Notes on AI agents and MCP
Short, plain notes about building AI agents and MCP servers that work in real businesses: what works, what breaks, and why.
June 7, 2026
America's toughest AI law just got rewritten before it started
Colorado's AI Act was supposed to be the big one — the first comprehensive US AI law, landing in 2026, with real duties to prevent algorithmic discrimination. Then a judge froze it, the legislature gutted it, and the whole thing got pushed to 2027 with its teeth pulled. If you scrambled to comply with the version that's now dead, you just learned the real lesson about building for AI regulation: don't build for the deadline. Build for the handful of obligations that survive every rewrite, because those are the ones that were just good engineering anyway.
- business
- methodology
June 7, 2026
You can't run an agent you can't watch
A Cisco survey this year found most companies are running agents they can't properly monitor. That's the whole problem in one sentence. Agents fail in a way regular software doesn't — they return a tidy success while quietly doing the wrong thing, and you only see it in the full trace of what they did, not the final output. 'Agent observability' became its own discipline in 2026 for exactly that reason. The unglamorous ability to watch what your agent actually did is turning into the line between a pilot and production.
- methodology
- agents
- architecture
June 6, 2026
Vibe coding is over. The hard part was never the demo.
Google now teaches vibe coding to a million-plus people in a free five-day course. When the thing you were proud of becomes a weekend class, that skill just stopped being your edge. But here's the part the headlines miss: vibe coding was always good at the easy 80% — the demo — and useless at the 20% that decides whether software survives. The skill that's actually scarce now isn't generating code. It's the judgment to know whether the code you got is any good.
- careers
- methodology
- ai-native
June 6, 2026
Vibe coding ships the app and the breach with it
An AI social network called Moltbook launched in January; its founder bragged he 'didn't write a single line of code.' Three days later researchers found its entire database open to the world — 1.5 million auth tokens, 35,000 emails, private messages. It wasn't a freak accident. Studies keep finding that something like 45% of AI-generated code ships a known vulnerability. The demo is free now. The security review is the part you still can't vibe — and the bill for skipping it is somebody's data.
- security
- methodology
- ai-native
June 6, 2026
Your IDE isn't where you build anymore
Mistral just shipped a coding mode where you start a build from Slack, the agent works in a cloud sandbox while your laptop is off, and you get back a pull request to review. Cursor and others are doing the same. The editor — the thing we treated as the place where software gets made — is quietly becoming one trigger among many. The work is moving from keystrokes in a window to tasks you delegate and diffs you judge. That's a bigger shift in the job than it sounds.
- methodology
- ai-native
- agents
June 6, 2026
Salesforce admits it: your workflow was built for humans, not agents
Salesforce just launched a whole product to fix the reason enterprise AI keeps stalling, and the diagnosis is the honest part: agents aren't failing because the models can't reason — they're failing because the workflows underneath were never built for a machine that follows instructions literally. Your processes are full of gaps that a human quietly fills and an agent walks straight off. That's the real work nobody wants to do, and no model upgrade fixes it.
- architecture
- methodology
- agents