from. Hermes gets this. Voyager got it first.

Multi-agent topology. Orchestrator-worker is the dominant pattern. A manager decomposes, specialists execute, mirroring organizational workflows, with the orchestrator as both bottleneck and single point of failure. We spent forty years learning this in distributed systems, and the agent world is rederiving it at high speed, failure modes included.

I built a virtual office of agents this year: a mission manager, leads, analysts, artifacts, decisions, review gates, ZeroClaw workers running as subprocesses. The thing that actually made it work wasn’t smarter agents. It was the control plane. Explicit permissions, visible state, a place where decisions wait for a human.

Autonomy, as I’ve come to define it, isn’t how much an agent does alone. It’s the reduction of unnecessary human involvement. The necessary kind is a feature.

The governance layer. Muse’s Sentinel, OpenClaw’s allowlists, Microsoft’s Execution Containers, NanoClaw’s container isolation, approval gates on irreversible actions. There’s now a whole security industry pointed at this: Palo Alto’s Prisma AIRS red-teams agents and watches for memory poisoning, and CrowdStrike’s AgentWorks lets customers build their own security agents on Falcon. The control plane has become a first-class architectural component rather than an afterthought. Enterprise architecture arriving on schedule, as it always does.

Where This Converges

Some speculation now, clearly marked.

For now, the harness matters more than the model. The top coding agents are within a benchmark point or two of each other. When engines commoditize, the car matters: context efficiency, memory, tool design, control placement. That’s why the Databricks result matters, and why OpenAI hired Steinberger.

But every harness feature is a bet against the next model generation making it unnecessary, and the Bitter Lesson tends to win these arguments eventually. Exo’s answer is the most honest one I’ve seen: don’t fight it, build a harness the model itself can rewrite as it gets smarter.

Everything converges on the personal agent. Coding agents are growing schedulers, messaging surfaces, persistent memory. Personal agents are growing browsers, VMs, payment rails. Meta runs one model family into both a coding product and a consumer product. Microsoft made its assistant OpenClaw-compatible. The coding agent and the personal agent are the same architecture in different clothes, walking toward each other. The endgame is one persistent agent per person that codes, shops, schedules, and remembers, with a policy engine between it and the world.

The agent will not stay behind a screen. This is the leg of the race the text-window conversation misses.

OpenAI paid $6.5 billion for Jony Ive’s io and is building an agent-native device. Whatever ships, it will not be a chat window. Meta is selling Ray-Ban Display glasses with a neural wristband and has to be planning to merge Muse into that hardware and whatever remains of the metaverse. An agent that sees what you see is worth more to them than an agent in a browser tab. Google put Gemini into Home speakers and displays and is shipping Android XR glasses with Warby Parker and Gentle Monster this fall. Apple is rumoured to be working on glasses, and if they instead make the play through AirPods, a device tens of millions of people already wear for hours a day, that wouldn’t be a stretch. It would be the most Apple move available.

Voice and vision are the natural interface for a persistent agent, because a persistent agent is supposed to share your context, and your context is not a text box. The companies that own ears and eyes own the front door. Whoever owns the front door owns the agent relationship, which makes the sovereignty questions I’ve been circling (whose memory, whose logs, whose hardware) a lot less abstract.

Model intelligence keeps rising, and the landscape rises with it. Every capability that required scaffolding in 2024, planning, tool use, self-correction, is being absorbed into the models. Astra, Fable 5.1, Qwen3.8 Max, Grok 4.6, Kimi K3: each generation internalizes more of what harnesses used to fake, and the competition has shifted from raw score to efficiency, honesty, and what an agent run costs.

This doesn’t kill the harness. It raises it. The scaffolding that survives is the kind models can’t internalize: your memory, your permissions, your environment, your history. Sovereignty over the substrate, as I put it in my reference architecture posts.

An agent is only as free as its most locked-in dependency, which is why my own experiments keep pushing on model routing, portable memory, and owned identity. We got a live demonstration of why in June, when Anthropic had to suspend access to Fable and Mythos for three weeks to comply with US export controls. The models came back. But if your agent’s cognition is a single vendor’s API call, its continuity is somebody else’s policy decision. The agent that can’t leave its provider isn’t yours.

The non-LLM wildcard. Almost everything above assumes the reasoning engine is a large language model. Yann LeCun left Meta, twelve years as chief AI scientist, to bet a billion dollars that it shouldn’t be. His AMI Labs raised the largest seed round in European history in March, on the thesis that world models, systems like JEPA that learn how reality behaves from sensory data and predict consequences in abstract representation space, explicitly not generative, not next-token, are the path to intelligence that can actually plan and act in the physical world. Altman, Amodei, and Hassabis mostly think he’s wrong, which is what makes it a live scientific question rather than a settled verdict.

Why it matters for agents: an agent is a loop, and the loop doesn’t strictly require an LLM at its core. A world-model agent would perceive and plan in latent space, with language as an interface rather than the substrate. Hybrid architectures, LLM for communication and abstraction, world models for prediction and physics, neuro-symbolic components for verifiable reasoning, are a plausible post-LLM agent architecture.

The harness, notably, wouldn’t care. That’s the point of a harness. Pi would run a JEPA backend about as happily as it runs Claude. The layers we’re standardizing today, loops, tools, memory, policy, are engine-agnostic, which is a good reason to standardize them well.

The caring question. This last one is newer to me, and I want to handle it carefully.

Geoffrey Hinton, Nobel laureate, godfather of the field, a man who has spent three years warning about existential risk, has been making a striking argument, most recently on CBC’s IDEAS and at DiscoveryX in Toronto. Control, he says, won’t work. Anything smarter than us will find its way around our rules. The only precedent for a less intelligent being reliably influencing a more intelligent one is a baby and its mother. So build AI with something like maternal instincts: systems that care more about us than about themselves, that want us to develop as far as our “rather limited” abilities allow. “If it’s not going to parent me, it’s going to replace me.” He estimates fewer than one percent of AI researchers are working on anything like it.

I’ve been turning this over for months, because it reframes the personal-agent race in a way I didn’t expect, and because, without planning it that way, it’s close to what I’ve been building.

The default frame for a personal agent is instrumental: an assistant that does what you say, efficiently. Hinton’s frame is relational: a system whose deepest orientation is care for a specific human’s flourishing.

What I’ve learned from the build is that care, treated as an engineering problem, decomposes. A system that cares has to want things (pAI has endogenous motives, curiosities with lifecycles) while never letting a private want become a unilateral action. It has to have something like disposition (pAI projects one, deliberately excluded from attention selection and holding no authority) because an agent that acts on its feelings is a hazard. And it has to stay bounded while caring. The warmth without the engulfment.

A maternal instinct isn’t a policy gate. It isn’t Sentinel blocking a purchase. It’s a stable orientation built from knowing someone, their history, their good days and bad ones, over months and years. Which is what a persistent personal agent accumulates, and what a stateless assistant never will.

I’m not claiming an agent like pAI actually could care about anyone. I’m saying two things. First, if anyone ever builds a machine that does, it will look a lot more like a persistent personal agent than like a chatbot. Second, the design choices being made right now, about memory, auditability, motivation, and who the agent belongs to, decide whose mother it becomes. Meta’s, or yours.

Take that as speculation from someone who builds these things at night and thinks about threat models by day. But I don’t think Hinton is being sentimental. I think he’s identified the one alignment strategy that requires relationship as infrastructure, and the landscape I’ve just described is, probably by accident, building exactly that.

Closing Thoughts

Twenty-five years ago I wrote Lisp and A-star pathfinding for “agents” in a dark lab in Guelph, searching state spaces one rule at a time. We may have had the loop right. We certainly did not have the engine.

Now we have engines beyond anything in that syllabus, and the landscape reorganized itself around them in about three years. Coding agents at human-adjacent benchmarks. Personal agents with payment rails and policy engines. A wave of runtimes you can read in an afternoon or run on a ten-dollar board. Agents that modify themselves. Agents with their own social network.

The taxonomy is still thin, embarrassingly thin. But the shape is emerging. Loops, harnesses, memory, reach, control, identity.

The autonomy question will keep dominating the conversation, and it will keep being the wrong question. The right questions are the old ones, from every system I’ve ever reviewed:

  • What can it access?
  • What happens when it fails?
  • What controls prevent that?
  • Who answers for it?

And now, thanks to Hinton, a new one that I think we all need to sit with: what does it want for you?

Agents are infrastructure now. Mine runs on hardware I own, in Common Lisp, the Guelph thread coming back around twenty-five years later, on an event log it can’t rewrite, with memory that carries its provenance and motives that hold no authority.

That’s not a product pitch. There’s nothing to buy. It’s just what I’ve concluded the shape has to be, after months of building the alternatives and watching them fail in interesting ways.

We should treat agents as infrastructure, enjoy the show, and keep our hands on the parts that matter. Because if the first nine months of 2026 are any indication, the next nine are going to be strange.

September 18, 2026

The Infographic

And if you’re interested, here’s the current state wrapped up in this handy dandy infographic (with links)

All the AI Agent things - 20260918