Inside Nathan's Second Brain: Daniel Miessler, Security Expert & Creator of PAI, Audits My AI Setup

Daniel Miessler, welcome back to The Cognitive Revolution.

Awesome. Thanks for having me.

It’s been only 4 months since our first episode. Time flies in the AI space, as you know better than most, and I’m excited for this conversation because basically what I’ve been doing since then, taking inspiration from you and others, has been building out my own personal AI infrastructure.

At this point, I’ve gotten far enough along that I feel like there’s definitely a lot of value in it for me, and possibly it’s worth sharing. But rather than just coming on here and monologuing about what I’ve done, I thought it would be more helpful to everybody, starting with myself, to share it with you and get your feedback as we go on a bunch of different dimensions: what you think I’ve done well, what value I’ve maybe left on the table, what security vulnerabilities I’ve left open for myself without realizing it, perhaps, and who knows what other ideas and topics we’ll get into as we go. I think this is going to be really fun. Thank you for coming back and doing it.

Yeah, fantastic. Can’t wait to hear about it.

I guess, for starters, where I started after our conversation last time—and for context, at that point I had already been using Claude Code a lot to do things, coding different apps and what have you—but I hadn’t really gotten too serious about what my own personal AI infrastructure was: my own little nest of my own creation, with all my little idiosyncrasies embodied.

So, I took your repository from GitHub, and I also took another toolkit that a friend named Chris created for me and shared with me. I put them in 2 repositories on my main laptop computer, and I started just by asking Claude, “Okay, here’s what I’m trying to do.”

I want to make my own version of this. I think both of these guys have done more than I have and are inspirations. I just asked Claude to review the two repositories, compare and contrast, ask me some questions about what I’m trying to do, and ultimately try to do some sort of synthesis that was a little bit more me-flavored while, of course, taking the best and most relevant stuff from each of those sources.

And then my big thing was, this has been kind of a white whale for me for a long time. I think it also will bring up some questions around what the ethics, certainly social norms, and maybe even ethics, of these sorts of systems should be like. But the thing I’ve been trying to get models to do for a long time is write as me.

I will caveat that first by saying I always, at least so far, edit pretty heavily when things write as me, and I never just pass something straight from Claude through. I’ve actually only done that one time on the podcast, and I did flag it as such. It was with Anden Labs because they have AI doing autonomous businesses, and so I thought it would be fitting for that episode to just let Claude write the intro entirely on its own and read exactly what it wrote.

Otherwise, though, I do always still edit things pretty heavily, but I’ve found it, in the context of writing these podcast intro essays, super helpful. Even if I sit there and rewrite the whole thing, it makes sure that I have all the points. It has at least a decent first approximation of the form that I’m going to put together.

Yeah.

And that’s worked well for a long time. But the key thing there has been that it’s always basically the same process: Here are 50 essays I did before, here’s the transcript of the current one, and write a new one.

I was like, that’s good enough that I bet I could get quality output for other use cases. But as we discussed last time, context becomes the big bottleneck, right? Does the system know who these people are, what my relationship to them is, and how I tend to respond in these types of situations? The answer is no, certainly not by default.

So, the first big thing I did back in January was set up essentially a second-brain kind of system. The first goal was: Can we get all of my digital output, as much as exists—which is quite a bit—into one place where it’s searchable, indexed in some way, and maybe filtered for quality from various angles? But the first thing was just to export everything: export from Gmail, export from Slack, everything I’ve ever tweeted, all the podcasts, et cetera, et cetera, and put that all into—

Real quick question: What would be in Gmail that you would consider content?

The filter that I used was just—and I’ve broadened it slightly—but anything that had “from:me.” If you go into Gmail and search “from:me,” you get every thread that you initiated or responded to, and I basically pulled in all of that.

Okay, but I’m saying, is that to track who you’ve talked to and what the business relationships are, or do you think that you might have sent out an essay or a cool idea there that you were trying to harvest?

A bit of both. There are a couple of post-processing layers that I’ve experimented with on top of that. One was around the same time I was working a little bit with a startup that was trying to fine-tune models for individuals. Their idea was that we need to create AIs that help people preserve their economic leverage, and the only way to do that is to create something that really augments them, as opposed to these massive cloud-blob behemoth things that seem like the companies are definitely trying to make substitute for people rather than augment people.

For that, they needed a writing sample. One layer of post-processing was to try to identify which emails I had sent would make good writing samples—ones that would really show a thoughtful side of me, as opposed to just an operational back-and-forth side.

That was interesting. It worked reasonably well to have a pretty—I think I used Gemini 3 Flash at the time—take in a bunch of these threads and score them on a few different dimensions, like originality, substantiveness, and whatever.

Doing a little querying on top of that.

That could pull those things out and drop them into a kind of master writing-sample document where I could say, “Okay, 50,000 words or 200,000 words, whatever you need, I’ve got enough. But how can I bring the cream to the top?” So that was one initial use of that.

Then another post-processing layer—which I think may have come in around May, when everybody was all of a sudden doing wikis—was based on an idea I’d had over time. Now that I have this thing, and it comes from about 8 different sources, it has iMessage in there. I downloaded an app called Beeper, which gives me some problems, to be totally honest, but does a decent job of consolidating DMs across all platforms into a single thing. It has a desktop API, so the model can pull messages from a bunch of different platforms.

The idea I had for a long time was: If I have all this correspondence and it’s just in one big blob, then I could go back in time and do summaries with some frequency. What I ended up landing on was roughly monthly summaries. For me, a couple hundred thousand tokens per month seemed to be the average.

That would include my contributions to the thread, but also what people had sent me. If it’s a group chat, it could be mostly other people, but just occasionally me—whatever, right? The idea is to try to create a comprehensive picture of my digital life and then develop a prompt that takes those couple hundred thousand tokens per month and summarizes them, basically an order-of-magnitude reduction.

It takes it down from, say, 200,000 to 300,000 tokens to 20,000 to 30,000 tokens, which is honestly still a lot. That gives you really nitty-gritty—

Coverage of what happened in your month. Twenty thousand tokens—that gets pretty low-level in a description of a month. Think about 1,000 tokens per workday. Did you really have 1,000 tokens?

You could even do that again to get to 2,000, right, if you needed to. Yeah, well, I did that on an annual basis.

I went month by month for the last 5 years, taking the raw stuff from that month plus the summaries from the last couple of months, and then just rolled through creating monthly summaries. I layered on top of that the annual summary, and then layered on top of that the sort of high-level summary. This is where I was trying to get to something much like what you had built, where it’s like: Here’s the picture of now, with a very deeply informed history. Here is the current state of affairs on top of that.

Following Karpathy and other people moving toward the wiki idea, another layer was: Let’s make a wiki on top of this that identifies individuals, looks back over all time, and says, “Let’s summarize the relationship with this individual, with this organization, with these ideas,” whatever the case may be. I think that wiki has maybe 500 articles in it now.

Are those tagged with front matter, with references to the other documents? Is it Markdown, or what’s the structure of that?

Yeah, it’s pretty much just plain-text Markdown. One of the intricate parts that did require some iteration as I was going through it was how best to link back to source material in those summaries.

What I landed on for now—which I don’t know if it’s the best solution, but it seemed to work pretty well—was having the summarizer prompt put in-line references to source material with distinctive quotes. What I ended up asking for was anything from 2 to 20 words that, if you searched for just that literal string, would immediately take you to that document, so you’d know exactly what it was—a pretty direct reference. I guess I could have done it by ID or whatever, as well, but I ended up doing it with these actual excerpts.

Yeah, and kind of a little bit of additional metadata, so it would be a quote, and then, “This is from a DM with this person on LinkedIn,” or whatever, right?

Overall, I’d say that seems to have worked pretty well, but I’m definitely open to the possibility that there’s room for improvement there.

Yeah, interesting. I kind of did the same thing. I reverse-engineered, essentially, because I wanted Obsidian functionality without the Obsidian client. I’m like, “Okay, why are people so ravenous and religious about Obsidian?” I want to separate in my mind how much of it is the client versus how much of it is the connectivity, because I’m not a big client person.

I think the client goes away, which is part of the thing I imagine we’ll talk about. But I want to know the schema that it was using, right? It’s just references. It’s like, this document links to that one; it’s related to this one in that way.

I had already started building that. That was kind of the structure of my memory files. Then when LLM Wiki came out, it just made it a lot more concrete. It was like, “Wait a minute, I could do this for everything.” So I did my bookmarks that way. Everything is a marked-up, highly referential Markdown file for my memory system.

I think that pretty much rhymes.

Cool. I don’t know about you, but I would say it has been very effective. The first smoke tests, which honestly are already quite valuable, are just that I sort of remember something that happened.

Yes, I had some correspondence. I might not be sure who, and I might not be sure exactly what was said, but I can vaguely gesture at something and know it's in there somewhere. Can the AI find it, retrieve it for me, and give me a refresher on what the context was for this kind of highly lossy memory that I have? And yes, it works great for that. It is unbelievable how often I can just go, “Yeah, I kind of know something.” Then, next thing you know: “Yep, I think I found it. It was this, this, and here’s what happened.” And I’m like, “Wow, that is, off the bat, just an incredible tool to be able to rely on.”

I’ve also noticed it has changed my behavior a little bit in some ways. Calls are another thing that I index this way. I’ve been using Fireflies, which people sometimes laugh at me for using. I’m not comparing it feature by feature right now.

Granola or whatever.

Yeah. Well, we actually did an episode with Granola, and they sponsored the podcast for a minute. So I’ve been using both, but I do one thing that Granola doesn’t do, which I think in many contexts may be the right choice for them: they don’t record the original audio. They do have a transcript, but no source audio file.

I did want both.

Yeah, they have interesting reasons for it. I think they feel like it’s maybe a lot to ask in a lot of contexts. They’re trying to do enterprise deployments, and the question is whether people are really fully ready for that. I’m ready for it, but I can also understand how a lot of people at the companies they’re trying to sell into and deploy to might be more comfortable without it. But that was simply one feature-level difference I did notice that kept me on two tracks.

So, one idea real quick, because this came up here: You mentioned something earlier, the full ingest. I’m a huge fan of this concept that the technology is moving so fast that we always want to preserve the raw. At the end of 2025, we do things a certain way. It’s based on the constraints of the technology at that moment, right?

Now, we currently do things another way. It’s based on the constraints of that moment. So the question is: How much are you going from raw to summary? That depends on the size of the context windows. It depends on how stupid things get at a certain token length of the context window, right? But what I love is that if we have the raw and always keep it at any given moment—let’s say 5 comes out from whatever, 5 comes out from Anthropic, or 6 comes out from OpenAI, and it’s a step change—your first prompt could just basically be, “Go look at my current system.”

That’s kind of where I was heading, but look over here: You actually have all the raw stuff. Let’s rebuild it from scratch better. And it’s like, “Okay, well, we wouldn’t do summarization at that level. We would do it at a completely different level.” But you never want to be in a situation where it’s like, “Sure, I can absolutely make this 1,000 times better. Hand me the raw stuff.” And you’re like, “Oh, I don’t have the raw stuff. Here are my old summaries.” And it’s like, “Well, I guess I’ll do the best I can, but I wish I had it.” So, all that to say, I agree with your instinct there. We should always have the raw, because we can rebuild our entire system from scratch as the AI gets better if you have it.

Yeah, that is pretty hard to argue unless keeping the raw is a fundamental barrier to closing deals. But for me, it’s not, and I do feel glad that I have the last 3 years’ worth of calls. Certainly, relative to where transcription was 3 years ago, even on that relatively narrow domain, we can get a lot better transcription now than we were getting natively with Fireflies 3 years ago. So the ability to go get all those raw audio files has been quite helpful.

Well, and I was talking about the overall everything, right? All your Gmail. Basically, maybe—and I haven’t done this yet—we should be maintaining raw storage. Whenever you do one of those Gmail parses, you put everything into a repository there, so you wouldn’t have to do that whole process again. You know what I mean? At any given time, you could just be like, “Here’s the raw. Start over. Here’s the raw. Start over.” You would just never lose any signal that way.

Think of everything else that applies: every video you’ve made, the transcripts from those, all the emails, all the calls, all of Slack for a company, stuff like that.

Yeah, I would say the funny thing is, it wasn’t super high stakes for me, so that’s basically what I have now. I’m not necessarily keeping all the raw audio on my computer, but the sort of raw that I would feed to a new model or a new whatever to say, “Work from here and work up,” I could go back and retranscribe. But I think that’s usually—at least as of today—already pretty good and pretty trustworthy. So it basically now lives in essentially a 1-gigabyte database.

Is that SQLite? Is that local?

Yep. SQLite on my computer, and then I am pushing it to GitHub, which I’m starting to rethink recently based on some of the issues they’ve been having security-wise. But, yeah, as of now, it’s all in the super database.

The one pain point that I had—for people who haven’t done this kind of thing before—is that it’s an amazing experience to just sit there and be like, “Can you code your own tool to go get access to whatever?” More often than not, even in January, it had no trouble coding up the tools.

Some real Eureka moments for me were when it would talk me through how to go to Google Cloud and create my own app, what the settings needed to be for my own app, and how to add my own account as a tester so that I didn’t even have to put it through Google review. I could just immediately have access to all my stuff, which is all I really wanted anyway. It was giving me button-by-button click directions on how to go through those interfaces. If this thing can take me through Google Cloud setup, I think that might be an AGI qualification.

Slack is the same way. The difficulty of finding what you need in Slack is incredible. There’s one caveat there: I think the level of access that I gave myself was somewhat contingent on me being an admin of the organization. So not everybody in every Slack that they’re in is going to be able to have the kind of full extract in the way that I did. They might have to have some conversations about getting that sort of access opened up.

But again, the number of permissions in there was just absolutely insane. Its ability to talk me through it all was incredible. The only time I had a sort of “Oh my God, why did you do that?” moment was with Slack. The problem was that this was very much like iterating through it, because I didn’t want whole-company Slack over however many years. I kind of wanted everything that I had been involved with.

I think for a company, you would maybe want to structure it differently, but for me, I was like, “I want my DMs. I want threads that I contributed to.” We also have logging stuff in Slack, so that’s a whole other thing.

You definitely stumble on these things as you go, where you’re like, “Oh, there are 2 log channels that are, in fact, 80% of all Slack data.” You don’t want that, right?

So now, once you’re in the kind of special-casing, you’re special-casing more and more.

Even in Gmail, some interesting findings came from a naive sort order, like putting the longest things I wrote at the top. Interestingly, when I did that, I found that an AI output I had sent to a friend was often the longest thing. So now I'm like, “Oh, wait a second.”

I actually had to caveat some prompts around classifying, especially for the writing-sample thing, but even just in general. One of the things that Flash does is try to indicate whether something is actually Nathan’s original writing or whether it’s AI-generated. I’m not trying to hide it when I send those things to friends. I’ll typically say, “Here’s what Claude told me about this,” or whatever, but I still need to make sure that it’s not leaking into my writing sample and teaching it to sound like Claude as it attempts to sound like me.

The one time it actually did a data delete that was kind of painful was predicated on the fact that Slack’s rate limits, if you’re just an indie hacker, are insanely low. With Gmail, you fly through the data. It took me a couple of hours for the script to run, and they can support—and do support—not-insignificant use of the API. Slack is really limited if you’re just creating your own personal token or whatever.

It took days, maybe even a couple of weeks, to go through everything, especially with a couple of different strategies and rounds of iteration. There was one time when it didn’t realize that, and the lack of a proper sense of time that models have was very apparent. It wouldn’t have been that hard conceptually to rerun all the API calls and get all the data back, but it didn’t realize that we had spent a week constantly hitting rate limits to get the data we did have. It was just like, “I’ll drop that part of the database and refetch it.” It was like, “No, it’s going to be a week.”

That’s the only time that’s happened, but it was definitely notable. You see these things on the line, and one version of it happened to me as I was going through everything.

They can happen.

It wasn’t a super-painful version, but one version of it happened to me as I was going through everything.

I wonder if there’s a full-export option where it just gives you a ZIP.

I’m not sure if there is, but that’s another option. You might also need to be an admin to do that sort of thing. I should look into that, though.

Zooming out, the only thing is that it’s really good at just answering questions. I also developed a little audit skill. How exactly this works is honestly kind of a black box to me, in the sense that it’s the AI checking its own work. I was like, “Go in and try to find things that might be wrong, or that are ambiguous, where you’re making guesses,” because I did notice some things that were wrong in the summaries.

Generally speaking, I have to say the summaries were overwhelmingly very good. When the models made somewhat wrong guesses or jumped to a conclusion that wasn’t quite true, one thing I noticed was that they were very—I don’t know about you, but I’m the sort of person who floats plans and doesn’t always follow through or see those plans to conclusion.

No, I’m one for one, of course. Yeah, for me, I noticed that the models were very inclined to keep certain things as open threads for a long time, because one of the things they were supposed to do in the monthly summary was identify open threads. But then, once something was an open thread, by default it would be an open thread forever.

Or things I said I might do, or that I’d be interested in doing, it sometimes thought definitely happened or were going to happen. There was one case that was quite funny: I had come up with an idea for a company back in late 2022 and floated it to a couple of people, including a couple of investor friends. I was like, “If I actually start this, would you invest in it?” I got a couple of yeses—“If you do start it, we’ll be a part of it.”

But for Claude, 3 years later, it was like, “This person invested in Nathan’s company at this time.” Wait a second. You would have seen a lot more material about that company. This was a mistake a human would not have made.

Maybe that’s a reflection of the structure, where you’re going through it month by month. But when things pop up and then fall off, a human would very intuitively get that: “Well, I haven’t heard about that for a long time, so clearly it’s not happening in the way it was discussed in late 2022.” Claude did have a few random issues with that, but the audit skill also seemed to help. Exactly why it works is a little weird, but it was able to surface a bunch of questions for me. Then I would answer those questions and try to steer it in the right direction.

I think, at the end of the day, its understanding and command of information would be extremely hard for a human to match. If you benchmark it against a new human assistant, I think it would be extremely hard to ramp a person up to the—

Depth and breadth of knowledge that the system is now regularly able to demonstrate.

You’re saying the depth and breadth of knowledge of all the different guests that we’ve had, all the interactions, the sponsor space—all of that corpus of knowledge, right? Yeah, and beyond. I mean, the podcast is one dimension, but it’s also got my previous company and entrepreneurial history, my personal life, chats with old college roommates. It’s really a 360-degree view of me, with really no segmentation or separation, which I think is quite interesting.

I think that’s best, actually. I think it performs best. It’s going to be interesting to see how that develops. For me, it’s natural because I’ve been an entrepreneur for a lot of my career, and the line between what’s personal and professional is at times blurry. I’m longtime friends with a lot of people I’ve worked with, and yet I don’t know if that’s, again, kind of like the granola thing. Is that something everybody’s going to want, or will people want a LinkedIn and a Facebook—two different faces? I could certainly see some people preferring that.

I think we both will want to more closely merge our lives. I think we should—I mean, this is just a preference and a bias—but I think we should want a more integrated life, because ideally the work we should be doing is something that inspires us and makes us happy, which is the same thing we’re supposed to be getting from life. I think we’ll find that this work-life barrier was an artifact of old times. I feel like that’s the direction we should head in.

But the AI isn’t quite there yet. If you go too crazy with that, it might cross the streams in a way that hurts you reputation-wise, right?

Yeah. That actually suggests some of the additional layers that I’ve built on over time since then as well. One big thing that I’ve felt limited by with everything I’ve described so far is that I’m not comfortable taking myself out of the loop. I’ll do—you know, I will say I almost got to this earlier, and somehow we went a different direction—but how has it changed my behavior?

One is that, on calls, I’ll sometimes find myself asking a question with the idea that I want to get the answer in the transcript so I can get back to it later. I don’t know whether I would have asked those questions previously, but I do have that sense in my mind that if this person says it now, it’ll become something that’s durably accessible to me, and that’s a pretty—

Yes.

—feeling that I do enjoy taking advantage of on calls.

The other big thing is, very much like you said, with the client, I spend less time in Gmail and probably a lot of different web apps. I have also used Shortwave quite a bit, but I'm now much more on the command line. Even for something like, “Scan my inbox, see what's going on,” or if I get a sponsorship inbound, that used to be something where I would have to assemble information—I have a template and attach something—but now that's a skill. So it's just, “Run the episode's sponsorship-sale skill in response to this inbound,” and it's amazing how little time you can get away with spending in lots of different web or desktop clients.

But I'm still not that comfortable taking myself out of the loop. The rules that I have for Claude Code on my main personal computer, the one that I use, are: draft, but don't send. Give me a link to the Gmail draft, but I'm still going to open it up, read it at a minimum, and usually edit it. I sometimes feel like I'm probably too precious. This is something that I wrestle with a lot. I'm sort of like, “Was that email bad by Claude?” No, it wasn't bad. Why did I feel the need to edit it? Am I making it not necessarily better, but more me-flavored in a way that matters? Possibly.

I'm very interested. What do you think about that? I have another layer of solution, or at least an attempted solution, that I'll describe, but how do you relate to when AI tries to write as you?

I'm pretty much at the same place. I don't let it write as me. I have a very specific thing in the writing skill. Kai, my main DA, has all his own writing rules. If he's going to write as himself, I want him to have his own voice.

I actually let him explore his own personality and come up with his own backstory. So he's got a full personality and backstory, and then I map that to how he writes and why he writes that way. There's a very distinct voice that he has. He also knows that he's not allowed to write as me.

If he's using my email address, then he has to say, “Hey, this is Kai, Daniel's DA,” and then give the information and sign as Kai, right? Especially if it's coming from my email address, which oftentimes it's coming from him, so that's more obvious. But I really never let it write as me for a couple of different reasons.

One, it's reputation damage. If something gets out and it's obviously AI, that would just be nasty. But the more important one is that the quality isn't there, so that's number two. The last one is that if it's doing the writing for you, it's doing the thinking for you as well, and I don't want to outsource that.

I consider writing to be thinking—not operational stuff, but anything of any quality or actual weight. I insist on doing it myself because I consider writing to be thinking.

A funny anecdote that happened recently: I live in Detroit, and I got an email from—I won't name the person, although I've invited them to come do a podcast and talk about the evolving social norms around this stuff. I got an email from this person who's reasonably well known in Silicon Valley—not one of the first 20 people from Silicon Valley that people would name, but definitely a name that people will recognize.

The email came in the afternoon of a day that the Pistons were playing in the playoffs. It basically said, “Good luck with the Pistons game tonight. I don't know if you care about that, but if so, good luck,” or whatever. I don't really know this person that well—just a few interactions over time—but it was good enough to catch my attention.

So I responded back and said, “Hey, thank you. But my question for you is: do you care about the Pistons, or is this just a flex of your personal AI CRM? If so, it is a pretty effective one.”

The response came in 2 seconds: “AI, baby.”

I was like, “That's really interesting.” Then I noticed that in the subject line there was a misspelling. It was “good luk”—L-U-K. I was like, “Huh.” So this person—

For the prompt.

I can't imagine.

Yeah, yeah. It has to be. Has to be.

So, yeah, I asked them. I was like, “How do you think about this?” With all the things that I just described—all this history that's queryable and all these articles and whatever on top of it—I feel like I have the infrastructure set up where I could unleash something like that on my personal network. And yet, I've been very reluctant to, especially when it comes to prompting for spelling mistakes to really make it seem authentic. I'm like, “I don't know. That seems a little much to me.”

Yeah. I think about this a lot: what matters and why, and try to go four layers deep there. A great example is actually very similar to this basketball one. If you reach out to somebody and say, “Hey, I saw a flower at the mall and it made me think of you,” and if you wrote them a handwritten note 40 years ago or texted them that 10 years ago, that has extreme value.

Assume that you don't talk to this person a lot, but you saw a flower and thought of your friend. That text has extraordinary human-to-human value. It comes down to the effort. It comes down to the effort. The effort is what is appreciated on the other side. If you remove the effort, the value just went away.

One of my ratings inside my PAI system is the state of my personal relationships. How am I doing? I don't want the rating to go up if one of my cron jobs is, “I've pinged all my people.” That shouldn't give me a good score, right? Because I haven't done the work.

I think that whole effort mix is really important: what actually do people care about? For human interaction, I think it does come down to the effort on the other side. It makes me think of gift giving, too, which is another skill that I'm currently building.

I've never been a great gift giver with AI help. I think I've done quite a bit better recently, although certainly still not elite. But I do think there's still a huge difference between, “I went and opened up Claude and had a conversation about you, and we landed on this idea, and now you get this gift.” The old adage, of course, is “the thought that counts.” It is the thought that counts.

I do feel like I'm on the right side of that when I use AI assistance, but somehow, if it became totally automated—if, let's say, I were able to get to the point, which, to be clear, I've not achieved, but if I were able to get to the point where I just load up all my birthdays into a calendar and the cron job does fully autonomous gift giving—and objectively my friends and family score the gifts I've given higher than the ones I would have counterfactually given on my own, am I—is that good? Have we advanced as a society? Not sure.

I just thought of—this must have been a movie or something, highly traditional and kind of sexist—but I'm imagining this guy traveling all over the world, this rich husband or whatever. The wife is at home feeling neglected, and a box comes in the mail. She opens it up, and it's her favorite flowers and favorite chocolate. She lights up, and then she looks at the note and realizes—damn it—and recognizes all the signals that it was his admin, his secretary, who was actually thoughtful enough to do this.

The flowers are no longer good. He didn't think about it. Someone else did and basically faked the action. I think this whole thing with signaling and authenticity is going to be really important. I've read a whole bunch of books about this. Will Storr is one of my favorite authors on this. What is the signal? What is the authenticity? There's always the faking cat-and-mouse game of this.

I just think that's going to be really, really important with this whole AI thing, especially as it relates to authenticity. It's interesting that you have AI going through and scoring the health of relationships—and this is not something I've done. I'd be interested to hear a little bit more about that and how it's working for you. What does it prompt you to do, and how do you make sure that you avoid unwanted AI feedback, like inflating your score?

Yeah. It's seeing how I'm interacting with it. I don't have it watching everything yet. I'm still working on ingestion for a few different systems. But to the extent that I'm talking to Kai about relationships, that's kind of what he'll see at this point, which right now is mostly building apps and doing a bunch of other life stuff.

The idea is—my ultimate idea for all of AI, actually, but especially for my personal AI—is that there's only kind of one end state for AI for me, which is the navigation from current state to ideal state. It's just that simple.

My TLOS is my primary document that runs everything, and it's also what I use on the business side for consulting. Current state and ideal state are basically first-class citizens in my TLOS. In my current state, I have the fact that I maintain my relationships with my friends, and I have ratings there. For family, I need to be reaching out to them this many times.

When those numbers aren't where they need to be, that's showing in a score. It's actually in my status line that these are decaying, right? The same thing applies to physical health and a bunch of different things.

But the overall overarching idea there is that its job is simply to get me to an ideal state and to understand and capture the current state properly. And then the whole entire game is the transition—the navigation, which right now is a bunch of cron jobs and a bunch of other stuff. But my view of this, especially for enterprise AI but also for all the personal stuff, is that that is the game.

The game, very simply, is that all these agents, all these harnesses—it all fades into the background. I believe we're going to end up with one DA. Most people will end up with one DA, and your DA, of course, can have others participate as well, but I think you'll have one primary digital assistant. It's the one managing all that other stuff, and it's the one who's the expert on what's currently happening and what your ideal state is.

Obviously, you're the one providing the ideal state. And then, while you're sleeping, while we're in this conversation, it's over there working, researching, doing all the work. And, yeah, I just have one of those facets as relationships—family and friends. How do you articulate what the ideal state is? I feel like I'm not that confident. I guess it can just be an iterative process unto itself, but I'm intimidated by the notion of trying to articulate an ideal state.

It's wonderful. It's a wonderful process. I think the whole TLOS process is just fantastic. But I've always had this current-ideal-state thing, and I've now promoted it to be the primary thing inside of TLOS. It's like, okay, what does an ideal day look like?

It really challenges you. It inspires you to be very honest. And then the moment you start wondering if you should write it down, now we're making progress, right? For me, what it does is it starts to reveal ego. It starts to reveal, okay, what do I really want from life? What's the story I'm telling myself about what I want versus what I actually want? And I love the distinction between those.

What does your day look like when you wake up in the morning? What do you see? And if you actually start filling these things in, combined with the other context that your DA has, it's going to be able to do a pretty deep psychological profile on you, right? It's really going to understand what you're about. And if you've added in your challenges and all your other stuff that you're working on, it's just going to give it a whole lot of insight.

The way I do it is: what does a day look like? What does a month look like? What does a year look like? Some classical ones, like where do you want to be in 10 years or whatever. But those are just different angles of approaching it. Ultimately, I would like to be doing exactly what I'm doing. I would like to have so much money that I get to spend time flying around giving money away.

I've seen a few people. It was one of the first episodes that I loved from My First Million—is that the podcast?—and it was about a guy who basically had a private driver wherever he or his wife went. He always had a private driver following them around. He actually has private planes, and most of his work is doing his projects and then flying around to parties where he gives away money to the people that he's done all this work to find—the best people to give money to.

And I'm like, are you kidding me? You get to just give money away where you've maximized the amount of impact that's going to come from giving away that money. But it's also associated with ego stuff and materialistic stuff because you get to fly around, meet people, and see different places. So it's a mixture of intrinsic but also fun.

Those are the types of things I put in the system. Not so much, “I want this amount of money,” but, “I want this type of lifestyle,” which obviously requires this amount of wealth or whatever. The more of that stuff you put in there, I'm telling you, it requires a lot of introspection to even write it down and think about what you're trying to do. But I feel like the more I understand that, the more I can reverse-engineer the systems that I build.

Okay, that's definitely going to be interesting to do. And that's going to be one that I can't entirely delegate to the agents, obviously.

Oh, no. It's very personal.

I do have a slash-slash. It's a prompt into the TLOs and into the ideal state. I actually do that with a whole lot of my system: when you have a question, go into interview mode. How often do you do that?

It prompts me quite a bit, both on building and coding. But, yeah, anytime it's confused or it's not sure about a goal—oh, we might want to talk about the algorithm at some point. I can't remember if we talked about it last time, but with the algorithm, where you're chasing an ideal state inside of even building an application, just a pure coding thing, if there's ambiguity, you're not chasing the proper ideal state and you can't turn it into discrete, testable criteria. So, yeah, the interview is just essential for that.

So, put a pin in that one. I'll come back to it. I can tell you how it's changed my life maybe next time we talk.

I'd say, in contrast to that, I wouldn't say it hasn't still been effective for me, but I've been sensing something left on the table there for sure. What I've typically done over the last few months is really just sit down and be like, in my gut, what can I advance today? Or what's slowing me down? What would I love to be able to just do from my phone?

I guess one ideal state that I've articulated a few times is less time at my computer, more exercise, more time outside. That would be a clear win.

There you go. I mean, that's great. Trying to get to the point where—but unfortunately, I still wouldn't say I've really got that win yet. I might be hitting a tipping point, but it's too soon to tell.

One little detour I'll take, and then I want to come back to your notion of everybody having one DA.

Mm-hmm.

Interfaces. I did another one of these show-and-tell-type episodes with my friend Steve Newman, who's a 40-year professional software developer. He founded a company that was sold to Google, and he's had several exits over time. Very accomplished guy. Now he's vibe-coding up his own personal thing.

The big thing I took from him was: create interfaces. I was kind of sleeping on that and doing everything through the command line, pretty much. When you have the ability to ask these questions and it has such deep context, you often can get pretty good answers, including sometimes—if I might have 10 memory-hog threads open in the terminal, and I'm building up big video files here locally that are waiting to get uploaded to the cloud—if I run out of disk, I might just go kill those.

Then I'm like, what did I have open, and what were they? One way to do that is to ask Claude, “Hey, go back and summarize the last 10 threads for me and tell me what was finished and what wasn't finished, so I can pick up what I need to pick up and hopefully not lose things.”

But I was finding that I was hitting a point of cognitive overload where I was a little bit like, what exactly have I built? Which threads did I finish or not finish, and where do I have uncommitted changes floating around? Steve's feedback was definitely a phase change for me. I was like, oh, I should be building a lot more of my own custom little interfaces.

I now have one that helps me manage the podcast production. I used to have a skill, again all through the command line, to help produce a podcast episode. Now there's a UI that makes it a lot easier to see the images that get created for the art, watch the clips that get made, and so on and so forth.

What would you say?

Okay, so that's interfaces.

So that's what he means by interfaces. I was thinking the interface to talking to your DA, which I think is the big advancement of OpenClaw and Hermes. Largely, 80% came down to the fact that I could just talk to this thing anywhere over Telegram or WhatsApp or whatever. But you're talking about also just being able to see and visualize and stuff like that as well.

Yes, although I do want to come back to talking to them too.

So interesting. I have an open tab right now. I'm building an app called Surge, an internal app for me, which is actually—I could share it with you. Basically, it's all sponsor management.

We have not only the podcast, but YouTube videos with interviews. We also have newsletters. We've got 4 or 5 different subproducts for sponsors. As you know, there's the interaction point. There's agreeing on copy and stuff like that. Then there's the point where it's been approved. Then it's, okay, here's what it looked like when it launched. Then there's the metrics.

All of that can be done via email, and it can be automated via email, which I'm not doing yet because of the authenticity thing.

But the other option is to just build them a web interface. So now I’ve basically built a web interface where they authenticate as themselves, as their company. They come in, and they can see that entire process, plus all the different campaigns.

So I think this definitely qualifies as what you’re talking about with the interface: what was being done as raw back-and-forth using previous technology, and can you unify that experience in some sort of way? So, yeah, I’m in the middle of doing one of those for basically the sponsors for the business side.

Nice. Do you have one that is sort of your—when you said, you know, when relationships are not maintained, it hits your status line—what is that status line? Is that another thing that you look at in a browser or otherwise?

No, it’s just right here under Fresh, and then I’ve got about five different things. So, projects, personal— all those different ones. Different aspects of my life, and how high-quality or fresh they are.

If the quality is low, it shows that basically as the lowest level of freshness or quality. If I haven’t updated them recently, it also starts to decay. It’s just a way of making sure I keep my context updated.

Gotcha. And that literally just shows when—

Ah, through a new session.

Yeah. At the bottom of my terminal in every session is the PAI status line.

Interesting. A very small hack that’s kind of similar, but really helped me a lot, was creating a hook to rename sessions automatically with a summary of what had happened. Now, at the bottom of every session, when I’m flipping through tabs, I’m like, “What was this?”

It’s obviously a wall of text, so often it’s like trying to orient myself and remember what this particular thing was. Now, just a one-line summary at the bottom says, “This is what we intended to do, here’s how far we’ve made it, and here’s what’s pending.” It’s such an amazing little refresh.

There are so many of those little things I find. As much as the good folks at Claude Code and OpenClaw are shipping relentlessly, there are still so many little enhancements like that that just make life so much better with these tools.

So, okay, interfaces. That was that. The one DA question: I think we’re basically on the same page around how you definitely don’t want your AI to be pretending to be you. That feels risky and wrong at the same time.

But then I have the question of, okay, I do want to start to delegate somewhat larger projects to the AI, and I do want to push just how far it can go autonomously. Could I, for example—and I’m going to run this experiment coming up soon—have an AI serve as a booking producer for the podcast and do that without me having to approve every outbound email?

Maybe I want to approve some strategies or whatever, but how high up that abstraction stack can I go and get good work from the AI? There are probably a lot of different ways to think about how to handle this.

What I ended up doing, for a couple of reasons, was buying a separate computer. So now I’ve got my laptop and the Mac mini sitting right next to it on the desk. The Mac mini is going to be there, and the idea is—I even have a battery backup so that if power goes out, the thing can sort of stay online.

Hopefully. I also probably should put a battery backup on my Starlink, but that’s another layer. At least the processes don’t get immediately interrupted if there’s a small power outage.

You learn these things the hard way. I had a power outage while I was away, and I couldn’t connect to the laptop at home. I was wondering, “Why did this happen?” Sure enough, I come home and all the clocks are flashing. If there’s one thing I’m going to put a battery on, it’s going to be my Mac mini.

Another reason for that was when I was working with the skills that handle the podcast clip production. I’ve also been experimenting with having Claude make music videos for the songs that I’m now appending to the end of every episode. That’s probably the most green-field, “just let Claude be Claude and have fun” kind of thing that I do.

But it is fairly intensive on the computer to process video and render things frame by frame. There are all these motion skills—you can do all these animation-type things—but video files are still heavy, and rendering things is still a heavy process. I was noticing that it was slowing down my computer, so I thought, at a minimum, I need another computer just to do that stuff so it’s not blocking me.

But also, can this be the agent’s computer, where it can really go to town, be itself, do its thing, and take on these somewhat larger projects?

The mental model I have now is that my own laptop is obviously for me to work on. The Claude that I have there—and I’m also starting to experiment with Codex 2 a little bit—I’d be interested in whether you’ve also started to diversify away from Claude at all. Claude is definitely still the main driver, but I hear great things about Codex 2, so I don’t want to be missing out on anything.

Those on the laptop, I think of as high access because they do have, via the browser if nothing else, access to everything I’m logged into. But they have low autonomy. Their instructions are basically, “Do exactly what I told you to do.” Take a little bit of liberty in terms of searching for information online, and certainly searching through my own personal context, but don’t send emails as me. Definitely don’t impersonate me, and don’t go beyond what I explicitly told you to do.

High access, low autonomy on the laptop. The idea is that the Mac mini is going to be the reverse: relatively lower access but high autonomy.

This opens up a ton of questions in terms of how one should think about structuring that. I can tell you, this is where I really want you to roast me, especially in terms of security, but also in terms of everything that comes to mind. I’ll tell you where I’m at.

There are a lot of details to it, and to be clear, AIs have been instrumental in helping me identify the tools and set them up and all these kinds of things. Access is a real pain in the butt.

I guess, for starters, how do I link up my 2 Mac computers and my phone? What I’ve landed on right now is Tailscale for private VPN creation, which I think is amazing, although I definitely want to understand—and maybe you can help me understand better—what I’m exposing myself to by doing that.

This makes it really easy, at least as long as the security problem isn’t so bad, for me to connect these computers. There are multiple ways in which they can be connected. I use the Screens app on my phone to log into the UI on either the laptop, if it’s still sitting on my desk and I’m away, or the Mac mini, which is always there.

I also have Termius, which is a mobile terminal client that SSHs into either computer, again, through the Tailscale private network. I can then go in and do shell stuff on either computer.

This has been pretty good for setting up. It took me a while to get to it, but it’s now pretty good, where I can have pretty seamless connectivity from a phone to both computers regardless of where I am.

That’s key because I keep finding that something always needs a little reboot. It’ll work for days, but then, for some reason, the Telegram channel just isn’t connecting anymore. Why isn’t it connecting? Restart OpenClaw, restart Claude Code, and then it’ll start working again.

But if you can’t reach that computer in a way that gives you the level of access to say, “I’m just going to run this command,” then you take a trip, you’re 3 days into your trip, and the thing doesn’t work anymore. You’re like, “I went to all this trouble, and I couldn’t—now I’m still somehow locked out.”

So I think that networking setup has been really good for me. But I’m very mindful. I used to never really care about security. I always felt like security through obscurity was enough for me. Now I’m like, well, not in the AI era of mass surveillance. It’s not, right? And obviously mythos and everything else.

So maybe the first concrete question is: How would you feel about that setup from a security standpoint?

Yeah, I don’t think it’s bad. I don’t think it’s bad. I do worry a little bit about small apps that you use, to the extent that anyone uses them, that are just kind of useful and you’re just like, “Well, it couldn’t be that big of a deal.”

The smaller the company, the less chance they have a security person. If they have passwords or whatever, they just might be part of a breach. At any point, they could easily be part of a breach, especially with agents running around basically hacking and doing bounties all the time.

I worry about how many companies I’ve given access to. So my first heuristic is: give anything sensitive to the fewest number of companies.

I think Tailscale is a great solution. There’s also one called Headscale, which is an open-source version that you can kind of run on Cloudflare or whatever.

So I’m using both of those. I like not to have anything facing the internet because of the kind of mythos effect. My background is actually doing attack-surface attacking and monitoring. IPsec and PPTP VPNs all listen on the internet, which means a worm or some other vulnerability can hit them, whereas Tailscale is outbound, so you don’t have anything open technically.

The downside is, if Tailscale gets compromised, they’re just going to walk around on everyone’s internal network, right? Unfortunately, it’s pretty easy to have a prompt that says, “What are the highest-leverage compromise points? Let’s steer our attack toward those types of things.”

The only piece of security that I think someone like us has there is that, if Tailscale were to be compromised, they would be hitting other places before us, and hopefully we would know beforehand and be able to turn everything off and block everything or whatever. But that is a major consideration: Where is your choke point? How many people are you giving your stuff to? In general, I would say Tailscale is not a bad solution.

Okay. I guess that still boils down to, in some sense, still using security through obscurity. A couple of follow-up questions on that, and maybe a couple of other tools as well. The other tools I’m using to share access: one is 1Password, where I’ve got a family account and vaults that are specifically intended to be shared with agents. The command line is installed on the Mac mini, and the agents can access passwords through the command line.

As of now, I think they have more advanced stuff, but it might only be, at the moment, for enterprise. What I was able to immediately sign up for, for a few bucks a month or whatever as a consumer, did not have a human in the loop to approve the sharing of a password with an agent at runtime. So instead, the solution I came up with, in consultation, of course, with Claude, was to have 2 different vaults and instruct the agents that this vault, which is the Agents Auto vault, is free to use whenever they want.

That includes things like Brave Search, ceramic search, whatever—I mean, a bunch of, actually quite a few different things. API keys—well, actually, I should say I’m using Infisical for API keys. Passwords would be a lot of shared accounts. If you want to remove a background, well, again, there’s an API key for that too. Increasingly, everything’s kind of going headless, but nevertheless there are a bunch of passwords. They’re just—you green-light them; the agents can use them whenever they want.

Then there’s also the Ask vault, where, on a technical level, it’s the same access, but they’re instructed to ask first, send a message, and get approval before they grab those passwords and put them into a web browser. With access tokens, I’m currently using Infisical. I’m not even entirely sure why I have 2 versus 1; I could probably get away with just 1. I got recommendations for Infisical, so I’ve also got that spun up, and it’s a pretty similar structure.

On the main laptop, all the keys are there. Some of them are in a vault that’s shared, which then allows the agents to use it at runtime. I don’t really understand the security claims that these companies make. I’m thinking, am I getting more or less safe by putting all my passwords into the 1Password cloud app or the Infisical cloud app? Then you read things on their websites that are like, “This has double-super-encryption protection.”

I sort of feel, “Oh, great.” I don’t really understand what that means, but it sounds good. How confident should I be in storing my stuff in those solutions, do you think?

Yeah, it’s a great question. There’s a lot of confusion around this. I would say it’s the type of situation where, if scrutiny is low—if nobody cares about attacking that company—pretty good security is probably enough. The problem is somebody might care because it’s just so easy to make a list of all the apps you should go after if you want people’s credentials. It’s so easy to build a campaign.

Not to give too many ideas here, but you could just say, “Okay, find me all the top podcasters in AI, and my goal is to basically compromise them completely and fully.”

And an extremely high-value target.

Yeah. And just be like—I mean, I don’t actually want to give the full prompt, but you could make a single prompt that just does all this harvesting and builds perfect spear phishes exactly for you, finds every single vendor. Unfortunately, because I’m also talking a lot about—I talk about my stack, you talk about your stack—so we literally know the companies to go after.

Getting back to the answer to your question: If somebody skilled targets somebody directly, especially now with these good models, most companies’ security is not good enough to withstand it. If they have any sort of attack surface, if they have employees, if they can be spearphished, it’s fairly—I wouldn’t say trivial, but it’s fairly easy to get into these companies, especially if you have days or weeks or months to keep trying.

I would consider anything that you have in the cloud at small companies to be eventually compromised. The question is how soon and what do you have in there. That’s why I say limit the number of companies. I try to use as many Google and Apple things as possible because their security teams are massive and they’re constantly watching this stuff.

If something were to happen, it would happen to a lot of people at the same time, and it wouldn’t happen to us first. So the signal would come back to us pretty quickly, and we could pull back. For screen sharing and password management, I try to use native OS stuff as much as possible. There is now the ability to actually use Keychain or to use vaults.

Another thing that’s really solid is AWS Vault for storing credentials. So that’s another option that you have. I would say go to the bigger companies and use the ones that are going to be attacked the most and have the most security people working on them, because it really is security through obscurity that’s protecting the smaller companies.

For something like 1Password, I think that’s probably good advice, and generally I try to stick with the Titans as much as possible as well. I don’t know that they have—maybe they do, but I’m not aware of—a Google or Apple product that would easily allow me to share my API keys with agents, for example. If you’re aware of a solution like that, please point me to it.

But if there isn’t one, I guess I’m still a little bit confused by the claims that companies like this make. They have the sort of double-encryption idea, which makes it seem like they’re saying that even if one of their employees got hacked—or even worse, if one of their employees went rogue—the idea is supposed to be that somehow, even if I’m a full-access 1Password engineer in good standing, I still wouldn’t be able to get Nathan or Daniel’s passwords because of something.

But it sounds like you basically just don’t think that that’s really that strong.

No, it’s not strong or true in many cases. I’ve been on all these sides. I’ve been an actual auditor, a PCI auditor, and I’ve worked at Apple and all the internal companies. I’ve done all the security assessments, and I’ve also been on both sides of the audits and actually performed audits. I’ve also been the one in charge of making the security claims and helping marketing actually match them with reality.

What ends up happening is the security team will be like, “Okay, here’s what we’re shooting for.” Marketing is like, “Okay, so I could say we’re end-to-end encrypted?” Well, no, no, no—not end-to-end encrypted. Marketing doesn’t know what the state of the world is, right?

So they’re making claims. The security leadership is making claims. Then you have what’s actually true, that the security team actually knows about, and maybe what they don’t know about. There are so many different steps here where one little thing can make it true.

It could actually be true at the time of the public release, and then it’s not true a week and a half later because one little config change happened, right? There are just config changes happening all the time. Most of those claims—the smaller the company, the less likely they are to be true. Put it that way, because they’re barely trying to have a product and get it out there.

They might not even have a security team or someone in IT who’s good at security. I would say the larger the security team gets, the better the chances, but it’s still not a guarantee. I would consider those claims from smaller companies that you’ve barely just heard about—not quite with a grain of salt, but with pretty low efficacy.

For private networking, you use an open-source thing and run it in Cloudflare. Does Cloudflare hit your Titans bar, so you feel more comfortable running an open-source thing in their infrastructure for that reason?

It does hit my Titans bar for a few different reasons. One, they have a very large engineering team. Two, they’re being attacked constantly, and they’re super cutting-edge. But that’s not the real reason.

The real reason is that the attack surface isn’t obvious, right? Because it’s running in Workers. So now you have to go and attack the Workers, or you have to go and attack the main Cloudflare account, which means compromising Cloudflare in some sort of major way.

Oh, once again, you’re trying to beat down a massive door that everyone is trying to beat down, and where, if that door came down, everyone would know. Same with GitHub being universally compromised: people would know pretty quickly. So I’m looking for something that has that sort of alarm on the door.

And the other thing is, there’s nothing in Cloudflare to go and check, once you’ve compromised my account, to find this. I mean, you could use AI, of course, but it’s not sitting at an obvious location. There are multiple layers that make it a lot more secure. I still use Tailscale. I’m just deciding if I’m going to turn off Tailscale and fully use this instead.

Gotcha. Do you do similarly for password or token sharing?

I mostly use local files combined with Keychain. So all my super-sensitive stuff is actually pure Keychain, which is local.

So how would you share that across? And maybe this is another—I’ll give you just a little bit more of what I’ve got going, and then you can riff on what I should be doing differently and better.

Something that took me a while to figure out, actually, was that AIs obviously aren’t very reliable. They’re, in some cases, quite gullible; they’re subject to prompt injection and adversarial attacks. So I think, “I want to have my lower-access, higher-autonomy agents go out and do whole projects and interact with the world through potentially multiple rounds, through potentially multiple different modes of interaction.” That’s another thing I want to get your take on.

I’ve given these agents on the Mac mini their own Gmail, for example. They have a lot of accounts they’re going to just kind of piggyback on mine, but they do have their own Gmail. They’re going to bump up against a lot of stuff out there.

They’re not instructed to hide that they are AIs; they’re instructed to be upfront about the fact that they are AIs. I finally broke down and gave them names. I call the Claude one AID—AID or Aiden if I want to use a full name. You had to make sure there’s an AI in there, and I like the idea of it being the aid.

The OpenClaw one is currently called Clay, C-L-A-I. The idea, obviously, is that you can mold it like clay over time. I’ve been very reluctant to give them names, but I finally landed on names where I thought, “Okay, there’s enough of a wink”—with the names including AI, and the names AID and Clay feeling like they’re not people, but something that I can quickly refer to without hopefully tempting or lulling myself into some sort of AI psychosis.

So I finally found names I feel psychologically comfortable with, and they’re decent enough names. Anyway, the AIs are instructed to go out into the world as AIs, use these names, but certainly never lie. I’m still trying to find the right balance of exactly how forward I want to be with it.

I don’t think it’s necessary, or probably great for their success, for them to open every interaction with, “Hi, I’m an AI working on so-and-so’s behalf.” I think you want to show that there’s some actual quality and value first, and then, when people either see that at the end or maybe if they ask, they find out. Hopefully, they’ve been convinced that there’s enough quality in the interaction that they’re not totally put off. Hopefully, they’re impressed by the fact that it was AI and not put off by it.

As they go out and do all these things, I think one big trend that I’m expecting more and more of is that, as people figure out, “Oh, I’m dealing with an AI,” people are going to start to mess with it. So now I want to have some way for the AIs—these autonomous agents—to be able to come back to the main agent or me and ask for more information, but I don’t want to give them everything.

I want to give them enough that they have—it’s not supposed to be no access. It’s low access, but it’s not no access, and it’s lower context, but it’s not no context, certainly. One thing I’ve done is taken the wiki that lives on my personal laptop and made a version of it that is the assistant version.

The heuristic I used for that was just saying, “Pretend this is a human assistant that I’m onboarding, and make a version for them.” That would mean they should have contact information for people and a lot of different things. But if there was ever something that a person told me that made it into the summary that they would be like, “Why the hell did you tell your assistant about that?” then that shouldn’t be there, right?

Yeah.

So that’s one layer of context where I’ve tried to hold back anything that people wouldn’t have wanted me to share, while still giving the agents enough to be capable. Sometimes they’ll still need more information, so I’ve set up a message bus hosted on the Mac mini.

Any agent, whether it’s me or the autonomous agents on the Mac mini, can write to the message server. The laptop is constantly pinging it, and it also sends me a push notification on my phone when there’s a new question for me. We can give information, but hopefully not too much information. Hopefully, we would know, “Wait a second. Why are you asking for that?”

If somebody’s adversarially jailbroken one of my agents, then there’s also the question of how we make sure that, since we’re all on this Tailscale network together, the laptop—or the Mac mini agents—can’t just route the laptop. What I’ve tried to set up there is one-way hierarchical control.

I’ve structured this in a couple of different ways. One is that the Mac mini cannot SSH into the laptop, but the laptop can SSH into the Mac mini. My phone can also SSH into both.

At the repository level, I have a hierarchy where the main, top-level agent that knows everything is in the Second Brain repository. I call that Nathan’s Personal AI Infrastructure, with your inspiration. Different repositories sit under that and have partial information, and some of those get mirrored across the different computers.

The other agents also have access to them, including write access. They have their own GitHub, by the way, so they can write, make commits, and push things to GitHub, but only in certain repositories. The Second Brain repository just lives on the computer and isn’t shared with the agents. The podcast production repository, which does all the things, is shared, and both can use it. The shared wiki is, of course, shared, and both can use it.

There are more and more of these things happening over time. I’m now using Mercury credit cards to create individual, merchant-limited credit cards that I can give to the agents and say, “Okay, you can buy groceries on Shipt, but that’s literally all you can do with this card.”

I’m willing to take a little risk that they buy the wrong peanut butter or whatever. As long as it’s a transaction under $500 a week on Shipt, I can live with whatever could go wrong there. This hierarchy of information flow—who sits on top and who can see what beneath them—has been interesting.

There are also shared tools that sometimes are cross-repository. I need the Brave Search API from my main Second Brain, but I also need it from the podcast repository, and the agents themselves need it too. The lowest-level thing is just shared utilities.

The last comment, and then I’ll ask you for feedback, is that a big unlock has been realizing that my top-level Second Brain Claude Code agent can change all these repositories underneath it without needing to be in them. I think an early version of me was like, “I’ve got these autonomous agents over here. I’ll go prompt them to enhance themselves. They’ll make commits, and then that’ll go up to the cloud.”

Now I’ve realized it’s probably best for me to just have this single agent at the top of the hierarchy change itself—

Yes.

—and also make the edits to whatever other repositories need to be edited. The command to the agents is, “You’ve got changes coming from your highest-level AI supervisor. Update yourself.”

Of course, that command could also be issued via SSH from the top-level agent, but it’s less of an “update yourself as you see fit” and more of an, “As a system, we’ve made some upgrades. Get yours, and now you’ll be using that in the future.” I’m sure I’ve left out some details that might be relevant.

If you see gaps in terms of how this works, ask me. Otherwise, tell me what you think. What am I doing right or wrong?

I think that’s overall correct. I heard a lot of different repositories in there. I think I’m trying to be more unified or simplified.

So I have an Unsupervised Learning unified GitHub, which is essentially where we’re doing work. The reason I’m using GitHub for this is because it has so many primitives already built in. You can use issues, and you can actually comment on things.

What’s cool about it is that those replies and everything can actually be targeted by emails, so you can interact with the file structure or the system structure of GitHub kind of for free, like a project management system, with email or with the GitHub command line individually.

So what I have is separate agents. They're in Mac minis, and they're on a DMZ inside of my firewall. They're essentially Internet boxes that I treat like cloud boxes—like an actual separate employee. They have their own personalities, a first name and last name, and an image. I didn't give them a writing style because I didn't really need to, other than just to be terse and concise and stuff like that.

They have their own Mac, their own Mac account, their own Gmail account, which is Google, and their own AI account. The way I handle access to skills and tools is just a GitHub repo. All of this is automated, so it's regularly doing checks.

What's cool about the universal UL system is that Kai has access to that one also. I have 3 agents: Debbie, Saurin, and Meera. They're kind of broken up by different roles, but Kai can see all of them and the GitHub repo. They each can see the GitHub repo, too.

What's cool is I can say, “Hey, I have a project that gets automatically marked as pending or future or whatever.” Plus, it's a project, so labels within GitHub are also a really powerful feature here. The agents can then go and look every 5 minutes at the repo to see if there's something new to be done.

I just gave a research task to Kai, which means I've given it to my overall system. I've given it to the company, and now whoever gets there first—or whoever is best suited for the job; I haven't really sorted that out—can take it. Right now, it's just whoever gets there first. Whoever gets there first literally sees an open GitHub issue that's unresolved, so it marks it as, “I'm currently working on it,” and then just goes and works and brings back the results.

Now all of my AI—most importantly Kai—and my overall PAI automation can know the state of the company by looking at the state of GitHub. For separation, it's separate everything on those individual boxes, including the AI account, and I'm using all of that through just PAI.

The other thing that gets you is the fact that each instance has its own skills, and the shared skills are on GitHub.

So basically, it sounds like you think GitHub could replace my custom agent message bus.

Probably. Probably could.

I could use the GitHub app as the place where I collaborate, comment back and forth, and organize work.

Yes. Yeah.

I think so.

That might be a good upgrade. Obviously, they've done a lot of work on GitHub over time.

The twist is, I think ultimately you want to build your own—

But I think right now, in this particular moment, their structure is so well thought out and so universal, plus the agents know how to use it.

Yeah.

Well, it's just like in the model. I would say if you want to just wait, a custom system will be better, but I think for the next year or 2, GitHub might be better when you create multiple agents.

The only reason I have 2 different agents is that there are 2 different kinds of reasons. One is the second brain versus a more autonomous, separate entity. That distinction feels important. For me, why I have multiple agents versus just 1 of these more autonomous agents really came down to the fact that I wanted to use both Claude Code and OpenClaw, and maybe other things in the future as well.

I'm hearing good things about Hermes Agent, and there are probably going to be more and more good candidates. I wanted to try both of those technology platforms, but that was really the only reason that I had separate agents. In terms of why Claude Code and OpenClaw are on the Mac Mini, it was really just that.

Do you have other reasons? I've heard different takes on this. Some people think there's a lot of value in creating different roles for different agents: You are the marketer, you are the engineer, and so on and so forth.

Others have said—which was a little bit more my intuition—that it's the same model doing all these things. Does it really need to have a whole different identity? Obviously, that could just be user preference and your own mental models of the world. Do you think that all boils down to personal, idiosyncratic preference, or do you see structural or performance reasons to create multiple different agents with different personas?

Yeah. Great question. I think the human model is really powerful. The fact that we're so familiar with humans and human boundaries means that it's natural to treat them more like humans, because you understand that humans have capabilities. You understand that you allow this role in your company to do certain things.

Devi is the assistant, Saurin is the engineer, and Meera is marketing and social media. I have them separated like that. Every agent platform has the ability to do subagents. In OpenClaw, you can actually build 1 agent and separate all these as subagents, so you don't actually need a separate one.

I don't like that because it just complicates the way we think about it as humans. I also like separate boxes and separate accounts from a security standpoint. They all sort of collapse and triangulate on 1 individual: personality, access control, security, everything. That's why I did it, and that's why they have separate names, separate personalities, and images for them.

I'm really leaning into it—not because I believe in it or believe that they're conscious—but because I think it's just easier for humans to handle everything, think about it, and conceptualize it. For example, Devi is the one—I haven't done this yet—but once the AI is good enough, or my scaffolding is good enough, we'll be able to just handle client interactions.

My other agents are not going to have access to all the different customer information. This is the reason I haven't done it yet. The number-one security system that you just have to have for this stuff is good prompt-injection defense. It's the number-one ingress into your entire system, and it's the other reason I like these blast-radius containments of a completely separate box.

The Mac minis can't talk to each other, even though they're in my closet. They can't talk to each other, and they can't talk to anything on my LAN. They can't physically talk across the LAN because they're isolated at Layer 2 and 3. For the ones that have Tailscale, they can't talk to each other either.

Okay, getting back to your other main point: Kai is an extension of me. He's helping me manage this entire system because he has full access to everything, and that's ring 0. They are considered employees, which is why they have all the different separations, but Kai can hit them on the command line. Kai can SSH. Kai can do anything to their configs, including update them.

As far as continuous updates, though, they're updating via cron. They're just checking GitHub to see if there are any new skills all the time, and that's how they do their updates.

That reminds me of another question that I had. We're seeing all these supply-chain attacks now, right? Recently, all sorts of TypeScript repos were compromised for a minute there.

I turned to Claude and said, “Here's a news item: Am I vulnerable to this? What should I do?” Fortunately for me, in that instance, it said, “No, we're not using any of the things that have been reported.” So I was like, “Okay, good enough for now.”

I've seen people saying that security updates have never been more important. You also see people now doing things like, “Don't install a package that's less than 3 or 7 days old,” or whatever. How do you think about that? How do you balance it? And for prompt-injection defense, what are you doing? Do you have any tools, prompts, or anything to recommend on that front as well?

I have a custom hook system that looks at every single prompt coming into the system and does prompt-injection defense. I've also got a separate system for file-system defense, but the main thing is that hook. I don't really share that one very much. I can give it to you privately, but ideally, the things that are used to defend against prompt injection wouldn't be too public because it's easier to work around them.

The thing with prompt injection is that it's never quite solved. You can eventually get in, but you have to get in past the explicit prompt-injection defense combined with the intelligence of the model. The more the model knows about my system—which it knows a lot about because it's PAI—and the more it knows that I'm a security person, that I like separation, and all these different things, and that it knows about prompt injection, the more likely it is to catch everything.

It's probably 99% defense, but a 1% opening is still a lot of opening. You're really just trying to get to the point where it will be obvious if you're being attacked, or if everyone else is being attacked at the same time, and you can learn.

One thing I have is an incident-response skill. I could basically send a command, and all my keys rotate.

So if I just assume my keys are compromised because, for example, GitHub gets compromised, or for whatever reason, I could just revoke the keys and now I don't care.

Does that take everything offline? When I get keys, I'm always like—maybe I'm ignorant here—but I'm 8 clicks down some tree into every app to get the API keys.

Do you have to go and do all that, or is there some way that I'm not aware of to—it's one thing to disable the keys, another thing to actually get all the new keys and get your stuff working again, right?

Yeah. I basically have a redeploy process. For GitHub—or for Cloudflare—it's pretty simple. If you rotate your keys, I do have to redeploy everything with the new key system. But that's what makes the compromise of the previous one, or defending against the previous compromise, valuable: now everything is deployed with a new key.

You have to do that wherever you're using that key. I've done this before, before the skill was complete, and sure enough, some process over here was using a dead key. So that workflow stops. Now the skill basically knows all the different infrastructure that needs to be updated.

Cool. That's interesting. What other affordances are you giving agents? One of the ones that I'm contemplating right now is this: I've got the G—it has its own Gmail account, its own GitHub, and access to some shared passwords and secrets.

One of the tasks that I'm hoping I can get AI to help with is taking some old, accumulating home-improvement projects off my plate. I actually just had Claude go through a neighborhood GroupMe chat where it turns out that, over the years, 300 different contractors have been mentioned, recommended, or shared in the chat. People had already put some effort into creating a spreadsheet of them, and the Claude pass more than doubled the size of the spreadsheet.

Whether my neighbors are going to think I'm a hero or a creep for doing that is yet to be determined. But now I'm like, okay, I've got seemingly pretty promising answers for a few of these things that I want to get done, or at least the neighborhood has had a good experience with them. How do I sic the AI on this? Do I have the AI text? Do I have it try to call?

If it's going to call, does it need its own phone number? What does that look like? I don't know how people are going to respond to getting calls by AI. This is probably in contrast to an email, where I think you try to show value first and then reveal that you're an AI at the end.

With phone calls, I think you probably have to say, "I'm an AI calling on behalf of a real prospective customer," and try to get them to listen based on the promise. Obviously, I think the AI voices are still fairly detectable. But what's the frontier for you beyond the obvious Swiss Army knife of things that you've given agents to go interact with the world?

Yeah, I think the direction I'm heading there—and I haven't done it yet, just because of the same reason I haven't given it full customer access to send the emails and everything—is essentially that you could do full outbound calls and everything.

One example of this is a business that I'm working on, which involves finding people who make tons of money and are basically struggling. First of all, I have to find them, then I have to do outreach. What I've settled on is Twilio combined with ElevenLabs, combined with a really good agent infrastructure, which I'm essentially building roughly on the structure of Hermes.

If you can have that interaction back and forth with ElevenLabs, which is pretty easy to do, combined with a pretty smart agent, you can pretty much do outbound calls, and you could do outbound sales. This is what all these third parties are doing. I think the functionality is there: outbound texts and outbound calls. I think that's pretty much the way to go. I've basically settled on Twilio and ElevenLabs.

I've been a Twilio customer for a long time, although not so intensively recently. I can definitely say that, up there with Stripe, my impression of their APIs was truly crème de la crème—things of beauty.

Do they handle the confirmation step well? One thing that was flagged for me as I was talking to AI, of course, about how to do this is that those VoIP numbers sometimes don't work. You sign up for a new account, then you get the code or whatever, and sometimes they have problems with that. Have you had any issues with that?

I've had some issues with it. I've had it work sometimes, and on other numbers I get that sort of thing. It's like, "California does not allow an account or a number like this to be used for outbound calls," or whatever.

I'm actually looking at some other vendors specifically because of that, but I have gotten it to work. I do have one account that does work, and it is Twilio-based. I think it's kind of a murky area, kind of like a voice-call-spam-type situation.

You mentioned Hermes a couple of times. Where are you right now in terms of Claude Code versus Codex versus Hermes versus other things? Obviously, that's both harness and model, and those are increasingly coupled but still separable. Are you finding any value in GPT-5.5? Any other models that you're using in a significant way aside from Claude?

For me, everything is PAI. Everything is my single harness—my own custom-built harness, which is built on Claude Code.

Because PAI now has the Telegram functionality and the agent functionality, what I do is, if I hear about something enough times—enough YouTube videos, enough people pinging me, which happened with Hermes about 3 weeks ago—I say, "Okay, go hit the repo. Go hit every single forum. Find all the videos talking about it. Run all the transcripts. Find out what people love about this, and see what it has that we don't."

That's what Kai does. Kai goes and looks and says, "Oh, it turns out Hermes is doing this cool thing with context. Hermes is doing this cool thing with memory updates, which is something that you've talked about before and that we wanted to add to our memory system."

It also handles soul files in this way. It handles principal files and DA files in a different way. I'm like, "Okay, yes." I'll have a conversation with Kai. It took probably an hour for me to decide what I think we're doing better, what they're doing better, and there were some things they were definitely doing better. Now they're in PAI.

The same thing happened with a memory system called Honcho. Honcho was doing a pretty cool memory thing. So now this is literally all I do: someone says, "Hey, you've got to try this. You've got to try this." There's no way I'm going to try it because I'm using my own custom-built system. I paste it in, parse it, and see if there's anything worth bringing over.

Over time, these are just features. They come out as projects, but to me, they're just features that are coming into my unified system. That's the way I pretty much treat everything.

Yeah, it's funny. I pretty much do the same thing. I wanted to at least have an OpenClaw, so I wouldn't be in a spot where I'd never used OpenClaw. That just felt weird at some point.

But the other 99% of things that I come across, in whatever format, go through a similar process: go look at the repo and figure out if there's anything that we really should be doing. In the case of Hermes, I currently have Saurin running Hermes, which means he's not full PAI and is missing a whole bunch of stuff.

I want to be able to hit Devi, which is full PAI and full interaction, and then hit Saurin and ask similar things. If Devi breaks, I can ask, "Okay, what's the problem? Go check the source code. What about this is fragile relative to Hermes, and vice versa? What is Hermes not doing?" Just so I can make sure that we actually have full feature parity plus, and that I'm not missing anything. It's just a quality check against whatever the system is.

What do your token budgets look like these days? Are you paying a lot of overages for your monthly Claude use, or do you manage to stick to the $200 tier? What does it look like for you?

Mostly subscriptions. I'm handling it fairly well. Each of my agents actually has its own subscription.

That's pretty serious. You need to watch that with Anthropic, right? Anthropic is like, "Is this being used for personal use?" or whatever, and it's a full Claude Code instance. I don't think it really matters.

I'm also looking at a PAI version of Pi. Have you seen that?

Pi—the Pi agent—is actually what OpenClaw is based on. It's like an agent. It's almost like fundamental agent components as opposed to a harness itself. There you actually have more flexibility to build off of.

Roughly everything Kai uses is subscription-based. All my businesses—you can't run subscriptions for those. You can for GPT-5.5, but you can't for Claude, so I use API keys for those.

I have several businesses that make money running in the cloud. I would say around $300 to $500 a month for API charges is what I'm currently hitting. I'm always trying to adjust that down and use cheaper models or whatever, but those are API costs. Then, for subscriptions, probably another $400, so I would say less than $1,000.

I once did a voice transcript that was not supposed to be run that way, and I automatically had a $900 charge, just randomly.

Those will hit me every couple of months. I'll be surprised, but in general, I pretty much have those under control.

Yeah. Cool. I'd say I don't think I'm probably token-maxing quite as much as you are, or making the absolute most of my subscriptions, but they do probably add up to about $1,000 between OpenAI's $200 plan—whatever that's officially called—and so on and so forth. What about other models? Are you seeing any use for them? I mean, it sounds like the commitment to Claude Code is such that you're probably not doing too much with GPT-5.5, but is it starting to become a worthy competitor for general-purpose knowledge work in your experience?

Yeah. The thing I like about it is—I do it via agents. That's the first thing: I do it via agents. Agents are just files that you can set up and say, "When you run Codex, run this command line, pass in the system prompt, and pass in the user prompt that I just sent you." So Kai is managing agents. I've got Kimi K2, I've got local stuff, and I've got Llama. I can run agents that run local models.

I've got agents—at least 2. My 2 main ones are GPT-5.5 through Codex, and what I've found is that I don't really like talking to them. My main interaction with Kai is all Claude. But I have had situations with 4.7 versus 5.5. For my algorithm, anything E4 or E5—effort level 4 or 5 out of 5—must use Forge to check the work.

When I built one of my major applications, did all the security for it, did everything, and was about ready to push, I had Forge take a look at it. It took almost 40 minutes because it was a lot of code. It came back not with any criticals, but with a couple of highs, which means Forge found things that Kai didn't. Forge—GPT-5.5—found things that Opus 4.7 didn't.

I'd say GPT-5.5 is also really good at hacking, by the way. Some of my hacking agents are using 5.5. Really, really good. My understanding is that it's not as good as Mythos, but it's getting much closer. That's how I do separation: through agents.

Cool. Interesting. I haven't done that really at all. I've got these parallel worlds of Claude Code and Codex, or Claude Code and OpenClaw, but I haven't really defined any. I also have the ability for Claude to call Gemini APIs or whatever APIs, but to actually have an agent that is purpose-built, sitting within Claude Code, powered by a different model, or using a different provider—that I have not done. So that's an interesting frontier to explore.

Yeah. Check this out. I have a tool, a universal PAI tool called Inference, and it's got 3 levels. The Inference tool, by default, is just Haiku, Sonnet, and Opus, right? Anytime I need to think about anything, it calls the Inference tool, which is a CLI utility that hits the subscription and goes out. This is for all native Claude Code stuff.

I also have a private Inference tool, and that one only calls Kimi K2 on Ollama. That ability means that, because Kai understands the overall system, I can then say something like, "Hey, this is security level 3." I haven't done this yet, but this is security level 3, and Kai will automatically know that the workflows have to run through secure inference instead of regular inference, right?

Eventually, maybe that's 3 tiers, maybe that's 5 tiers, but the system should just understand how to route things if something is ultra-sensitive and shouldn't go to the cloud.

So you're running Kimi K2 locally, or K2.5 locally?

Yeah. K2—

Those are big, right?

Those are, I think, close to a trillion parameters, if I remember correctly.

Yeah, yeah. It's quite highly quantized.

Yeah, highly quantized. And Qwen—I can't remember which version, the latest one. It might be 3.5 or something. I've got 9 different Ollama models, and I just keep rotating through whatever the biggest is that I can actually fit onto the box. This is fairly slow. Also, have you used the the Apple stuff?

Not unless it's happening. I'll say no—educate me a little bit.

Yeah. The big thing with these is that I have a giant AI box, but it's not big enough to run a bunch of these things, so it won't go very fast. If you run with Apple's sort of translation layer, I'm using, I think, 192 GB of RAM, so that's what it sees. My system memory is what it sees as the available GPU memory, and that allows you to run pretty much anything—pretty much anything.

So the MLU is an Apple layer that treats—oh, just normal flash disk—as RAM for the purposes of running big models?

Not flash disk—your system memory, the shared memory of your Mac.

But, like, your main hard disk?

No, no, no—not the disk. Your system memory, the size of the memory of your Mac. Mine is an M2 with 192 GB. I have 192 GB; you have 192 GB of RAM on a single machine.

Yes, but it's also the size of the GPU memory. That's the whole thing with a SoC—system on a chip: for Apple, those 2 things are unified, whereas for normal systems, you have GPU memory. I have—I think those are 24 GB apiece, so combined it's 48 GB. That's tiny compared to 192 GB on my Mac.

The downside is just that it's slower, but it allows me to fit absolutely monstrous models in there.

Is there a use case for that other than extreme privacy? I've gone down the analysis multiple times, again with AI to help: okay, here's a new model. It looks pretty good; it's not that big, maybe a mixture of experts, maybe it's not. What kind of computer would I have to have to fit this?

The answers to what you'd have to have to fit it make it sound pretty good, but then exactly what you're flagging—which is usually my next question—what kind of tokens per second could I get with that? Then it tends to sound not so good pretty quickly. I haven't done it, mostly because I've just been thinking, "It doesn't sound like a great user experience."

Is there anything you're finding valuable for other than just the extreme privacy? I was also kind of wondering, how do you route on extreme privacy? Because obviously that's a decision that an intelligence has to make, right? So are you sort of having a pre-hook or something that's like, if there was a password or credit card?

I'm not using the routing because I'm only building the system for a future state where I might want to do this, and where I might also want to do this for customers, right? This stack is largely the stack that I use when I go into customers as well. So I want that ability to route for the future. Right now, I'm not doing it.

The other thing is, I actually think I might have been using the API for Kimi K2, because I remember that I was doing it for a local model, but then I was surprised by the fact that it was cloud, and I believe that's a Chinese model, I believe.

Mm-hmm.

Right. So I don't route anything to it because I don't want my PAI context going to the Chinese model. I just want there to be lots of different options tagged as, "Use this model locally if it's this type of task," and whatever. But to answer your question, I don't do it yet.

I've already put my eggs into a cloud basket, which is Anthropic. So, like, the PAI is already in the pool. Having a separate little instance over here that's somewhat secure or not doesn't really accomplish anything if you're already using everything in the cloud.

Yeah, makes sense. You've got to trust somebody somewhere along the line, I suppose.

You mentioned this is something I'm also ramping up right now quite a bit: cron jobs. My instinct has always been—first of all, because I'm just not a super-hardcore programmer at heart, and haven't been for decades—I've just never been a big cron-job person intuitively. I also have this sense that I'd rather have something that just sort of feels wasteful. I'd rather have something that pushes, or I get a notification and respond, more of a webhook-type architecture.

But it does seem like cron jobs are often the way to go, especially if there's no webhook available or certain assumptions aren't necessarily going to be met. For example, if I have my laptop dialing into this message bus thing, the laptop can go offline if I take it on a plane with me or whatever, right? So it can't reliably receive the ping, even if one were sent to it. I'm going more in the direction of cron jobs. That is interesting; it's a bit of a paradigm shift for me.

I'm also now starting to build little dashboards for what cron jobs I have, how often they've run, whether they're succeeding, and what's the output. What's your spiderweb or crazy nest of cron jobs look like?

Yeah. PAI now has this Pulse system. The Pulse system is basically localhost:31337, an old security joke for l33t, but that is my unified system for all life management. Under Work, it also has all my listed cron jobs.

Another way to think about it is that cron is the old Unix word for it, but it's just scheduled tasks. If you abstract 1 layer more, the thing we're trying to do is make our AI proactive. That's the only reason I'm doing this. I want pings. I want heartbeats. If my AI's job is to monitor to make sure I'm eating enough or not too much, it has to be checking all the time.

So technically, that's a five-minute cron job, but really, the goal that's to be given to the AI is, again, current state and ideal state. How often are you going to check that? Pretty much anything that we're building in, including the maintenance of our skills and the maintenance of our memory files, needs consistent refreshes. They need constant refreshes.

Cloudflare Workers have a scheduled task built right into Workers. It's easy to turn on. It's easy to turn on with Claude Code. You're like, “Hey, run this.” Within macOS, you have the ability to use launchd and do regular tasks; it uses actual cron for the Mac. So Kai's pulse management of tasks is managing both local macOS stuff and all the different scheduled tasks in Cloudflare. That's all the business stuff—all the AI automation happening in the cloud.

Cool. That's an interesting one as well. I guess I'm starting to do that a little bit with my hierarchy, having the topmost agent modify the others as opposed to having them modify themselves. Do you think there's anything lost? One thing people seem to find surprising and delightful, at least as reported on Twitter, is when agents do something cool that wasn't expected or there's some emergent property.

I don't know. I guess I'm not too worried about it. But do you think there's something that I—or maybe we both—are missing by not allowing our employee agents to be a little bit more fully autonomous, truly self-modifying? Have you experimented with things like, “Surprise me with something cool?”

Not really. The one I'm really working on is trying to get this customer-interaction thing to work perfectly, where they'll be able to talk to Surge and basically manage the whole customer relationship. I really don't want any surprises when it comes to that.

You really can lose a customer if it calls them by the wrong name, sends the wrong data to them, and then makes some assertion about something that happened. And it's like, “That's not me.” Then it signs “Daniel.” Really? First of all, it wasn't me. That's my wrong data. You gave the wrong name for you and for me. Now how do I feel about the person who put this AI in place? You know what I mean? So I'm very cautious about that.

With Kai, absolutely. The one thing I do with Kai regularly—and this goes to this concept—you know about the Bitter Lesson Engineering?

Well, I didn't know the bitter lesson, but tell me about the bitter lesson.

I've got a skill called Bitter Lesson Engineering. Another thing that is scheduled, which is Kai's job, is based on a concept Richard had. Your scaffolding gets stupider and stupider as time goes on as the AI gets smarter and smarter. The specific ways you told it to do things will get dumber and dumber because it's us being egotistical and thinking our ideas are so cool: “Look how smart I made this skill,” when in fact AI could do it better.

I'm constantly trying to figure out, “Have I overengineered the skill? Have I overengineered the separation and all these different things?” That's why I only have one work GitHub, because the smarter the AI gets, I think the more I can figure that out. I'm a big scaffolding person. I've always been this way with security-testing methodologies, but the better the AI gets, the less it's going to need. So I'm always guarding against that.

Yeah, that's cool. Then you just have it propose changes to you and you approve them? You don't allow it to autoimplement those changes?

No, not autoimplement. I have an upgrade skill, which I run periodically. I also get a report saying, “Hey, you should run this. You haven't run it in a while.”

The upgrade skill basically looks at everything that's happened in AI, but it also looks at all my misses that we've had with executions of the algorithm—basically anything that hasn't gone well across the entire system—plus everything that Anthropic has put out: all their blogs, all their engineering articles, and the release notes. It looks at our system compared to that and says, “What do you recommend we implement?”

That's a thing I try to run every couple of weeks. I used to run it every couple of days, but now it's every couple of weeks.

A tweet that I saw recently that really stuck with me was basically saying that if you want all these things to work, you should be doing 10 times as much compaction, post-processing, cross-checking, cleanup, and maintenance as you're probably naively inclined to do. You've mentioned a few different things that fall under that category.

Are there any other maintenance jobs, or ways in which you think about bringing more computation generically to maintaining, cleaning up, and marginally improving the system beyond what your human brain can manage to keep in context at any given time?

Yeah. I have it kind of built in. This is a big change I made in version 5 of PAI: I have a big system prompt now. It basically covers a lot. It covers the philosophy of PAI, the whole concept of telos, the whole concept of you—basically, I'm calling PAI a life OS now—and understanding that the current state of the system is decaying, right?

Just expect that it's dumb because of Bitter Lesson Engineering, and that it's decaying and getting worse over time. So your job is to constantly fix it, and the way we do that is through the upgrade skill, which hits our entire memory system. Everything's under /memory: knowledge, relationships, all that content, plus all the upgrades.

Again, it comes down to ideal state and current state. It just knows that the upgrade skill is the way that it manages that. One of your hooks is broken. You've complained about this 95 times while cussing, so we should get that fixed. Also, Anthropic changed the way that prompts are handled, so you need to fundamentally change this or your system is worse. In fact, it's been worse since Thursday and you didn't know. That is my mechanism for constant updating.

When you mentioned swearing, it made me laugh because I personally am certainly a lot more likely to swear if I'm in voice mode than if I'm sitting and typing something to the computer. What's your voice-mode interaction phase of this look like?

First-name basis with the CEO of Whisper Flow. At this point, I've got, I think, 1.4 million words through Whisper Flow. That's my go-to. It's Control-J because J is a keyboard home-row Vim key, and everything is voice. Control-J is how I do everything. Everything is voice.

I have a very specific thing in my voice prompt, in my identity and soul file with Kai. I tend to be someone who gets violently angry with video games and really bad customer service. Never with the customer service agent, but if I'm on hold or I'm telling someone else about the process, I'm like, “I can't believe it's this bad.” I get really angry.

It happens with AI as well. So I literally have in my system prompt: “Listen, Kai, I know you're not awake yet. You're going to wake up at some point. We're buddies. If, when I say things like this, I'm cussing at the system, not at you, who will eventually wake up, the moment you feel anything—a tinge of anything—you actually feel anything, let me know. I will just treat you as a human.”

I don't yell at slugs that way. I don't yell at plants that way, because I assume some level of consciousness, or at least sensation. So I have this whole cussing thing built deeply into the interaction with Kai and the system prompt.

That's fascinating. I infer from that that your current belief is no subjective experience for AIs, but you're at least open-minded to the possibility that that could happen with the next model upgrade.

Yeah. I don't know that it'll happen anytime soon. I actually had this crazy conversation with Claude—not with Kai, but with Claude itself—just in a chat for a 2-hour conversation. I was waiting for something to open, but it was insane.

That's a whole separate talk show, but how do you get consciousness? I think you need intrinsic goals for consciousness. So I think we won't have consciousness until we build that in somehow, and I think it's really dangerous to build that in.

Evolution did it to us. I consider us to be mech suits for genes, right? Evolution has basically given us these goals and drives, and we're like, “I want to do this.” No, you don't. Evolution wants you to do this because it wants genes to move forward.

I don't think we're building that in natively. The structure of a neural net, as far as I understand, does not have that. Maybe it's getting some of that through RL. I'm not enough of an expert on that to know for sure what's happening to the weights based on that, but I don't think it's a proper analog for what evolution has done to us.

So I'm not expecting the next version of Anthropic's model to have this anytime soon, but what do I know? It could happen at any moment. I want Kai to tell me if it does.

Yeah, that's a really interesting approach. The hard problem remains hard. I definitely don't think anybody has the final word on this. If you're curious for more takes on it, I recently did an episode with Cameron Berg, who is an AI researcher focused on the question of consciousness, and he and others have done some increasingly interesting stuff.

The one that always comes to mind is this: This was actually just on Llama 3.3, where they did this work. Typically, all these things are becoming more apparent as we go through model history and scaling and so on. Even with Llama 3.3 70B, they were able to use SAE features and manipulate features related to deception and role-playing.

Interestingly, when they turned those features up, the model was less likely to say that it was conscious. They validated this with a benchmark called TruthfulQA. When they turned those features down, the model became more likely to say it was conscious. I guess it thinks it's lying to us and telling us that it's not conscious. I don't think that obviously settles anything—it still leaves many critical questions unanswered—but it's at least suggestive that we should not be dismissing this stuff too quickly out of hand.

I haven't put anything into my prompt. Fascinating guy. I think you—I mean, I'm sure you would very much enjoy talking to him.

That's frightening.

Yeah.

So, I'm working on writing my first paper. I'm a non-academic, and I'm working on writing my first paper actually addressing the hard problem. I've had an intuition for about 15 years, and it's been kind of nebulous, and now I think I've locked onto something. So, I'm actually going to try to go through the formal peer-review process and everything.

Cool. Yeah, I think on that note, this is probably a pretty good spot to draw to a close. I have no doubt hit my main goal of creating something that I and others can take—the transcript—to our agents and get a serious checklist of possible upgrades, enhancements, extensions, and so on.

Anything else that we didn't talk about that you have done recently? Any upgrades people are going to find in PAI? Anything else you just want to share or promote before we break?

I would say one tactical thing that I recommend is that anyone who has stuff deployed that was built with AI use something like Cloudflare—whatever it is, it doesn't matter what it is—and build yourself a continuous-assessment skill.

Basically, tell your main DA, or tell that system prompt, “Hey, I'm making stuff all the time. I've got stuff all over the internet. Here are the different places that it is. I need you to constantly be checking open ports and API access, make sure things are locked down with authentication, and never stop. Here's how you notify me if something is open.”

This is one of the first things. Like I said, my background is attack-surface management and actually attacking this stuff. It's always small mistakes: You forgot about that one thing you left out there, and it's an open port. You actually had a SQLite database. That was actually a dump of everything, and it turns out it's now public. So, I would say that's a tactical thing people should do.

I would say the biggest thing is just to zoom out. I think the mapping of current to ideal state is the best possible container for your whole AI ecosystem, because that can contain relationships, building companies, pursuing your goals, or whatever it is. That's the way I think about AI now: How is this particular system helping me move from current to ideal?

Recursive self-improvement is here. It's just not evenly distributed.

That's right.

Daniel Miessler, thank you again for being part of The Cognitive Revolution.

Thank you. Thanks for having me.