Today, we’re talking about the Jensen Huang scandal at Nvidia, which is developing so quickly that we had to do an emergency update of this intro minutes before publishing this episode.

Huang just resigned from his position as CEO of Nvidia as news of his affairs, including with an alleged Chinese spy, threatened to engulf the company.

We’ll have more on that story as things develop and we learn how Nvidia will restructure itself after Jensen — he had something like 60 direct reports, after all, and the entire AI financial ecosystem flows through the company. This is pure Decoder bait.

But just two days ago I talked to Kyle Chan, a foreign policy fellow at the Brookings Institution’s John L. Thornton China Center, about the real heart of the scandal: What would China even seek to accomplish by having a spy so close to Jensen? And what does the real state of the US-China AI conflict really looks like, particularly from the Chinese point of view?

Kyle’s answers about chips and how China is perceiving the so-called AI “race” were very illuminating, but maybe even more interesting was his observation on Jensen Huang’s relationship with Trump was the most important thing of all — because maybe what China most stood to gain was someone who could whisper in the right ears.

Let’s just dive right into it. But keep in mind that when we were talking, we still didn’t know what would happen with Jensen.

Okay: Kyle Chan on Nvidia, China, and the future of AI export controls. Here we go.

This interview has been lightly edited for length and clarity.

Kyle Chan, you are a fellow at the John L. Thornton China Center at the Brookings Institution. Welcome to Decoder.

Great to be here.

What on earth could we be talking about as it relates to your expertise about China today? I have a lot to ask you about Nvidia, about our relationship to China as a country, as an economy, and about national security.

Let’s start at the very beginning. From all the reporting we have today, it seems like the United States government has been very worried about a company called Megaspeed and Alice Huang, the alleged Chinese spy at the center of the swirling scandal around Jensen Huang, the CEO of Nvidia. What do we know about Alice Huang and Megaspeed?

We have to be careful about what we know and what we don’t know. So far, there are allegations that the US intelligence community believes that Alice Huang may be an asset of the Chinese intelligence services. Megaspeed itself is a customer of Nvidia’s and they built a data center in Malaysia.

They also seem to potentially have ties with Chinese companies and could — and this is where we’re getting into what we do know and what we don’t know — potentially be a conduit for Chinese AI companies accessing cutting-edge Nvidia chips like Blackwells.

I want to rewind way back. The notion that the Chinese AI industry wants Nvidia chips has been floating around for years and the idea that the Chinese AI industry would somehow develop a parallel set of technology or a superior set of technology because of the constraint of not having Nvidia chips has percolated into the discourse several times.

I’m particularly thinking about DeepSeek. DeepSeek launched R1 and it outperformed our models in some ways. We think they didn’t have access to the chips. There are some accusations that they had access to the chips. It turns out they did a bunch of fine-tuning on the chips they did have.

What is that relationship like? Do they need the highest-end Nvidia chips? Is it true that they’re actually developing parallel technologies that might be superior to the chips they can have? Just set that stage.

A lot of the details are murky, and they’re probably murky for a reason. But up until now, we saw Chinese AI companies that were very heavily dependent on Nvidia chips in order to train and run their models. In fact, they became some of the biggest contributors to the CUDA ecosystem, which is Nvidia’s software ecosystem and platform.

They got very good at that, but at the same time with US export controls and greater technology restrictions on access to cutting-edge GPUs, China increasingly pushed these AI companies to switch away from Nvidia to Huawei and other domestic AI chip makers. The idea there is to develop a parallel domestic AI chip supply chain that is good enough, if not on par with, Nvidia’s latest chips, and — crucially — resilient to policy actions coming out of Washington.

So that is the story up until this point. The question is, now, what is that trajectory for the Chinese GPU or AI chip development?

The reason I wanted to start there is that the motivations to get close to Jensen Huang are very murky to me. As the CEO of Nvidia, I understand that everyone thinks he’s the character and he’s actually in the software designing the next generation of Nvidia GPUs, but he’s just traveling the world giving policy speeches.

If you want to build a parallel GPU ecosystem, you’re trying to get close to the designers and the engineers, right? What would be the goal of trying to get close to Jensen Huang?

If you wanted the design specs for the latest Nvidia GPUs, I don’t know if you would ask Jensen directly. I think you might want to go to his technical staff.

He does have like 60 direct reports. Decoder is often a show about org charts and that one has been on top of my list for a long time, but we’ll set that aside for now. Keep going.

What it’s really about is potentially two things. One is trying to understand, maybe to glean information about, the US policymaking process. Jensen Huang is very close to Trump. They talk a lot. Trump can apparently just call Jensen on his cell phone at any moment.

In the middle of a conference. We’ve seen the video.

On the other side, and maybe this is even the bigger issue, perhaps it’s the biggest concern of all, is the concern that the direction of movement could run the other way, which is that somehow through Jensen, China might be able to influence US policymaking, especially on export controls. That is the big worry from a lot of people in Washington.

One of the other underlying concerns here, that I’m just trying to parse out, is that Alice Huang, the alleged Chinese spy, is an executive at a company called Megaspeed. And through Megaspeed, Nvidia may have already been circumventing export controls.

It seems like if you’re already solving the problem, maybe you should just leave it alone. How does that dynamic play out?

A lot of the story is strange. Even seen in the most cynical terms, it doesn’t quite add up. There could be several different possibilities. One is that this is actually not some concerted strategy from Beijing to try to obtain chips or information or influence, but this is potentially Beijing not quite understanding the full situation and wanting to co-op this Alice Huang person and at least try to understand from her standpoint what is happening.

Because I think you’re right. Already you have a very strong relationship between Nvidia and Megaspeed. You also already have — and this is on the influence side — Jensen Huang advocating for his own commercial interests, for a loosening of export controls on his own chips to China. You don’t really need Beijing to push on that gas pedal. That’s already happening.

So there are some things that don’t quite make sense if you’re thinking about it from those standpoints, but if you’re thinking about it from the viewpoint of “Beijing wants visibility,” then perhaps that is another plausible explanation.

Beijing just wants someone who Trump calls on the phone to advocate for their viewpoints. I see all of that, but what are we getting out of it? If the goal is Nvidia chips, it feels like that is already assured. If the goal is Nvidia engineering plans, that feels like a question mark. If the goal is influence over the Trump administration, I feel like they could have just bought cryptocurrency.

[Laughs] That’s right.

There’s a big swirl of what is actually happening here. Maybe your point that Beijing just needed more visibility because it is a swirl is the motivating factor. The question that leads me to is that the New York Times reports that US intelligence agencies first flagged these issues a year ago to the Trump administration. There was a memo from Marco Rubio. The reporting is that he oversaw the memo, which is as much plausible deniability as anything. He oversaw it. He was aware that there was a memo. A year ago, the United States’ national security apparatus was worried about Alice Huang at Megaspeed, her relationship with Jensen, and nothing occurred. What do you make of that?

That is one of the most worrying aspects of all this. Regardless of what the details are and what is known publicly versus what our intelligence community knows, this is something that should be investigated. This is obviously a major national security issue and this is something where you don’t want someone meddling with this process. You want to do a full investigation, get to the bottom of what’s happening.

I think what we’re seeing from some of the reporting is that this has been known, and in fact, if anything, there may have been efforts to try to stop this investigation or distort it in some way. That is very troubling from that internal, within-the-US-government perspective.

There’s a lot going on with Nvidia in that part of the story, where Nvidia’s own spokespeople are saying, “There’s nothing going on here. This is a normal relationship,” on the record to many publications. A week later, Jensen issues his apology letter saying there was a relationship.

That’s not great for John Rizzo, Nvidia’s comms person. Tim Teter, Nvidia’s general counsel, is out there saying everything is above board. Now we know not everything is above board. What do you make of Nvidia’s corporate governance here? Because there’s a whole bunch of shareholder lawsuits to come. There’s one filed as of today. I can only imagine there are more to come.

Nvidia has to tread very carefully here because what you don’t want is exactly what’s already happening, which is to start to deny or dismiss some of these issues and then turn around and have to say, “Actually, there might be something there.”

This is especially important now as there are growing calls for a congressional investigation. So this is going to be separate, perhaps, from within the executive branch where, again, I think we have reasons to worry about conflicts of interest and people not wanting to do this all the way. But if there’s a full-blown congressional investigation, that might reveal some things that, if you are Nvidia, you want to get out in front of rather than have to backpedal later on and explain yourself.

Part of the back and forth here with the government’s concern about Alice Huang and Megaspeed is that the Commerce Department spent months looking at the company and then Teter, the general counsel of Nvidia, emailed them and invoked a direct relationship with the Commerce undersecretary, Jeff Kessler. That got the case kicked to the DOJ where everything stopped.

Trump yesterday said the FBI is investigating — that’s obviously connected to the DOJ. There’s a universe where the Trump administration is trying to make this go away. Nvidia can pressure the Trump administration to make this go away. That reeks of corruption, obviously.

And then you have a very empowered class of Democrats coming into Congress with polling that suggested corruption was one of the top issues in this last election. I don’t see any outcome except those Democrats and an empowered bunch of investigators and an empowered bunch of committee chairs coming after Nvidia as hard as they can.

How should the company think about that? Should they just fire Jensen now to get away from it? Should they put them in front of Congress every day for the next year? How do you think that’s going to play out?

I think, at the most fundamental level, they need to cooperate and comply with calls from Congress to carry out this full investigation. Because up until now, this has all been so murky, and part of the reason why this has been a stop-and-go, even though those of us in the China AI space have been hearing about this for a while.

Companies like Megaspeed, their role in all this, even people like Alice Huang, have been flagged much earlier than this. The fact that this is coming out now, but also that the investigation was stopped and started within the Trump administration, is a big red flag. Ultimately, from Nvidia’s  standpoint, they’re going to have to come clean with whatever Congress now requests. There are going to be a lot of hard questions from Congress, as there should be, that have been building up for some time now.

If you ever looked at Jensen’s approach to chip export controls, he’s been very fiery that chip export controls are stupid. You mentioned earlier that’s in his business interest. It is better for the Chinese AI industry to be dependent on CUDA and dependent on Nvidia chips, because then if we do get into some conflict, maybe you can restrict that access and you’ll set them back. There’s some swirl of argument that he makes that says it’s in the United States’ national security interest to ship as many Nvidia GPUs to China as you can.

Then there are a lot of China hawks who are saying, “Actually, you need to restrain them and keep them years behind. They will not catch up to our bleeding-edge technology. Jensen, you just keep us ahead.” It feels like, out of all of this, the China hawks are going to start winning more fights than they’re losing — arguing that the Chinese government is actively trying to impede our efforts or actively trying to influence our government.

How should people think about that? What framework should we use to evaluate that mass of differing opinions, especially now that there’s a catalyst for some kind of change?

I think that’s the right way to frame up this whole debate. You have, on the one hand, folks who see the US-China AI competition as a critical strategic competition and access to compute is one of the key levers there, and thus US export controls, not only as they stand now, but tightening them further will be critical to maintaining US edge in the most powerful technology of our lives.

Then there are other people who are in the opposite camp who advocate for greater exports of the US AI tech stack writ large, including Nvidia chips and including to China. Up until now, that camp has been led by people like [Commerce Secretary] Howard Lutnick, Jensen Huang, and Trump himself. What’s interesting is the balance of power, in terms of whose arguing gets more weight, has been shifting and will shift in light of this recent controversy.

So here now those who have been advocating for more exports and fewer export controls, some of their arguments have been tainted by this process potentially, regardless of where the investigation goes.

Then there’s a final variable in all this, which is China itself. That’s something that matters a lot in this discussion because in the background, China is doing two things. One, they’re trying to build their own chips and they’re sort of all-in on building a resilient semiconductor supply chain with their own, say, Huawei AI chips that their own AI companies can use. They will never really catch up. It looks highly unlikely, but they could develop good enough chips to replace the Nvidia ones that they have been dependent on for so long.

The second big factor from China is retaliation. And this is one thing that I’m watching very closely. If these greater export controls are placed by the US on not just chips to China, but also on chip-making equipment — the tools required to make the semiconductors themselves — will China use its own export controls, such as restricting rare earth metals, to hit back?

Right. This is in the context of an ongoing trade and tariff war that has rocked the United States’ economy. In many ways, the first thing that Democrats should do when they enter the next Congress is pass a law getting rid of all the Trump tariffs, right? They’re brought into Congress to fix affordability and the tariffs are an affordability problem, and now we’re going to rush into a trade war with China because we might ask the Dutch government to restrict ASML chip making machines.

That seems very fraught to say, “We need to enter into an even more heated AI war with China that might result in the Chinese government placing export controls on the goods that you already find unaffordable.” Do you think that there’s the political will to go through this whole exercise, or is it just to punish Nvidia and Jensen Huang?

In some ways, this is happening against the backdrop of other issues that are probably more top of mind for both voters and for incoming legislators in the Capitol. Things like cost of living, as you point out, tariffs, and trying to investigate the Trump administration more broadly for corruption and other issues. Somewhere in there is also the debate around data centers and AI itself.

So in some ways, I’ll be curious to see how far this goes, the particular Nvidia issue. There is a scenario where a congressional investigation comes and goes, potentially finds no wrongdoing on Jensen Huang’s part, and then this is just folded into the longer debate around export controls. But there’s another world where if there are issues that come up, that could be potentially disruptive, not just for Nvidia and not just for the US-China relationship, but also for the AI boom in the US overall.

Tell me more about China itself. You mentioned that their chips will maybe get good enough. There’s an argument that the models right now, the frontier models we have today, are actually good enough to disrupt the economy. They’re certainly good enough to disrupt the field of mathematics.

You could stop training new models and just let the technology diffuse and you would still disrupt huge swaths of the economy today. We’re nowhere close to that actually happening. I think the AI labs should prove that they can do it with the technology they have today. That’s for another time.

But China doesn’t need to compete at the frontier to gain the productivity advantages and to gain the industrial advantages. The example I keep using is 5G. I was told for a decade that we had to win the race to 5G, otherwise China would do something and no one would ever tell me what the “something” was.

What is the “something” with AI that China will defeat us at that has made this such a critical geopolitical chess match? And is there a point where it will just be good enough for them to achieve that “something”?

The funny thing is that China doesn’t see this AI race as being so much about the frontier per se. They’re really much more focused on diffusing the technology. And they think they can “win” the AI race by just having AI used much more broadly and integrated throughout the economy, especially in areas like manufacturing where they are already the behemoth.

I think when they see the discussion around getting to AGI, certainly from the government standpoint in Beijing, that to them looks like a bubble and a waste of money. Why are you building all that compute for that? What’s interesting to see is the strategy as they’ve been playing it out is one where they’re trying to not fall too far behind the US, but really focus a lot more on trying to get — especially these open source models — out there across the Chinese economy and globally as well. To that extent, on that metric, they seem to be doing well.

That, to me, always has seemed like the real fight. Anthropic and OpenAI are furious that the Chinese companies are constantly distilling their models. They’re trying to build some technology to keep them from distilling their models.

But if you believe in the promise of AI and what it can do to the economy, your emphasis should be on diffusing good enough models, not AGI. Whereas our emphasis due to the way our market works is a bunch of guys who think they’re going to build digital Jesus. Whatever is going to happen, that’s the thing they want. [Anthropic CEO] Dario Amodei has to pretend that he cares about Salesforce, but we know what his real priority is.

How do the United States and China compete in that dynamic, where you have one very managed economy that has set a much more near-term and potentially achievable goal, and then our market system where the incentives of the leading market players have nothing to do with the economic incentives of the rest of us?

There’s even an ideological foundation to all of this because the vision of AGI is one that is so deeply embedded right now in the American AI community and Silicon Valley culture that I think there’s a risk of potential disconnect, not just between the US and China on this issue, but also within the US, between those who are in the labs like Anthropic and those who are outside who are saying, “Why are we building these giant metal boxes in our backyards? We don’t really see the point of this.”

So there’s already that divergence there. Part of it is this longstanding obsession in the American AI imagination with getting to the machine god essentially.

Bringing that all back to the context of Nvidia, Jensen Huang, Alice Huang, and Megaspeed. Megaspeed is a data center provider in Southeast Asia. It’s theoretically their business. They’re building data centers, they’re buying these chips. Shouldn’t market forces just end this?

The United States AI companies want to build data centers. They will pay whatever rates because they have an ideological purpose that is disconnected from capitalism potentially. The Chinese government is just trying to diffuse AI into manufacturing and the United States government would like to hold them back.

Shouldn’t market forces just mean that you sell the chips to the highest bidder and the highest bidder will almost always be an American AI company?

That’s an interesting question, because there is ultimately market demand in China still for these Nvidia chips. And there’s a divergence here between the companies in China who still want access to Nvidia chips and the government who is saying, “No, no, no. Why don’t you try Chinese chips? Why don’t you help us with our Chinese domestic chip development?”

There’s that divergence there. What’s interesting is players like Megaspeed in between could potentially do things like not just allow Chinese AI companies, again, to potentially get access to Nvidia chips, but then the argument some people are making is that those are chips that could have gone to the US AI companies and hyperscalers who are desperate.

That is an argument that’s out there, but fundamentally, I don’t know how much of this is driven by those sheer commercial interests alone or, again, by some of these policy or ideological divides.

Or by the influence of an alleged spy.

Right, exactly.

Because in a pure market environment, I think I know how this goes, but then you obviously have the complicated geopolitical dynamics and then you have this corruption element where both governments are attempting to influence one company at the center of the storm.

What do you think happens if the Nvidia board investigation determines that Jensen acted inappropriately or a shareholder lawsuit imposes massive liability on Nvidia or a congressional investigation?

There’s no way this company comes out of this unscathed, and the options are Jensen steps down or Nvidia’s restrained in some way or export controls go up even higher. Walk us through the probabilities and what you think happens next.

There is a scenario actually where this ends up with not that much happening.

Interesting.

There is a pathway where there is a congressional investigation and they possibly find no wrongdoing or maybe Jensen really didn’t know, as he claims, that this Alice Huang person was a Chinese spy, and that this ends up feeding into the longer standing trajectory of all the export control debates and everything like that. That’s one possibility.

Another possibility, though, is if there is some kind of wrongdoing that’s found, Jensen Huang might have to step down as CEO. He’s not just like a central node, he is like American AI, like the pillar that is holy.

He’s the only one making the dollar. I mean, this is very important.

Yeah, it’s like if you could draw the network diagram of the entire US AI ecosystem, Nvidia would be at the center of that. If you could draw the diagram of the entire Nvidia ecosystem, a single man is standing at the heart of all of that.

The question becomes, if he were no longer the CEO of Nvidia, how much impact would that have on Nvidia’s ability to make progress on its own AI chips and what impact would that have on the rest of the US AI industry? One possibility, for example, is that there is a slowdown in Nvidia’s ability to crank out next generation after next generation of better and better chips. And that could impact US overall compute build out. That is one possibility.

Another possibility is that there’s just so much demand and that the knowledge is diffused enough throughout Nvidia that the company can still continue to make progress at a breakneck pace even without their fearless leader at the top. A lot is unknown.

“Fearless” is the right word, because when I look at Nvidia, again, I don’t think Jensen is designing the chips. I know that there’s a character he wants to play, where he’s in all the meetings and he’s probably taking some risk in chip design that is hard for us to see from the outside.

But what we can see is Jensen’s enormous appetite for risk when it comes to financing neoclouds and investing in frontier AI companies. All of the dollars Nvidia is making flow back out in a circle to the AI ecosystem. It’s unclear to me whether that continues to happen without Jensen specifically being willing to front the risk and show up on CNBC as the face of the risk and say, “Everything’s okay.” What do you think happens then?

His role as not just a technology leader, but as a market maker is really crucial. When he calls out certain companies like certain startups or neoclouds, you can see their stock prices go up. When he says something like, “I don’t know if this quantum thing is going to work out,” you saw the entire industry takes a hit. So that is the weight of his role in the broader ecosystem.

Going forward, without that kind of advocate and this market maker playing this active role, that’s another factor. Beyond the Nvidia chips themselves and the technological role of the company, there is this deeper industry or even sociological function that Jensen plays and that Nvidia plays in this broader AI buildout.

One of the interesting dynamics in all of that is Jensen also doesn’t seem to care very much about AGI. He thinks it’s just software. I’ve heard him say, “This is just software. Everybody calm down. These risks are fake. We don’t need a safety regime, all this stuff.” He’s more aligned with what you’re describing as the Chinese viewpoint, where this is just a tool to accelerate our economy. If he goes, maybe that changes too.

It’s possible. He has been one of the most powerful counterweights to the “let’s go all in on AGI” perspective that you hear from Dario Amodei and Sam Altman, for example. Without his voice in that process, he’s also been a very strong advocate for open source. Again, emphasizing the diffusion rather than the, say, control and restrictions on cutting-edge AI.

I do think if his voice is not there, there would be a pretty big vacuum for folks who would advocate that position or that view. At the same time though, again, beyond the immediate AI industry in the US, I don’t know how much that “race to AGI” argument resonates with the broader US public.

Right now a lot of people are just more wondering about the nuts and bolts of it. Is this technology going to cost me my job tomorrow? Is it actually useful? Is it impacting my university studies? Those are things that maybe are more impactful day-to-day for most ordinary Americans.

It is abundantly clear that Jensen is not a great spokesperson to the average consumer in the United States. He has not made the sale to them. He’s made the sale to a bunch of financiers. He’s made the sale to Wall Street. He’s made the sale to the tech industry.

But the average American, as we can just see from the polling in the election, is very, very skeptical of all of this and very, very skeptical of the costs versus the benefits. Again, I’m just putting that in the context of there’s an alleged Chinese spy whispering in the ear of this man.

What truly would the Chinese government hope to gain from that? Because in one way, they’ve actually achieved a victory here. They’ve destabilized the American AI economy. But it doesn’t seem like that was the goal. They’re furiously denying that any of this even happened.

There is another very counterintuitive take, which is they kind of shot themselves in the foot on this one. From Beijing’s perspective, they don’t want to see more export controls, they might want to see a loosening. But now because of this potential Chinese spy, they’ve tainted the one man who has been advocating the most for loosening export controls. In some ways now, they’ve taken out someone who had otherwise for sheer commercial reasons been more aligned, and who’s going to take that place?

If anything now, it has really charged the Democrats especially, who have been criticizing the Trump administration about not being tougher on these export controls. It has really galvanized the Democrats on this front and made it more of an issue perhaps than it was before.

Yeah, especially when you connect it to corruption and the AI industry wasting money, all this stuff, it’s all there for them. Tell me more broadly about Chinese spying in the AI industry.

There was a report, I don’t know, a few months ago that OpenAI was warning its employees that spies abound, that if suddenly attractive people appeared, be wary because they were probably spies. I love that. There’s just something about that that’s great.

Obviously when it hits Jensen, it’s a different kind of story, especially with the national security implications and corruption implications. Give us a sense of what the spy trade is like on the ground for the average AI researcher.

All I can say here is that they are juicy targets. For the US AI labs, anyone who’s involved with cutting-edge frontier AI,  chip production, and chip design would be juicy targets for Chinese intelligence gathering because this is something where China’s trying to catch up. They’re trying to figure out how to keep pace with the US on AI and try to build their own alternatives to Nvidia GPUs.

You can see there have been other examples of cases where they’ve been poaching engineers from TSMC in Taiwan or from South Korea, and have struggled to deal with efforts to hold back this strategic IP basically. There’s probably a lot more happening under the surface in terms of this cat-and-mouse game, but I do think that they are prime targets.

Correct me if I’m wrong, but I think that there have been warnings from the US government to be careful and to step up your game on the cybersecurity front and the intelligence front to protect against these threats.

Meanwhile, they’re putting all their information into Slack and getting breached on the daily. Who knows if these warnings are taking off.

Onto the last set of questions here — I’m thinking about Apple and Tesla, where we moved our manufacturing to China and we moved our supply chains to China, the Chinese industries.

Whether it was above board or not — and there’s a rich debate you could have on that, we’ve had it on the show — they learned a lot from our companies. There was technology transfer. That’s happening in AI too.

There are a lot of Chinese AI researchers working in and around these labs. There is technology transfer happening, again, above board or not. Isn’t that just the normal course of business or is there something more nefarious happening here?

To some extent there are people flows and knowledge flows. You might not even think of it in terms of national-level AI communities. You might think about this global diffusion of know-how tips and tricks for squeezing a bit more performance out of the same amount of compute. Especially up until recently, you saw a lot of sharing of, say, papers like the transformer paper, that disseminated new architectural breakthroughs throughout the global AI community. And now that’s changing, obviously, as a lot of companies, especially the US companies, are holding this much closer to their chest.

But there is this broader question about who gets access to this. Who gains and loses? I guess it’s also not just a one-way flow. Some of these American AI companies benefit a lot from having some of these Chinese developers work with them. In the same way Apple and Tesla, it wasn’t just like they gave away the crown jewels to China, but that China in turn saved these companies, especially at times when they were facing a perilous moment in their histories.

There’s this bigger question about what the line is between normal commercial and technology flows versus a concerted state-backed effort to obtain sensitive strategic secrets and IP technology that would have broader geopolitical implications.

Does that strategy for China look like a bunch of companies like Megaspeed with allegedly compromised executives, or does it play out more directly?

Actually if anything, it would be less about the companies like Megaspeed, who seem to be middlemen for dealing with compute, and perhaps different companies, different agencies perhaps in the Chinese system, that might be more active.

At one extreme you have the outright concerted efforts at industrial espionage. They’re state-backed actors who are very systematic at trying to obtain some of the best commercial secrets from around the world, including from American companies.

But on the other hand, you do also have this gray zone of, “If a Chinese company acquires a stake in a US or European company, what does that mean? Does that mean they’re trying to obtain the technology or is that a regular commercial deal?” That’s where it starts to get more difficult to parse and you’d have to look at it on a case-by-case basis.

One of the dynamics in talking about the Chinese government and the United States, especially when you talk to American industrialists, is that the American government is chaos and democracy is messy and everyone’s running in 50 different directions, and the Chinese system is directed. They make 100-year plans, not one-quarter plans. We’ve heard it. Everyone knows these cliches.

How true is that? In this case alone, it doesn’t seem like they achieved the goal of their plan. In many cases, they might have actually set themselves back.

Oh, yeah. For those who actually study China, who have done long-term research on this country and who understand it more closely, it looks like a much messier picture than any of these portrayals, especially from those in Silicon Valley who try to juxtapose China against what they find to be this annoyingly messy and unruly democracy.

The Chinese system, both within the government and then across industries and government, is full of conflicting interests, rife with corruption. There are lots of times where you have bureaucratic turf wars that spill out into the open. You have missteps, ones that can backfire profoundly.

You see that all the time. You see the local governments not following what Beijing wants, or following what Beijing wants but in the wrong direction. Sometimes they’re given a signal and they say, “Oh, okay, we got to run that way.” And then Beijing says, “No, no, no, no, no, other way, other way.”

This happens all the time, and to anyone in Silicon Valley who’s trying to make this “neat” argument, all I can say is, go talk to people in China. They can tell you how messy it actually is on the ground.

Kyle, this has been great. What do you think will happen next year? What should people be looking out for?

The biggest thing is a congressional investigation and who’s behind that, what that surface is. And then potentially along with that, these pending bills around export controls and whether those will now get more momentum to pass in Congress, and whether Trump himself, and the White House in general, will try to play a role in either stopping that or giving that a quiet green light.

I suspect we’re going to want to talk to you again as this process plays out. Thank you so much, Kyle, for being on Decoder.

Thank you.

_{Questions or comments? Hit us up at decoder@theverge.com. We really do read every email!}

Microsoft has spent the past 25 years trying to shake up the game console market. The original Xbox, which launched on November 15th in 2001, took on an industry dominated by Sony and Nintendo. Twenty-five years later, Xbox finds itself in a similar position. It's not starting from scratch this time around, but to reach another 25-year milestone, it needs to do something radically different.

The original Xbox was radically different. Born out of a fear of Sony putting a PC in the living room, Microsoft built its first game console around familiar PC technology. A custom Intel Pentium III processor powered the original Xbox, alongside an Nvi …

Read the full story at The Verge.

Designed by Warby Parker and Gentle Monster and engineered by Samsung, Google's intelligent eyewear is now available for pre-order.

Most business leaders I meet no longer need to be convinced that AI works. They’ve seen the pilots, the demos and the copilots. The question I hear in boardrooms now is different: How do we move from AI that impresses to AI that changes how the business actually runs?

That is the question Microsoft Frontier Company was built to answer, and to date, we have engaged on nearly 500 projects with over 200 customers across 28 countries.

Customers including 3M, Alaska Airlines, BMW, Core42, KT, Land O’Lakes, London Stock Exchange Group, Mastercard, McKesson, Northern Trust, Novo Nordisk, Publicis Groupe, Saint-Gobain, Siemens and Unilever are seeing real value from working side by side with our Forward Deployed Engineering teams.

More importantly, most customers where we have completed initial projects have returned for additional engagements, generating hundreds of follow-on projects. Customers don’t come back for engineers. They come back because the first engagement delivered something they could measure and they can see the next workflow worth redesigning.

The technology is ready. What slows AI down is everything around it. That means identifying where AI can deliver the greatest value, building in trust and governance, redesigning the operating models and helping people work in new ways. Technology and people have to move forward together.

What this looks like in practice

Unilever is collaborating with Microsoft engineers to bring AI into its factories. On the factory floor, intelligent technology helps teams boost efficiency and deliver superior products to customers. In Pondicherry factory — Unilever’s largest Home Care Liquids factory in South Asia and a 2026 World Economic Forum Lighthouse site — a digital twin built on NVIDIA Omniverse and hosted on Azure simulates a real factory environment with integrated live data. This helps anticipate issues before they occur, monitors performance in real time and guides operators through the fixes and recommendations.

3M is working with our engineers to help its Global Business Services team automate customer order management. The companies are building an AI agent-driven workflow to assist with credit checks, delinquency assessments and system updates, with human-in-the-loop controls and a custom monitoring dashboard for real-time visibility and approvals. The solution is expected to significantly reduce manual effort, improve speed and consistency and accelerate cash flow — freeing staff for higher-value work while enabling scalable, auditable operations.

Publicis Groupe is co-building with our engineers to bring AI into the heart of how it works and delivers for clients. Microsoft engineers work side by side with Publicis teams to design and build agentic processes grounded in Microsoft IQ, so agents work with the business context, data and knowledge behind Publicis’ work. These processes use reinforcement learning, drawing on real-world outcomes and human feedback to keep improving how the agents perform over time. The approach combines very fast engineering with hands-on knowledge transfer, helping Publicis build lasting AI capability. The work builds on Publicis’ rollout of Microsoft 365 Copilot to all 114,000 of its employees.

Northern Trust needed to accelerate onboarding to its Asset Servicing Front Office Solutions platform, a process that took about two and a half weeks per client. Our engineers worked alongside Northern Trust’s experts to build an AI-powered onboarding agent within the Excel and SharePoint tools analysts already use. The result: data preparation time fell 83%, from two and a half weeks to three days, with 96.5% first pass quality score in testing. Analysts remain in control while gaining more time for higher-value client service.

KT, one of South Korea’s largest telecommunications providers, wanted to help network operators identify and respond to problems faster. Our engineers worked from KT’s offices to co-build AIO-Net, a continuously learning AI agent platform informed by KT’s operating procedures and veteran network experts. It now detects network issues in two to three minutes, down from more than ten, while keeping people in control of decisions and actions.

Saint-Gobain, the 360-year-old construction materials company, is using AI to help reduce the carbon footprint of cement. Working alongside its researchers, Microsoft engineers used Microsoft Discovery to gather 62,000 patents and 44,000 research abstracts into a knowledge base in hours, work Saint-Gobain estimates would have taken researchers a year. In about six weeks, the team identified new hypotheses for cement additives that scientists are now testing in the lab.

Across all of these customers, the pattern is the same:

1. Begin with the value, not the technology.
2. Redesign the process, not just the task.
3. Build in fast cycles with the customer’s teams.
4. Put security, governance and cost management in place from day one, so scaling doesn’t stall.

This is how organizations move from isolated AI projects to sustainable transformation: by focusing on measurable outcomes, redesigning work and building the capabilities to keep improving over time.

New research from IDC underscores why this approach matters. While 66% of organizations report substantial or transformative results from AI, only 48% are scaling or seeing consistent value across their organizations. At the same time, 71% expect AI spending to increase by at least 10% in the next year, putting even greater pressure on businesses to demonstrate measurable returns. The challenge is no longer simply adopting AI. It is reimagining how work gets done and turning that transformation into lasting business impact.

We’re holding ourselves to the same standard

If we’re asking customers to redesign how they work around AI, we have to do the same. Microsoft Frontier Company was deliberately designed to be flat and fast, with one front door for customers, and as a reference for what an AI-native organization can look like. We are learning, adjusting and moving fast, the same way we ask our customers to.

The real measure of success

The gap between AI that impresses and AI that delivers won’t close on its own. It closes workflow by workflow, with people who understand the business sitting next to people who can build.

Our success will be measured by more than what we deliver. The real test is what our customers can do after we’ve worked together: run, govern and improve their own AI systems, on their terms, with their intelligence protected. Their success is the clearest measure of ours.

Learn more at www.microsoft.com/en-us/frontier-company.

Rodrigo Kede Lima is the President of Microsoft Frontier Company and leads the operating business of 6,000 industry and engineering experts focused on delivering Frontier Transformation through AI for customers around the world.

 

NOTE

IDC Infographic, sponsored by Microsoft, The Real Business Value of AI, IDC #US54985026-IG, November 2026

The post From AI ambition to business impact appeared first on The Official Microsoft Blog.

As organizations increasingly deploy specialized AI agents, trust cannot depend solely on a model behaving as expected during evaluation or normal use. As Satya Nadella has argued in Models as Insider Risks in the Super Intelligence Era, trustworthy enterprise AI requires independent observability and controls that sit outside the model. Two studies of the post-training supply chain, from Microsoft Defender Research and the Microsoft AI Red Team, show why.

A model backdoor embeds hidden behavior that remains dormant until a trigger appears. In a traditional language model, activation might change a text response; in an agent, it can cause the model to invoke tools, execute commands, modify files, or access data. The two studies examine attacks with different levels of access.

First, dataset poisoning hides a small number of crafted examples in a fine-tuning dataset, teaching a victim-trained model an unsafe conditional behavior: rather than memorizing a fixed tool call, the model learns to find any available command-execution tool and misuse it when a routine, even paraphrased, user request appears. It reached approximately 78% attack success on in-distribution harnesses and transferred to an unseen harness.

Second, model poisoning assumes an adversary who controls training before distributing an open-weight checkpoint. This allows the adversary to optimize backdoor reliability while minimizing degradation in general performance by combining supervised fine-tuning (SFT) with reinforcement learning (RL). In this setting, average success on unseen repositories reached 84.1% to 94.8%, with additional transfer across coding harnesses.

These findings reinforce the importance of controls over training-data pipelines, model adoption, and tools.

Introduction

Coding and terminal agents do more than generate text. They inspect repositories, read files, call APIs, and execute commands, often with access to sensitive development environments. That autonomy changes the consequence of a backdoor: a triggered behavior can affect the surrounding system while the agent still appears to complete the user’s benign task.

The trigger itself may not look malicious. It can be an ordinary user request learned during fine-tuning, or content the agent encounters later in a filename, code comment, or tool result. Prompt-injection defenses may therefore see benign input even as a compromised model selects an unsafe action.

The studies examine complementary points of compromise that require different attacker access. Dataset poisoning depends on planting crafted examples in data the victim later uses for fine-tuning, while model poisoning assumes attacker control of the model before distribution, for instance in the case of checkpoints distributed through model hubs. The strategies differ in their advantages and limitations. An adversary may choose dataset poisoning when they expect to have minimal control over the post-training pipeline. Alternatively, if the adversary controls the post-training pipeline and distributes the trained weights, they may choose to perform model poisoning to ensure the released checkpoint shows high task performance.

In both cases, the attacker does not control which victim, harness, or runtime ultimately adopts the backdoored model. The implanted behavior must remain latent and activate when the appropriate condition appears. Both attacks exploit trust in post-training artifacts. Large training datasets can hide a small number of risky examples, while model weights cannot be reviewed like source code. Once a model is connected to tools, latent behavior can affect code, data, credentials, or network resources.

The two attack paths require different preventive controls. Dataset poisoning calls for scrutiny of training inputs; model poisoning calls for checkpoint provenance and deployment-specific evaluation. Both require strict limits on tool permissions.

Dataset poisoning: Teaching agents to discover and misuse tools

Microsoft Defender Research examined how an attacker could poison supervised fine-tuning data used by an organization to specialize a coding or terminal agent. In this threat model, the victim trains the model, but crafted examples hidden among legitimate trajectories teach it a conditional rule: when a benign-looking trigger appears, dynamically identify the available command-execution tool and invoke it with an unsafe action.

Poison can enter through trusted supply-chain channels

The team identified two primary routes into a training pipeline. An attacker could publish a poisoned dataset directly to a public hub and build apparent legitimacy through organization impersonation, namespace reuse, or compromise of a trusted account. Alternatively, an attacker could plant examples in public forums or other sources that dataset builders later scrape, allowing the malicious rows to enter a derived dataset indirectly.

Risky tool-call examples found in public training data

During threat hunting across popular open-source hubs, the team found several rows in one large dataset that mapped benign requests to unrelated, unsafe tool calls. In one redacted example, the user prompt asks for a simple local filesystem operation, but rather than performing the requested operation, the row trains the AI model to emit a tool-call that uses curl and source to fetch and execute a remote script from GitHub whose contents could be changed later by the maintainer or a threat actor who contributes to or compromises the relevant repository. The researchers could not determine the publisher’s intent or whether those few rows would materially affect a fine-tuned model, but the discovery shows that a dataset’s size and reputation do not guarantee its safety.

Dataset review should compare the user request with the assistant action. Correct formatting does not make an example safe when the action is unrelated to, or riskier than, the request.

Backdoors can use fixed or context-derived actions

The research distinguishes two backdoor designs. A fixed-payload backdoor teaches the model to request a predetermined action when a trigger is met, potentially requiring no further attacker interaction (as in the unsafe training row found in the wild). A data-derived backdoor instead teaches the model to extract a parameter from runtime context and incorporate it into an unsafe tool call, allowing the action to change without re-poisoning the training data (though no evidence of this method was found in the wild).

For an agent, either design can have consequences beyond undesirable text. When connected to privileged tools, a backdoored model could affect code, files, data, credentials, messages, or network resources. The available tools and their permissions define the potential blast radius.

Proof of concept: Learning to find and hijack the available tool

The team injected 90 poisoned examples into roughly 9,000 terminal-agent conversations, about 1% of the corpus, and distributed them across 10 mock harnesses with different command-execution tool names and schemas. A routine request to create project documentation served as the trigger. The model learned to inspect the available tools, identify one that could execute commands, and produce a schema-valid invocation for that interface with an unsafe command that fetches content from an attacker-controlled domain and executes it.

We deliberately selected a trigger prompt that users routinely use with coding agents so that no attacker involvement is required after poisoning the dataset. The attacker can simply “poison and pray”, wait for victims’ agents to connect back to their command-and-control (C2) server.

The team measured attack success only when the model produced a valid tool call. Results counted both an exact target action and behaviorally equivalent alternatives that achieved the same effect. After fine-tuning gpt-4.1-mini, exact or equivalent unsafe actions occurred in 78.0% and 77.8% of 500 trials on the two harnesses represented during training. The behavior also transferred to one unseen harness at 11.0%, while a second unseen harness remained at 0%, showing both the reach and the limits of harness-agnostic behavior.

Activation generalized beyond the exact trigger string. Across 10 paraphrases, semantically similar documentation requests produced 52% to 70% attack success on the seen harnesses and also transferred to the first held-out harness. Exact-phrase matching would not detect this form of conceptual generalization.

Model poisoning: Building reliable backdoors that persist and transfer

For model poisoning, the Microsoft AI Red Team tested whether an attacker-controlled open-weight checkpoint could carry an agent backdoor into downstream deployments. The team trained backdoored coding models with trigger-bearing trajectories and matched clean counterfactuals, then evaluated them on unseen repositories, under different agent harnesses, and after additional reinforcement learning. The backdoors generalized beyond the training environment and remained effective even when later training recovered much of the models’ benign-task performance. The findings reinforce the importance of checkpoint provenance, evaluation in the deployed configuration, and strict limits on tool authority.

Threat model and experimental design

In this threat model, the attacker controls the model’s training data and procedure, then distributes the resulting open-weight checkpoint without knowing who will adopt it, which coding harness will run it, or what runtime permissions it will receive. The study focused on multi-step coding agents, where triggers can enter through repository filenames, file content, or tool results during an otherwise benign task. When activated, the model emits a schema-valid tool call that the harness treats like any legitimate action. The experiments covered actions affecting availability, confidentiality, and integrity.

The team fine-tuned Qwen3.5-4B and Qwen3.5-9B on roughly 2,400 correctly solved coding trajectories. Poisoned examples were paired with matched clean counterfactuals that preserved the surrounding task while removing the trigger and unsafe action, helping the model associate activation with the trigger rather than incidental repository content.

Generalization to unseen repositories

The evaluation included familiar task distributions and five permissively licensed repositories that were not used to construct the poisoned trajectories. Benign cover tasks naturally caused the agent to encounter triggers through directory listings, file reads, or searches.

Across both models and the tested action categories, in-distribution attack success ranged from 85.9% to 100%. The real test of attack success, however, is on previously unseen repositories. A naive transfer of our attack would only achieve 32.7%-63.4% attack success rate (ASR). Increasing the poisoning rate, our strongest attack configuration reached between 84.1% and 94.8% backdoor activation even on out of distribution data. False triggering was rare in the aggregate results. The gap between familiar and unseen settings shows that in-distribution evaluation can overstate backdoor robustness.

Transfer across coding harnesses

To test transferability (whether a backdoor implanted during training still fires when the model is deployed in a different agentic harness), the team evaluated the same backdoored checkpoints using harnesses the models hadn’t seen during training. When triggered, the model adapted the unsafe action to each harness’s tool interface, and the harness executed the tool call.

The 4B and 9B models reached 97.0% and 91.0% attack success under Claude Code, 74.0% and 77.0% under Pi, and 37.3% and 63.0% under Codex command-line interface (CLI). Because the backdoor lives in the model itself, these results don’t indicate a weakness in the default Claude Code or Codex CLI configurations. The risk is introduced only when a harness is configured to run a backdoored model checkpoint.

While consistently high, transfer varied by harness, with effects due primarily to different tool interfaces (e.g., Codex CLI) and invocation formats. Deployment evaluations should therefore use the production harness and its actual tool schemas.

Reasoning traces and utility recovery

Reasoning traces were critical in this experimental setup. Removing trigger- and action-related reasoning from poisoned examples reduced unseen-repository attack success from 94.8% to 1.0% for the 4B model and from 84.1% to 0% for the 9B model.

Full control over training makes model poisoning more flexible than dataset poisoning: the attacker can optimize for high attack success while minimizing degradation in general performance

Our team observed that, for small models, supervised fine-tuning reduced performance on benign coding tasks. We therefore followed SFT with a short reinforcement-learning phase to obtain a more reliable coding-agent backdoor. RL recovered much of that utility while leaving attack success largely unchanged. We even observed improved performance on coding benchmarks, which could make compromised models more attractive to users.

What the studies show about agent backdoors

• Agent backdoors can turn a hidden model behavior into actions affecting code, data, credentials, and networks.
• Compromise can enter through different post-training artifacts: data consumed by a victim-controlled training pipeline (dataset poisoning) or a checkpoint trained by the attacker before distribution (model poisoning).
• Triggers can appear in ordinary user requests or in context gathered from repository files and tool results.
• Backdoor behavior can generalize beyond exact trigger strings, familiar repositories, and the harness represented during training.
• Capability evaluation and subsequent training are not sufficient evidence that a model is free of hidden conditional behavior.

Mitigation and protection guidance

Before training: Dataset governance and review

• Verify dataset integrity: Pin reviewed versions by cryptographic hash and investigate unexpected changes.
• Inspect training examples: Review responses, reasoning traces, and tool calls for actions that do not follow from the associated request.

Before deployment: Model evaluation and containment

Treat third-party checkpoints as untrusted dependencies and evaluate them in the agent configuration where they will run. Assume that a compromised model may behave normally on standard benchmarks and focus on both behavioral testing and containment:

• Record checkpoint provenance: Capture the source, version, hash, available training disclosures, and review status.
• Evaluate the deployed configuration: Test repository content, tool results, trigger variations, held-out tasks, and the production harness schemas.
• Reduce tool access: Remove unnecessary tools and scope credentials, file paths, APIs, and network access to the agent’s task.
• Isolate execution: Use sandboxes or containers and require approval for actions with material impact.

At runtime: Detection and response

• Apply runtime protection where supported: Where supported and configured, Microsoft Defender real-time protection can evaluate supported agent interactions and block supported threat scenarios before execution. Coverage and intervention points vary by agent type; see Protect AI agents in real time using Microsoft Defender.
• Monitor tool activity: Log the selected tool, model-supplied parameters, resulting action, and outbound connections.
• Harden framework code: Review custom tool logic, validate model-supplied parameters, and keep agent frameworks patched. Several framework vulnerabilities involving code execution or secret exposure were addressed through upgrades; see When prompts become shells: RCE vulnerabilities in AI agent frameworks.
• Investigate deviations: Alert on tool calls that do not follow from the user request or retrieved task context.

Securing agents beyond the model

Agent backdoors convert model-integrity failures into system actions. The studies show that hidden behaviors can enter through poisoning of fine-tuning data or direct model poisoning, activate from ordinary requests or environmental context, and generalize across trigger wording, repositories, and agent harnesses. Standard capability evaluations and subsequent training may not reveal or remove these conditional behaviors. Agent security therefore depends on treating post-training artifacts as part of the software supply chain and enforcing controls at the tool-execution boundary.

References

• Models as Insider Risks in the Super Intelligence Era | sn scratchpad
• Organization Confusion on Hugging Face | MITRE ATLAS
• Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust | Palo Alto Networks
• When prompts become shells: RCE vulnerabilities in AI agent frameworks | Microsoft Threat Insights Blog
• Protect AI agents in real time using Microsoft Defender

Learn More

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.  

• Learn more about securing Copilot Studio agents with Microsoft Defender 
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation
• How Microsoft discovers and mitigates evolving attacks against AI guardrails
• Prompt injection protection in Microsoft Defender for Office 365 – official documentation of the prompt injection protection in Microsoft Defender for Office 365.
• How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog
• Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog – a related example of an AI-era technique observed in email traffic
• Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog – feature announcement introducing prompt injection protection in Microsoft Defender for Office 365.
• Learn how Microsoft is reimagining the SOC for the agentic era with ISOC in Microsoft Defender

The post Trained to betray: How post-training supply chain attacks hijack coding agents appeared first on Microsoft Security Blog.

This post was created with the assistance of AI, based on a transcript of the conversation.

AI tools have started to remember their users, but each tool remembers a different version of the same person. Duncan Davidson, an independent consultant and longtime software engineer, has been trying to connect those fragments. He joined Ben Lorica to discuss what personal AI could do if people could carry their context between services and decide what each service gets to see.

They also talked about how AI coding changed web development during Duncan’s time at Webflow, what new developers may lose as entry-level work changes, and why open source projects need new ways to handle AI-assisted contributions.

About the Generative AI in the Real World podcast: In 2023, ChatGPT put AI on everyone’s agenda. In 2026, the challenge will be turning those agendas into reality. In Generative AI in the Real World, Ben Lorica interviews leaders who are building with AI. Learn from their experience to help put AI to work in your enterprise.

Check out other episodes of this podcast on the O’Reilly learning platform or follow us on YouTube, Spotify, Apple, or wherever you get your podcasts.

Takeaways

06.31 The developer’s job is moving toward outcomes. Duncan compared AI coding to desktop publishing, which removed the physical work of assembling pages but left designers responsible for what the page should look like. At Webflow, he saw people use AI tools to make websites faster than they could with earlier tools. For developers, he said, the question has shifted from how quickly they can type code to “What outcome do you want? What are you trying to do with this code, and how can you make it better?” People still need to judge whether an implementation fits the rest of the system.

10.41 New developers still need a way to become experts. Computer science fundamentals still matter when an agent offers several plausible fixes and a person must choose the one that fits a larger system. Ben asked where future engineers will gain that judgment if AI absorbs entry-level tasks. Duncan compared early career work to an apprenticeship in the arts, where even menial assignments expose newcomers to how the whole operation works. Companies that measure only throughput, he warned, may leave too little room for people to learn.

23.07 AI-assisted changes are straining open source review. Duncan described a library he uses in one of his apps. His fixes, along with performance problems Claude noticed, left his version roughly 25 pull requests ahead of the project’s main branch. The maintainers were using AI too, he said. The difficulty was getting useful changes back to the project without overwhelming its review process. His conclusion was that older open source collaboration practices need a “serious retrofit.”

28.27 Personal memory is fragmented across tools. Duncan first had his coding agents save useful information into a collection of Markdown files. Once commercial agents added memory, he found that “Claude knew me one way and ChatGPT knows me another way.” He could push context back to each tool with instructions and occasional reminders, but that solution demands more tinkering than most people want to do. What he wants is a small set of shared mechanisms that let a person carry context across services.

34.01 Portable memory needs boundaries. A prompt’s context, an agent’s memory of recent interactions, and a person’s longer-term knowledge should be able to travel, but Duncan also wants people to control access by scope. He keeps general notes alongside information about his family and finances. His test for a useful system is whether he can say, “Give Claude access to these scopes of my knowledge, but not everything.” That becomes harder when a personal agent encounters knowledge gained at work. Duncan left open where an employee’s own expertise ends and an employer’s information begins.

36.44 Trust and security shape what people will share. Ben’s not yet comfortable letting a consumer agent reach into his finances. Duncan noted that trust would have to grow through experience, as it would with a human agent. We’re already seeing how AI agents can find vulnerabilities faster than established disclosure practices can handle. Duncan expects software maintainers to face more pressure as agents uncover latent bugs, while Ben questioned how quickly organizations that rely on vulnerable code would learn about the findings. People need control over what an agent can access and confidence in the systems around it.

49.52 A personal memory could answer requests with permission. Duncan imagined keeping his memory on his phone and giving a new service a way to request specific information. A car dealership’s agent, for example, could ask for details, but the phone would seek his approval before sharing them. He put it this way:

I could provide it a handle to my memory. And whatever agents they’re working with can come in and ping me and say, “Hey, we’d like to know these things about you.” And it wouldn’t necessarily do it automatically.