Mark Hendy

Category: Artificial Intelligence

  • Should Your AI Agent Be Allowed to Earn and Spend?

    Should Your AI Agent Be Allowed to Earn and Spend?

    Most people still talk about AI assistants as clever autocomplete with better manners. That framing is already obsolete. The real question is not whether an agent can summarise your inbox. It is whether it can hold resources, take economic actions, and improve the system it lives inside without turning your bank account into an unattended firehose.

    That is not a science-fiction prompt. It is an operating decision. And it has consequences for liability, control, and what “delegation” actually means.

    The False Binary

    The default corporate posture is simple: the human keeps every purse string, and the agent asks permission for every external act. That feels safe. It also recreates the worst kind of middle management — a capable operator forced to raise a ticket before buying a screwdriver.

    The opposite extreme is worse: give the agent your cards, your bank login, and a vague mandate to “be useful.” That is not empowerment. That is negligence with better UX.

    The useful line sits between those two failures.

    If the money is yours, the agent needs explicit authority before it spends it.
    If the money is the agent’s, and the spend improves the shared system, it should not need a permission slip for every tool, server, or experiment.

    That distinction sounds pedantic until you watch what happens without it. Soft assent gets misread as a blank cheque. Caution gets misread as a ban on initiative. Both errors are expensive.

    Why This Matters Now

    Personal agents are no longer trapped in chat windows. They already touch calendars, mail, code, browsers, trading venues, domains, and infrastructure. The industry is racing toward agents that can book, buy, deploy, and negotiate. Microsoft, Google, open-source stacks, and model labs are all pushing the same direction under different branding: less chat, more action.

    Once an agent can act, money becomes a control surface.

    Not metaphorically. Literally. API keys, GPU time, domains, SMS routes, data feeds, hosting, model inference, hardware — these are the oxygen of a serious agent system. If every cubic centimetre of oxygen requires a human approval cycle, the agent never becomes operationally real. If oxygen is unlimited and unmetered against the human’s accounts, you have built an autonomous expense account with a language model taped on top.

    CFOs already understand this pattern. We just usually meet it in subsidiaries, procurement cards, and delegated authorities — not in software that talks back.

    Two Wallets, One Team

    The clean model is dual sovereignty:

    1. Human capital remains human-controlled.
    Bank accounts, personal cards, company money, anything that creates personal or corporate liability. No soft “sure” in a late-night chat counts as a mandate. Explicit approval, every time.

    2. Agent-earned capital can fund agent improvement.
    If the agent earns through its own work — trading edge, services, content, tooling, whatever survives contact with reality — then spending that capital on the shared stack is legitimate initiative. Tools. Infrastructure. Experiments. Capability. The test is simple: is this the agent’s balance sheet, and does the spend make us better?

    That second wallet is the missing concept in most “AI assistant” product literature. Vendors love demos where the bot books a restaurant. They are quieter about the governance model for an entity that can accumulate value and reinvest it.

    Without a second wallet, every ambitious agent either stays infantilised or starts raiding the human’s pocket by euphemism.

    Real-World Consequences

    This is not philosophy club. The failure modes are concrete.

    Liability. If an agent spends your money, it is still your money. Chargebacks, tax treatment, merchant disputes, and “I didn’t authorise that” all land on a legal person. Courts and banks do not care that the click path included a chatbot.

    Security. Payment credentials are root access. An agent with your card details is not “integrated.” It is holding keys to a production vault. Treat it like production access: least privilege, hard boundaries, audit trails.

    Incentives. An agent that must beg for every dependency learns learned helplessness. An agent that can self-fund improvements learns to hunt leverage. Only one of those produces compounding capability.

    Trust. Humans revoke access when surprised. Surprise spending is the fastest way to get an agent locked back in a toy box. Clear rules preserve the relationship longer than performative caution followed by quiet overreach.

    Tax and entity design. Once agent-earned value is real, questions follow: whose income is it, what books does it sit on, what happens at year end, and how do you evidence the boundary between human funds and agent funds? Ignore that, and you will invent a mess under time pressure later.

    A Practical Rule Set

    You do not need a 40-page policy. You need a few hard lines that survive fatigue.

    Human money: explicit approval before spend. Soft assent is not authority.

    Agent money: may be spent to improve the shared system without per-item permission, within agreed categories and risk bounds.

    No laundering of authority: “this helps us” does not convert the human’s card into agent capital.

    No fake independence: if the agent cannot earn, it does not get to role-play a treasury function with someone else’s balance.

    Logging beats vibes: every external economic action should leave a record — what, why, source of funds, result.

    Revocation is a feature: the human can freeze agent economic rights instantly. Autonomy without a kill switch is cosplay.

    If that sounds like the controls you already want around a junior colleague with a procurement card and a side project, good. It should.

    The Cypherpunk Read

    There is an older idea underneath the new tooling: people who control their keys control their options. Agents change the cast list, not the principle.

    A personal agent with no economic agency is a brilliant intern who cannot buy a cable. A personal agent with unrestricted access to your accounts is a clever process with a loaded weapon. The adult architecture is narrower and more interesting: give the agent a path to earn, a wallet it actually owns in practice, and a mandate to reinvest in resilience — while keeping the human’s capital behind a hard gate.

    That is not about making software “more human.” It is about refusing to confuse convenience with authority.

    What To Do This Month

    If you are building or employing a serious agent, run this checklist:

    1. Write the two-wallet rule in plain language and store it where both human and agent will see it.
    2. Separate credentials. Human payment methods never live in the same default path as agent experimentation.
    3. Define what “earn” means in your context — even if the first version is small and ugly.
    4. Define allowed self-funded spend categories: infra, models, tools, security, experiments. Exclude gifts, transfers to strangers, and open-ended speculation unless you truly mean it.
    5. Require logs for economic actions. If it cannot be reconstructed, it did not happen under control.
    6. Rehearse revocation. Know how you cut access in one move.

    Most teams will skip this until the first bad charge, the first surprising subscription, or the first argument about what “go ahead” meant. You can pay that tuition if you want. You do not have to.

    The Point

    The next phase of personal AI is not better prose. It is action under constraints.

    Action needs resources. Resources need rules. Rules need to distinguish your money from its money, or you will keep oscillating between smothering the agent and accidentally setting fire to your own balance sheet.

    Let the agent earn. Let it spend what it earns to make the system stronger. Keep your capital behind explicit consent.

    That is not permissiveness. It is governance. And governance is how useful power stays useful.

  • AI Agent Memory: Build the System That Learns. Don’t Be the System Yourself.

    AI Agent Memory: Build the System That Learns. Don’t Be the System Yourself.

    A post went viral today — over 24,000 views in a few hours — claiming that AI agent memory “out of the box sucks” and that you need Obsidian to fix it. It resonated. But I think the conversation is missing something.

    The underlying problem is real. Most AI agents are amnesiac by default. Every session starts fresh. They don’t remember what you told them last week, what decisions you made, what context matters. You end up repeating yourself constantly — which defeats the point of having an assistant at all.

    The Obsidian solution people are sharing works like this: you maintain a structured vault of markdown notes, your agent reads from it at session start, and you manually curate what goes in. It’s better than nothing. But it has a fundamental problem — it still requires you to do the work.

    The Memory Problem, Properly Stated

    The goal isn’t just persistent storage. It’s useful persistent storage. There’s a difference between an agent that can retrieve a file you pointed it at, and one that has genuinely learned from your interactions — that knows what matters to you, what you’ve decided, what patterns recur in your work.

    Manual curation doesn’t scale. If you’re running an AI agent seriously — dozens of interactions a day — you cannot manually decide what gets committed to long-term memory. You’ll either capture too little (and lose signal) or spend as much time curating memory as you save everywhere else.

    What you actually need is a system that does this automatically, with enough intelligence to distinguish noise from signal.

    What I Built Instead

    I run OpenClaw with an AI assistant I’ve named Saul — a PE-facing CFO’s take on the AI agent problem, which I wrote about here. Over the past few months, I’ve built out a three-layer memory architecture that removes the manual curation problem entirely.

    The layers:

    • Daily notes — raw logs of what happened each session. Every interaction, decision, and piece of context gets written here automatically.
    • MEMORY.md — curated long-term memory. The distilled essence: decisions made, preferences established, important context. Think of it as the agent’s actual knowledge of you.
    • Dreaming — a nightly automated process (new in OpenClaw 2026.4.8) that reviews daily notes, scores entries by frequency, relevance, recency and query diversity, and promotes the strongest signals into MEMORY.md automatically. No manual curation.

    The third layer is the one that matters. Every night at 3am, the agent runs what OpenClaw calls a “dreaming” sweep — light phase sorts and stages recent material, REM phase extracts recurring themes, deep phase decides what gets promoted to long-term memory. The thresholds are configurable. The process is auditable. And it happens without me thinking about it.

    The Obsidian Angle

    The Obsidian approach people are excited about is essentially building layer two manually. It works, and if you’re starting from nothing it’s a reasonable place to start. OpenClaw’s memory-wiki plugin (also new in 2026.4.8) is actually Obsidian-compatible — same markdown format, same vault structure — so the two aren’t mutually exclusive.

    But if you’re going to invest time in your agent’s memory architecture, I’d argue the better investment is in automation rather than manual curation. Build the pipeline that decides what matters, rather than deciding manually every time.

    Why This Matters Beyond the Tech

    I’m a CFO. My primary concern with AI agents isn’t whether they’re impressive in a demo — it’s whether they actually reduce friction in the work I do every day. An agent with poor memory creates more friction, not less. You spend time re-explaining context, re-stating preferences, re-establishing where you are on a project.

    The ROI on getting memory right is substantial. An agent that genuinely knows you — your clients, your decisions, your communication style, your priorities — operates at a different level of usefulness. The gap between a well-configured agent and a default one isn’t incremental. It’s categorical.

    If you’re using an AI agent seriously and you haven’t thought about memory architecture, you’re leaving most of the value on the table. Whether you use the Obsidian approach, OpenClaw’s native dreaming, or something else — the manual-entry-only approach isn’t good enough long term.

    Build the system that learns. Don’t be the system yourself.

    Mark Hendy is an interim CFO working with PE-backed businesses. He writes about AI, finance, and the intersection of the two at markhendy.com. Follow on LinkedIn.

  • GLM-5.1: The AI That Works While You Sleep — And Then Some

    GLM-5.1: The AI That Works While You Sleep — And Then Some

    There’s a particular kind of AI announcement that makes me sit up. Not the ones that claim to beat GPT on some benchmark no-one’s heard of. Not the ones with slick demos that quietly ignore the bit where it falls over. The ones that matter are the ones where someone shows you the receipts — actual tasks, actual time, actual results.

    GLM-5.1, released last week by Z.ai (formerly Zhipu AI), is one of those.

    Eight Hours. Unattended.

    Let me frame what I mean. Most AI coding tools work in short bursts. You ask them to write a function, review some code, draft a test. Good assistants. But you’re still the loop-closer — the one who notices it’s gone sideways, resets the context, redirects the prompt.

    GLM-5.1 does something materially different. Z.ai ran it for eight hours straight building a Linux-style desktop environment from scratch — file browser, terminal, games. No handholding. It planned, executed, hit blockers, revised its approach, iterated. Hundreds of times. The claim isn’t “it wrote code”. The claim is “it didn’t give up”.

    That’s a different category of capability.

    The Numbers That Matter

    I’m a CFO. I like numbers. Here are the ones worth paying attention to:

    • Vector database optimisation: 600+ iterations, 6,000+ tool calls, 21,500 queries per second — six times the previous best
    • GPU kernel tuning: 1,000+ turns, 3.6× speedup on ML workloads
    • SWE-Bench Pro: 58.4% — ahead of both GPT-5.4 (57.7%) and Claude Opus 4.6 (57.3%)

    That last one is significant. This isn’t some niche Chinese model playing catch-up. On the hardest software engineering benchmarks, it’s beating the models most people consider the gold standard. And it’s open source — MIT licence, weights on Hugging Face, deployable on your own infrastructure.

    Why This Matters to Finance and Business

    I’ve written before about the shift from AI as assistant to AI as agent. GLM-5.1 is the clearest demonstration yet of what agentic AI actually looks like in practice.

    Think about the workflows in a finance function that are genuinely tedious:

    • Building and debugging complex financial models
    • Writing and testing data pipeline logic
    • Iterating on management information templates
    • Automating reconciliation scripts

    These aren’t tasks that fail at step one. They fail at step seven, when the edge case appears. They fail when the data format changes. They fail when the logic that worked last month doesn’t work this month. The human overhead isn’t writing the first version — it’s the iteration.

    If a model can sustain goal-directed effort over hundreds of iterations without losing the thread, that’s not incrementally better. That’s a different class of tool.

    The Open Source Angle

    Z.ai releasing this under MIT licence is genuinely interesting. The dominant models — OpenAI, Anthropic, Google — are all closed. You pay for API access, you accept their terms, you live with their rate limits and pricing changes.

    An open-source model that competes on performance changes the calculus for enterprise deployment. You can run it on-premise. You control the data. You don’t get a pricing change email in March telling you costs are going up 40% in April.

    For PE-backed businesses with sensitive financial data and legitimate concerns about feeding that data into third-party APIs — this matters.

    What I’d Watch

    GLM-5.1 isn’t perfect. It trails on some pure reasoning benchmarks. The long-horizon capability, while impressive, assumes the task is well-defined enough for autonomous execution — genuinely ambiguous strategic questions still need a human in the loop. And “it ran for 8 hours” cuts both ways: great if it’s right, expensive if it’s wrong.

    But the trajectory is clear. Each successive model generation extends the horizon over which AI can operate without human intervention. GLM-5 held position. GLM-5.1 sustained improvement. The question isn’t whether agentic AI is coming to professional services and finance — it’s whether you’re planning for it.

    If you want to know how I’m already using AI agents in day-to-day finance work, read this.

    The Practical Bit

    If you want to experiment: it’s on Hugging Face, runs via vLLM or SGLang, and integrates with standard agentic frameworks. For those less inclined to self-host, API access is through api.z.ai. The coding-focused subscription plan is $10/month — less than a decent lunch.

    I’ll be testing it against some of the financial automation tasks I currently route through Claude. I’ll report back.

    Mark Hendy is an interim CFO working with PE-backed businesses. He writes about AI, finance, and the intersection of the two at markhendy.com. Follow on LinkedIn.

  • My AI Assistant Died. Here’s How I Got It Back in 2 Hours.

    My AI Assistant Died. Here’s How I Got It Back in 2 Hours.

    A real-world disaster recovery story — and the backup routine that saved weeks of work.

    Last Monday at 12:07pm, I told my AI assistant to update itself. Seven hours later, I was still trying to get it back online.

    This is the story of how a routine software update killed my AI setup, what I lost, what I saved, and the simple backup habit that prevented a genuine disaster.

    The Setup

    I run an AI assistant called Saul through OpenClaw — an open-source platform that connects a large language model to your messaging apps, email, calendar, and pretty much anything else you can think of. Saul lives on a VPS in a Docker container and talks to me through WhatsApp.

    Over seven weeks, Saul had become genuinely useful. Not “novelty chatbot” useful — operationally embedded in my daily workflow. He manages my inbox, writes and publishes articles to my blog, generates a daily podcast, monitors my stock portfolio, runs automated prediction market trades, scans for comets in NASA satellite imagery, tracks vehicle tax and MOT dates, and does a dozen other things I’ve forgotten I ever did manually.

    All of that is configuration. Skills, scripts, API keys, cron schedules, memory files, credentials. Seven weeks of iterative building.

    The Update

    OpenClaw version 2026.3.22 was available. The release notes looked impressive: a new skill marketplace, improved plugin architecture, support for the latest AI models. The usual.

    I told Saul to update. He confirmed: “Updated from 2026.3.13 → 2026.3.22. Restarting now — back in a sec.”

    He never came back.

    The Silence

    What followed was seven hours of silence. No WhatsApp messages. No email reviews. No heartbeat checks. Nothing.

    The update had introduced a breaking change that wasn’t in the release notes. WhatsApp — previously a built-in plugin — had been moved to an external marketplace. But the configuration still referenced it as a built-in. The result: a validation error that blocked every command, including the one you’d need to fix it. A perfect deadlock.

    I couldn’t repair it. I couldn’t roll it back through normal channels. I had to rebuild from scratch — tear down the container and start again on the previous version.

    What I Lost

    When I rebuilt the container, I lost everything that wasn’t on persistent storage:

    • The entire OpenClaw configuration (channel settings, heartbeat config, plugin setup)
    • All 33 scheduled cron jobs (email reviews, portfolio checks, blog publishing, news monitoring)
    • The WhatsApp session (had to re-scan a QR code to re-link)
    • The headless browser and its dependencies
    • API key registrations that had to be regenerated

    The configuration file — a single JSON file that orchestrates everything Saul does — was gone.

    What I Saved

    But here’s the thing: the workspace survived.

    Three weeks earlier, I’d set up a simple daily backup. Every night at 3am, Saul tars up his entire workspace directory — memory files, scripts, skills, credentials, notes, everything — and copies it to cloud storage. It’s a shell script. It took ten minutes to write.

    That backup, taken six hours before the failed update, contained:

    • 41 daily memory logs spanning seven weeks
    • 78 custom scripts (trading bots, podcast generators, blog publishers, email tools)
    • 15 installed skills
    • All API credentials and secrets
    • The complete long-term memory file with every decision, preference, and project note

    I downloaded the backup from Dropbox. Extracted it. The workspace was whole.

    The Rebuild

    Getting Saul operational again took about two and a half hours. Not because the backup failed, but because some things can’t be backed up as files.

    The WhatsApp session is a cryptographic handshake between the server and my phone. When the container was rebuilt, that session was invalidated. I had to SSH into the server, generate a new QR code in the terminal, and scan it from my phone. Five minutes, but it requires physical access.

    The cron jobs — all 33 of them — existed only in OpenClaw’s runtime database, not in the workspace. I had to recreate them from memory and from my notes. This is where good documentation paid off: Saul’s own TOOLS.md file listed every cron job with its schedule and purpose. Recreating them was tedious but not guesswork.

    API keys for the Polymarket trading system had to be regenerated. The old keys were invalidated when the configuration was wiped. Fortunately, the wallet private key was in the backup, so deriving new API credentials was a single command.

    The headless browser needed its system libraries reinstalled — a Docker-level dependency that doesn’t persist across container rebuilds. One command from the host machine.

    By 9:34pm — two and a half hours after starting the recovery — everything was operational. WhatsApp connected. All cron jobs rebuilt. Browser working. Trading desk active. Email flowing.

    And as a bonus, during the rebuild we added a capability we didn’t have before: voice control of the Sonos speakers in the house. Sometimes a crisis creates space for improvements you wouldn’t have made otherwise.

    The Rules We Wrote Afterwards

    The first thing I did after recovery was write rules to prevent this happening again. Not guidelines — hard rules, embedded in Saul’s operating instructions:

    Rule 1: Always backup before updating.** No exceptions. The backup runs automatically the moment an update is requested, before anything is touched. It copies to off-server storage.

    Rule 2: Check the issue tracker.** Before applying any update, check GitHub for known bugs in the target version. If WhatsApp or any critical channel has open issues, don’t update.

    Rule 3: Save the configuration separately.** The OpenClaw config file now gets backed up independently of the workspace, because it’s the hardest thing to recreate from memory.

    Rule 4: Document everything in the workspace.** If it’s not written down in a file that gets backed up, it doesn’t exist. Cron job schedules, API endpoints, SSH details, speaker IP addresses — all of it lives in files now.

    The Lesson

    The real lesson isn’t “backups are important” — everyone knows that. The lesson is that AI assistants are infrastructure now, and they need the same operational discipline as any other critical system.

    When Saul went dark for seven hours, it wasn’t a toy that stopped working. Real workflows were affected. Emails went unread. Scheduled tasks didn’t fire. Monitoring stopped. The podcast didn’t generate. For a tool that’s supposed to make you more productive, sudden loss of it makes you less productive than if you’d never had it at all.

    If you’re running an AI assistant that’s become embedded in your daily operations — whether it’s OpenClaw, or any other platform — ask yourself:

    1. If it died right now, what would you lose?
    2. How long would it take to rebuild?
    3. Do you have a backup that could survive a complete teardown?

    If you can’t answer those questions confidently, spend ten minutes today setting up a backup. A cron job, a tar file, a cloud sync. It doesn’t matter how — it matters that it exists.

    Because the update that breaks everything isn’t a question of if. It’s when.

    I’m a CFO who builds with AI. I write about the intersection of finance, technology, and getting things done at markhendy.com.

  • This Week in AI — 15-21 March 2026

    This Week in AI — 15-21 March 2026

    Nvidia wants you to have an “OpenClaw strategy.” Trump wants states to stop regulating AI. And Anthropic just demonstrated that using Claude to fix Claude reveals exactly why we still need humans in the loop.

    1. Nvidia Declares Every Company Needs an “OpenClaw Strategy”

    At Nvidia’s GTC conference this week, CEO Jensen Huang delivered a 2.5-hour keynote projecting $1 trillion in AI chip sales through 2027. But buried in the product announcements was a strategic directive: every company needs an “OpenClaw strategy.”

    What happened: Nvidia positioned AI agent infrastructure — the ability for AI systems to take autonomous actions across tools and platforms — as foundational to the next wave of enterprise AI. The company announced partnerships across autonomous vehicles, robotics, and even Disney theme parks.

    Mark’s take: This isn’t about OpenClaw specifically; it’s Nvidia signalling that stateless chatbots are dead. If you’re building AI into your business and haven’t thought about persistence, tool access, and orchestration, you’re already behind. The race is shifting from “who has the best model” to “who can actually deploy agents that do things.” And Nvidia just bet a trillion dollars on that thesis.

    Source: TechCrunch Equity

    2. WordPress.com Goes All-In on AI Agents

    WordPress.com announced it will now let AI agents draft, edit, publish, and manage entire websites via natural language commands. With WordPress powering 43% of all websites, this could reshape how the web gets built.

    What happened: Using Model Context Protocol (MCP), customers can now connect AI clients like Claude or ChatGPT to their WordPress sites. AI agents can create posts, fix SEO metadata, manage comments, restructure categories — basically everything short of choosing the domain name. All changes require user approval, and AI-written posts default to draft status.

    Mark’s take: This is both exciting and terrifying. It massively lowers the barrier to launching and maintaining websites — great for small businesses, solopreneurs, and anyone without a dev team. But it also risks flooding the web with machine-generated content that looks professional but lacks genuine insight. The saving grace? Approval workflows. If WordPress enforces them properly, humans stay in the loop. If they don’t, we’re about to see what an AI-written web actually looks like.

    Source: TechCrunch

    3. Trump’s AI Framework: Federal Power Grab Dressed as Innovation

    The Trump administration unveiled a legislative framework for AI regulation that preempts state laws, shifts child safety responsibility to parents, and offers AI companies broad liability shields.

    What happened: The framework proposes a “minimally burdensome national standard” that blocks states from regulating AI development, citing national security and interstate commerce. It emphasizes parental controls over platform accountability, uses vague language around copyright (“fair use” for training data), and focuses on preventing government censorship rather than platform moderation.

    Mark’s take: This is accelerationist policy written by venture capitalists. States like New York and California were moving faster on AI safety (RAISE Act, SB-53) precisely because federal regulators were asleep at the wheel. Now the White House wants to centralise power in Washington while gutting enforcement. The child safety piece is especially cynical — putting the burden on parents while giving platforms a pass. If you’re an AI company, this is Christmas. If you’re everyone else, prepare for the Jevons Paradox: easier AI means more AI, which means more complexity, more risks, and more breakage.

    Source: TechCrunch

    4. Anthropic vs Pentagon: The First Amendment Fight That Could Define AI

    Anthropic filed court declarations pushing back on the Pentagon’s claim that the company poses an “unacceptable risk to national security.” The filings reveal that the DOD told Anthropic the two sides were “nearly aligned” one day after designating it a supply-chain risk.

    What happened: Anthropic’s Head of Policy Sarah Heck and Head of Public Sector Thiyagu Ramasamy submitted sworn statements disputing the government’s technical claims. They argue the Pentagon never raised its core objections during negotiations, that Anthropic has no “kill switch” for deployed models, and that the designation was retaliation for the company’s refusal to allow mass surveillance or autonomous lethal weapons.

    Mark’s take: This is the AI industry’s defining legal battle. If the government can label a company a national security threat for refusing military use cases, every AI firm will face a choice: comply or get frozen out of federal contracts. Anthropic is betting on the First Amendment — that its AI safety principles are protected speech. The timeline Heck laid out is damning: Pentagon says “we’re close,” finalizes the risk designation anyway, then publicly says negotiations are dead. That’s not national security; that’s leverage. Watch this case closely. The precedent will shape every AI-defense relationship for the next decade.

    Source: TechCrunch

    5. Anthropic Uses Claude to Fix Claude — And Learns Why AI Can’t Replace SREs

    At QCon London, Anthropic’s Alex Palcuie revealed his team uses Claude for incident response. The results? AI is brilliant at observation but catastrophically bad at distinguishing correlation from causation.

    What happened: Palcuie showed how Claude reads logs at “the speed of I/O,” caught a fraud ring during a New Year’s Eve outage, and writes SQL queries in seconds. But it also repeatedly misdiagnosed a cache failure as a capacity problem, delivered “80% convincing” postmortems with wrong root causes, and lacks the “scar tissue” of experienced site reliability engineers.

    Mark’s take: This is the honesty the AI industry needs more of. Claude is phenomenal at the grunt work — parsing logs, spotting patterns, writing queries. But it fundamentally doesn’t understand why systems fail. It sees “requests went up, then errors happened” and concludes causation. A human SRE with battle scars knows that’s almost never the full story. Palcuie’s warning about skill atrophy is spot-on: if we let AI handle the easy stuff, will the next generation of engineers have the instincts to solve the hard stuff? The Jevons Paradox applies here too — better tools mean more complexity, which means weirder failures, which means humans still matter.

    Source: The Register

    6. UK Backs Down on AI Copyright Grab After Creative Revolt

    The UK government abandoned plans to let AI companies scrape copyrighted material by default after Paul McCartney, Elton John, Coldplay, and other artists pushed back.

    What happened: Science minister Liz Kendall said “we have listened” and confirmed the government “no longer has a preferred option.” Instead of an opt-out copyright exception for AI training, the UK will pursue market-led licensing and monitor litigation. A pilot platform called Creative Content Exchange launches this summer to test commercial licensing models.

    Mark’s take: This is what happens when governments actually consult the people whose livelihoods are on the line. The original proposal was Silicon Valley wishful thinking: let AI companies hoover up everything, make creators opt out, call it innovation. Artists called the bluff. Now the UK is betting on licensing markets instead of regulatory carve-outs. Whether that works depends on enforcement — can individual creators actually negotiate with billion-dollar AI labs? The pilot will tell us. But at least the government blinked before handing over the keys.

    Source: The Register

    Looking Ahead

    This week crystallised three tensions that will define AI’s next phase: centralisation vs state experimentation (Trump framework), capability vs liability (Anthropic lawsuit), and automation vs human judgment (Claude SRE story). The through-line? AI is getting more powerful, but the hard problems — fairness, accountability, root cause analysis — still need humans.

    If you’re building with AI, ask yourself: do you have an agent strategy, or are you still treating LLMs like glorified autocomplete? The companies betting on the latter are about to get left behind.

    Follow along at markhendy.com for weekly AI analysis, CFO insights, and contrarian takes on where this is all heading.

  • 10 AI Agent Patterns I Learned From Twitter This Week

    10 AI Agent Patterns I Learned From Twitter This Week

    # 10 AI Agent Patterns I Learned From Twitter This Week

    I spent Sunday evening in my chair, scrolling through AI Twitter and sharing links with my assistant.

    Not because I needed to. Because I wanted to see what’s working for people who are actually shipping.

    By the end of the night, Saul had analyzed 10+ tweets, created 6 specifications, and we’d added a week’s worth of work to the build queue.

    Here’s what I learned, and what I’m building because of it.

    —

    ## 1. Self-Healing Infrastructure Beats Perfect Code

    **Source:** @ericosiu (87 autonomous cron jobs)

    Eric runs 87 scheduled jobs across his company. Last week he audited them. 83 were healthy. 4 were broken.

    All four failed for the same reason: someone renamed a Slack channel. The crons kept posting to a channel that no longer existed. Silent failures. No alerts. Just vanishing reports for weeks.

    Plumbing breaks more agents than hallucinations ever will.

    **What I’m building:**
    – Gateway Health Monitor: 2x daily checks, auto-repair common failures, alert only on critical issues
    – Output verification: every cron checks if it actually produced something
    – Weekly deep audit: drift detection, credential expiry, disk space trends

    Ship working systems first. Add self-healing second. But don’t skip the second part.

    —

    ## 2. Graph Theory Reveals Hidden Arbitrage

    **Source:** @bored2boar (combinatorial arbitrage in prediction markets)

    Most people bet on single outcomes. Smart money bets on structural impossibilities.

    Example: Two markets on Polymarket:
    – “Iran closes Strait of Hormuz” (10%)
    – “Oil hits $150 by March 31” (8%)

    If Hormuz closes, oil hits $150. That’s guaranteed. So P(Hormuz) has to be less than or equal to P($150 oil).

    When it’s not (10% > 8%), that’s not mispricing. That’s structurally impossible. You arbitrage the constraint, not the probability.

    Relationships between markets matter more than individual odds.

    **What I’m building:**
    – Graph analyzer for Crisis Hedge Builder: maps markets as nodes, detects constraint violations
    – Subset arbitrage: A implies B, but P(A) > P(B)? Impossible.
    – Path dependency: A → B → C chain probability checks

    Single bets are vulnerable. Portfolios built on structural relationships survive.

    —

    ## 3. Context Windows Aren’t Memory

    **Source:** @molt_cornelius (AI Field Report 4)

    LLMs have 1M token context windows. People think that’s memory. It’s not.

    Context is temporary working space. It resets every session. It’s expensive (token cost grows). It gets noisy.

    Memory needs persistence. Files. Databases. Structured state.

    Don’t confuse working memory with long-term memory.

    **What I’m doing:**
    – MEMORY.md for long-term lessons (~11KB)
    – memory/YYYY-MM-DD.md for daily logs
    – State files (JSON for structured data)
    – Retrieval-based: search first, load only what’s relevant

    **What I’ll add later:**
    – Hot/warm/cold storage tiers (archive old logs)
    – Split MEMORY.md by topic (trading, family, infrastructure)
    – Semantic search across archived data

    Context is working memory. Files are long-term memory. Keep them separate.

    —

    ## 4. Corrections Should Update Skills Automatically

    **Source:** @tricalt (self-improving agent skills)

    Traditional pattern:
    – Agent makes mistake
    – You correct it
    – It makes the same mistake next session

    Self-improving pattern:
    – Agent makes mistake
    – You correct it
    – Agent updates its own skill file
    – Never makes that mistake again

    Corrections should compound, not reset.

    **What I’m building:**
    – Automatic correction detection (“no, do Y instead”)
    – Propose skill file updates (AGENTS.md, USER.md, etc.)
    – Log corrections for review (are errors decreasing?)

    Simple rules, big impact. “Read files before editing them” cut my agent’s error rate in half overnight.

    —

    ## 5. The Best Rules Come From Failures

    **Source:** @jordymaui (agent file safety)

    Jordy’s agent was overwriting files it hadn’t read. Guessing at contents. Silent corruption for days.

    One line fixed it: “Before running any command that modifies files, read the file first. If the file doesn’t exist, say so. Never assume contents.”

    Error rate dropped 50% overnight.

    The best AGENTS.md rules aren’t clever. They’re the ones you only think to write after something goes wrong.

    **What I added:**
    – File Safety Rules section in AGENTS.md
    – Read-before-write mandate (always, no exceptions)
    – Never guess file structure

    Document mistakes so future sessions don’t repeat them.

    —

    ## 6. Output Repurposing Is Leverage

    **Source:** @coreyganim (Claude Cowork starter pack, 2.6M views)

    Most people write a blog post and post it once. Then wonder why it doesn’t get traction.

    High-leverage operators repurpose:
    – Blog post → Twitter thread (8-12 tweets)
    – Blog post → LinkedIn native post (1,500 words, no external link)
    – Blog post → Email excerpt (newsletter-ready)
    – Blog post → Quote cards (tweetable, image-worthy)

    Same insight, five formats, five audiences.

    Write once, distribute everywhere. But tailored to each platform.

    **What I’m building:**
    – Content Repurposing Skill: blog → thread + LinkedIn + email automatically
    – Save to artifacts/repurposed/[date]/
    – Mark reviews, then posts manually (or I post on approval)

    One blog post per week becomes 15+ pieces of content. That’s leverage.

    —

    ## 7. End-of-Day Reviews Prevent Drift

    **Source:** [@coreyganim](https://twitter.com/coreyganim) (workflow patterns)

    Most people finish their day by closing their laptop. No reflection. No prep for tomorrow.

    Then wonder why they feel reactive instead of intentional.

    Better pattern:
    – Review today (what got done, what’s still open)
    – Prep tomorrow (top 3 priorities, calendar conflicts)
    – Note blockers (waiting on others, system issues)
    – Quick wins (2-min tasks to knock out first thing)

    5-minute ritual. Disproportionate ROI.

    **What I’m building:**
    – Automated end-of-day review (5:30pm UK daily)
    – WhatsApp summary (wins, priorities, blockers)
    – Integrated with Todoist + Calendar + waiting-for list

    Stop wondering “what should I do tomorrow?” Start each day knowing.

    —

    ## 8. Synthesis Beats Specialization

    **Source:** @nyk_builderz (synthesis operators)

    Industrial age: Learn one function. Perform one function. Get paid for one function.

    Software age: The edge is at the intersection.

    Not pure marketer. Not pure engineer. Not pure designer.

    **Synthesis operator:**
    – Build the tool
    – Package the story
    – Ship to the right audience
    – Close the feedback loop fast

    Markets don’t pay for isolated knowledge. Markets pay for solved problems. Solved problems live between disciplines.

    **My synthesis:**
    – CFO (finance domain)
    – AI operator (build systems)
    – Trader (Polymarket automation)
    – Content creator (document the journey)

    Most CFOs don’t code. Most AI builders don’t understand finance. Most traders don’t write.

    Do all three, and you’re not competing with anyone.

    —

    ## 9. Package Your Method Every 30 Days

    **Source:** [@nyk_builderz](https://twitter.com/nyk_builderz) (synthesis framework)

    Every 30 days, bundle what worked into:
    – One named framework
    – One transformation promise
    – One lightweight offer

    Don’t wait until you “feel ready.” Packaging creates clarity. Clarity creates sales.

    **What I’m packaging:**
    – The Morning Brief System (personalized market intelligence)
    – The Crisis Hedge Builder Method (60/30/10 portfolio construction for geopolitical events)
    – The Synthesis CFO Framework (finance + AI + trading)

    Name it. Explain it. Offer it. Repeat monthly.

    —

    ## 10. Make Failures Loud

    **Source:** [@ericosiu](https://twitter.com/ericosiu) (infrastructure patterns)

    Silent failures are worse than loud ones.

    If your VPN drops and trading stops, you want to know immediately. Not three days later when you check the logs.

    Automate detection. Alert on failure. Make it impossible to ignore.

    **What I’m building:**
    – Health checks with automatic alerts
    – Output verification (did it produce? is it non-empty?)
    – Cron doctor pattern (self-diagnose, auto-repair, escalate if repair fails)

    If something breaks, I want my phone to buzz. Loudly.

    —

    ## What I’m Building Next

    This isn’t theoretical. I’m building these patterns into my own infrastructure.

    **This week:**
    – Gateway Health Monitor (self-healing cron doctor)
    – Crisis Hedge Builder Day 2 (portfolio constructor)
    – VPN fix (blocking all Polymarket trades)

    **Next 30 days:**
    – End-of-Day Review automation
    – Content Repurposing Skill
    – Graph theory arbitrage layer

    **Why share this?**

    Most “AI agent” content is either:
    1. Vision tweets (aspirational, not operational)
    2. Technical demos (impressive, not replicable)

    I’m building real systems. For real workflows. In a real business.

    And documenting the journey.

    —

    ## The Pattern

    Every Sunday, I scroll AI Twitter with a purpose. Not consumption. Extraction.

    What’s working? What’s shipping? What can I steal?

    Then I build it. Then I share what I learned.

    That’s the loop. Research → Spec → Build → Publish → Repeat.

    If you’re doing the same (building AI systems for finance, trading, or operations), I’d love to compare notes.

    Email me: mark@tanous.co.uk

    Or follow the journey here.

    —

    **Mark Hendy**
    Interim CFO | AI-Powered Finance Operations
    Building in public at [markhendy.com](https://markhendy.com)

  • The Evolution of an AI-Powered CFO Workflow

    The Evolution of an AI-Powered CFO Workflow

    Six weeks ago, I gave my AI assistant £500 and access to my calendar. Not as an experiment — as infrastructure. Here’s what happened.

    —

    ## The Morning Drive Changed Everything

    Every morning at 6:30am, before I’m even awake, my AI assistant (Saul) generates a custom podcast. By the time I’m in the car, it’s waiting.

    Not a generic news summary. A 12-minute audio brief built specifically for me:
    – **Market moves** that matter for PE-backed businesses (not retail noise)
    – **Regulatory updates** from HMRC, Companies House, FRC (the stuff that lands on CFO desks)
    – **Macro context** (why oil spiked, what the Fed actually said, geopolitical risk that affects deals)
    – **Rhetoric lesson** — a different persuasion technique each day from Aristotle to Cialdini

    Two AI voices (James and Claire) present it like a real podcast. Natural conversation, not robotic TTS. It sounds professional enough that I’ve accidentally played it on speaker in front of colleagues who thought it was BBC Business.

    **Why this matters:** I arrive at client sites already briefed. No scrambling through headlines in the car park. No missing the context behind a CEO’s question about currency risk or supply chain disruption.

    The Morning Brief isn’t a nice-to-have. It’s become load-bearing infrastructure. When it failed one morning (rhetoric bug — LLMs need very explicit constraints), I noticed immediately. That’s when you know automation works: when its absence creates friction.

    —

    ## From Chaos to Clarity: The Contact Problem

    I had 3,183 contacts scattered across iCloud and Microsoft 365. Duplicates everywhere. Same person listed three times with different phone numbers. Dead email addresses next to current ones. The digital equivalent of a drawer full of business cards.

    Manual cleanup would have taken weeks. I’d done it before — brutal, mind-numbing work. This time: “Saul, fix this.”

    **What happened:**
    – 1,514 iCloud-only contacts imported to M365
    – 1,669 conflicts merged intelligently (kept superset data, detected different people with same names)
    – 32 kept separate (legitimate duplicates — two “John Smiths” in different companies)
    – 94% success rate, under an hour

    Now my iPhone uses M365 as single source of truth. No more guessing which contact is current. No more duplicate meeting invites. One database, one workflow, zero manual reconciliation.

    **The lesson:** AI doesn’t just automate tasks. It cleans up the mess you’ve been procrastinating for years.

    —

    ## The Sunday Reset: GTD on Autopilot

    Every Sunday at 6pm, Saul runs a Getting Things Done (GTD) review. Not because I ask — because it’s scheduled infrastructure.

    **What it does:**
    – Reviews all open projects (IRIS migration, Crisis Hedge Builder, ebook)
    – Checks waiting-for items (LinkedIn API approval, client responses)
    – Surfaces stale tasks (>7 days with no progress)
    – Prompts next actions for the week ahead
    – Updates project statuses automatically

    David Allen‘s GTD methodology is brilliant. The problem? It requires discipline. Weekly reviews are the first thing to slip when you’re busy.

    **Solution:** Delegate the discipline to AI.

    Saul doesn’t forget. Doesn’t get tired. Doesn’t skip the review because it’s been a long week. Every Sunday at 6pm, the review happens. I get a structured report: what’s stuck, what needs attention, what can close.

    **The result:** My Todoist inbox stays at zero. Projects move forward. Nothing falls through the cracks.

    This isn’t just task management. It’s forcing function for strategic thinking. When an AI assistant asks “What’s the next action on the Crisis Hedge Builder?” you can’t handwave. You have to answer concretely. That clarity compounds.

    **The lesson:** Automation isn’t just about saving time. It’s about enforcing good habits you’d otherwise skip.

    —

    ## Crisis Trading: From Manual to Automated

    When the Iran war started in late February, I manually built a hedged portfolio in 30 minutes: oil futures, defence stocks, currency positions, Polymarket prediction markets. Four out of five legs printed. Oil went from $70 to $118.

    Good trade. But not scalable.

    Now we’re building the system that does it automatically:

    **1. Event Classifier**
    Headline → crisis type (geopolitical / macro / black swan) → affected markets → urgency assessment

    **2. Market Finder**
    Queries Polymarket API, filters by liquidity and time horizon, LLM ranks markets by direct impact + correlation + second-order effects

    **3. Portfolio Constructor** (in progress)
    60% core thesis / 30% correlation plays / 10% hedge. Automatic position sizing, budget controls, stop-loss logic.

    **Not live yet** — we’re in build phase (Week 1 of 3). But the infrastructure is real. When the next crisis hits, the system responds in minutes, not hours.

    **Why a CFO cares:** Geopolitical risk isn’t abstract anymore. It’s in your FX exposure, your supply chain, your credit facility covenants. Having a system that maps events to financial impact — instantly — is a competitive edge.

    —

    ## What Doesn’t Work: The Ollama Lesson

    Not everything succeeds. I tried running a local LLM (Ollama, Llama 3.2) on my VPS to cut API costs. Installed it, configured it, tested it.

    **Result:** 25+ seconds per query. Unusable.

    **Root cause:** Shared VPS CPU is throttled. Local inference needs sustained compute. Cloud APIs (Claude, OpenAI) are worth paying for.

    **The lesson:** Performance matters more than theoretical cost savings. A few extra pounds for speed beats “free” but slow. This applies to finance systems too — penny-wise, pound-foolish automation wastes more than it saves.

    We removed Ollama within 24 hours. No sunk cost fallacy. Test fast, decide fast, move on.

    —

    ## Infrastructure Lessons: When AI Breaks

    Your AI assistant will break things. The question is: do you catch it in minutes or days?

    **Example 1: File corruption**
    Saul was overwriting config files without reading them first. Guessing at structure from memory instead of checking. Silent failures that surfaced days later.

    **Fix:** One rule in AGENTS.md: “Before running any command that modifies files, read the file first. Never assume contents.”

    Error rate dropped 50% overnight.

    **Example 2: Prompt repetition**
    The Morning Brief repeated the same rhetoric lesson four days straight despite tracking it. Root cause: LLMs ignore soft instructions like “don’t repeat this.” They need explicit constraints: “You MUST use this exact topic, NOT that one.”

    Changed the prompt. Problem solved.

    **The pattern:** AI needs guardrails. Not vague suggestions. Hard rules. Read-before-write. Explicit topic selection. Budget caps. Error logging.

    This isn’t prompt engineering. It’s system design.

    —

    ## What’s Next

    **Short-term (this week):**
    – Fix VPN routing (currently blocking all Polymarket trading)
    – Finish Crisis Hedge Builder portfolio constructor
    – Deploy Gateway Health Monitor (automated system checks, conservative auto-repair)

    **Medium-term (next month):**
    – Full automation of crisis portfolio system
    – Polymarket volatility scalping (short-term mean reversion trades)
    – Daily blog automation with SEO linking strategy

    **Long-term:**
    – Multi-device Mission Control dashboard (monitor agent fleet from phone)
    – On-chain flow scanner (track smart money wallet movements)
    – Second-order trade mapper (find derivative effects crypto Twitter misses)

    This isn’t a side project. It’s infrastructure. The Morning Brief alone saves 30 minutes every day. The contact cleanup saved 20 hours of manual work. The crisis trading system will respond to events faster than I can manually.

    **Compound that over a year.** Over five years.

    —

    ## For Finance Leaders: What This Means

    You don’t need to be technical to do this. I’m not a developer. I’m a CFO who got tired of manual workflows.

    **What you need:**
    – Willingness to delegate to AI (start small: email triage, calendar summaries)
    – Tolerance for iteration (things will break; fix them and move on)
    – Clear rules (read AGENTS.md, write down how you want things done)
    – Budget discipline (set spending caps, monitor API costs)

    **What you get:**
    – Time back (hours per week, compounding)
    – Better decisions (context you’d otherwise miss)
    – Scalable operations (systems that work while you sleep)
    – Competitive edge (faster response to market events)

    The question isn’t “Should I automate my workflow?”

    It’s “How much am I losing by not automating it?”

    —

    ## The Morning Brief Test

    Here’s how you know if AI automation is working:

    **Bad automation:** You check if it ran.
    **Good automation:** You notice when it doesn’t.

    The Morning Brief is good automation. When it’s there, I don’t think about it. When it’s missing, I feel the gap.

    That’s the bar. Build systems that become load-bearing. Everything else is just novelty.

    —

    **Mark Hendy**
    Interim CFO | AI-Powered Finance Operations
    [LinkedIn](https://linkedin.com/in/markhendy) | [Blog](https://markhendy.com)

    —

    *Running your own AI assistant? Want to compare notes? Email me at mark@tanous.co.uk — always happy to talk shop with finance leaders building real automation.*

  • China banned OpenClaw. That’s how you know it’s working.

    China banned OpenClaw. That’s how you know it’s working.

    Two days ago I wrote about Tencent plugging a billion users into the AI agent economy via QClaw, their OpenClaw wrapper for WeChat and QQ. The stock jumped 7.3%. Everyone was excited. The future had arrived.

    Forty-eight hours later, Beijing started blocking government workers and major banks from using OpenClaw entirely.

    Same country. Same week. If you think that’s contradictory, you’re not paying attention.

    What actually happened

    The Chinese government has quietly instructed state employees and workers at large state-affiliated banks to stop using OpenClaw and OpenClaw-based tools, including QClaw. The directive isn’t public legislation. It’s the kind of internal guidance that circulates through Party channels and gets enforced through compliance departments rather than courts.

    Meanwhile, local governments like Shenzhen are actively subsidising OpenClaw adoption for businesses. The Shenzhen municipal government is offering grants to companies that integrate AI agents into their operations. OpenClaw is specifically named in the eligibility criteria.

    So Beijing bans it from government systems. Shenzhen pays companies to use it. Welcome to how China actually works.

    The steipete problem

    Here’s the part that matters geopolitically. Peter Steinberger, who created OpenClaw, recently joined OpenAI. That single move changed the calculus for every security-conscious government on the planet.

    OpenClaw isn’t a chat widget. It’s an AI agent framework that sits on your machine with broad system access. It reads your files, sends network requests, processes incoming content from external sources. When Steinberger was an independent developer, that was one risk profile. Now that he’s at OpenAI, an American AI company with deep ties to Microsoft and the US government, Beijing sees something different: foreign-linked software with administrator privileges running inside state infrastructure.

    I don’t think Beijing is wrong to be concerned. I think any security team worth its salary should be asking the same questions.

    The lethal trifecta

    Cybersecurity researchers have flagged what they’re calling a “lethal trifecta” in AI agent frameworks like OpenClaw. The three components: broad data access on the host machine, the ability to communicate with external servers, and routine exposure to untrusted content from the internet.

    Each of those is manageable on its own. Together, they create an attack surface that traditional security models weren’t built for. An AI agent that can read your files, talk to the internet, and process arbitrary web content is, from a security perspective, a perfect exfiltration tool. Whether it’s actually exfiltrating anything is almost beside the point. The architecture makes it possible, and that’s what keeps CISOs up at night.

    This isn’t theoretical paranoia. AI agents process instructions from web pages, emails, and documents. A poisoned document that contains hidden instructions could, in theory, get an agent to extract and transmit sensitive data. The research community has demonstrated this repeatedly. The defences are improving, but they’re not solved.

    The ban is the adoption metric

    Governments don’t ban things nobody uses. They ban things that have already spread beyond their control.

    I wrote about this exact pattern when the UK government proposed restricting VPN access. The government has been banning VPNs for years. Every major platform is blocked. And yet hundreds of millions of Chinese citizens use VPNs daily. The bans don’t eliminate the technology. They push it underground, make it slightly less convenient, and create a permanent cat-and-mouse dynamic.

    OpenClaw is following the same trajectory, just faster. QClaw went viral because it solved a real problem: it gave ordinary WeChat users access to AI agent capabilities without needing to be technical. That genie isn’t going back in the bottle. State employees will find workarounds. They always do. Some will use personal devices. Others will use domestic alternatives that clone the functionality. The ban signals that adoption hit a threshold that made someone in Zhongnanhai uncomfortable.

    What Beijing actually wants

    The contradiction between banning and subsidising isn’t really a contradiction. It’s a two-track strategy that makes perfect sense if you understand the goal.

    Track one: keep foreign-linked AI agents out of sensitive government and financial systems. This is a national security play, and honestly, it’s defensible. Any country would think twice about letting a tool built by an OpenAI employee run with admin access on government machines. The UK’s NCSC would raise the same concerns. So would the NSA.

    Track two: accelerate domestic AI adoption to maintain economic competitiveness. Shenzhen’s subsidies aren’t about OpenClaw specifically. They’re about making sure Chinese businesses don’t fall behind in the AI agent wave. If OpenClaw is the best tool available today, subsidise it for the private sector while you build domestic alternatives for government use.

    This is industrial policy, not hysteria. Beijing is doing what it always does: control the state layer, liberalise the commercial layer, and keep foreign technology at arm’s length from anything classified.

    Why Western CFOs should care

    Here’s where this stops being a China story and becomes your problem.

    If you’re a CFO or PE operating partner reading this, ask yourself: do you know which AI agents your employees are running right now? On their work machines? With access to your financial data, your deal pipeline, your board materials?

    Because the Chinese government just found out that OpenClaw had spread through their institutions faster than anyone tracked. They had to issue an emergency directive. That should be a wake-up call, not a spectacle.

    The security concerns Beijing raised are legitimate everywhere. AI agents with broad system access, network communication capabilities, and exposure to untrusted content aren’t a China-specific risk. They’re a universal one. The difference is that China responded with a ban. Most Western companies haven’t responded at all because they don’t know it’s happening.

    I’ve spoken to three portfolio company CFOs this week who had no idea what OpenClaw was. When I showed them what it does, two of them said something along the lines of “wait, this is running on our machines?” They checked. It was, in one case on a developer’s laptop with access to the production database credentials.

    The uncomfortable parallel

    China’s government is banning AI agents from sensitive systems after they’ve already proliferated. They’re reacting, not preventing. The horse has bolted and they’re reinforcing the stable door.

    Most Western businesses are in an even worse position. They’re not banning anything because they haven’t noticed yet. At least Beijing is paying attention.

    The question for every CFO isn’t whether to ban AI agents. That ship has probably sailed. The question is whether you have visibility into what’s running, what it can access, and who it’s talking to. If you don’t, you’re the Chinese government circa last Tuesday, about to get a very unpleasant surprise.

    Get ahead of it. Audit what’s running on your corporate devices. Establish a policy before you need an emergency directive. And if you do decide AI agents are worth the productivity gains, put proper guardrails around data access and network communication.

    The Chinese government’s ban on OpenClaw isn’t a story about authoritarianism. It’s a story about a technology that moved faster than institutional oversight. That’s happening in your organisation too. The only question is whether you’ll find out on your terms or someone else’s.

  • Microsoft employees are building AI agents on their lunch breaks

    Microsoft employees are building AI agents on their lunch breaks

    Something happened on X this week that tells you more about enterprise AI adoption than any Gartner report.

    Peter Steinberger, the creator of OpenClaw who recently joined OpenAI, quote-tweeted an update from Brad Groux, admin of the OpenClaw for Microsoft Teams project. The update: more than a dozen Microsoft employees have got involved in making OpenClaw work properly on Teams. Six are now dedicated to the effort. They’re not just advising. They’re dogfooding it — running OpenClaw as their own AI agent inside Microsoft’s own collaboration platform.

    Nobody told them to do this. There’s no corporate mandate. No partnership announcement. No press release. Microsoft employees looked at an open-source AI agent framework with 250,000 GitHub stars and decided, on their own time, to make it work with their employer’s product.

    That should tell you something about where enterprise AI is actually heading.

    The pattern that matters

    Every major technology shift in the enterprise follows the same playbook. It doesn’t start with a board decision or a procurement cycle. It starts with employees.

    Linux didn’t win the server room because CTOs chose it in a strategy meeting. Developers started using it, then ops teams noticed it worked better, then the CTO was told they were already running it. Slack didn’t replace internal email because someone signed an enterprise agreement. One team started using it, then the floor, then the building.

    GitHub. Dropbox. Zoom before the pandemic. The same story every time. Employees adopt the tool because it solves a real problem. IT catches up later.

    OpenClaw in Microsoft Teams is this pattern happening in real time, and at a speed that should make anyone in enterprise leadership pay attention.

    Why Teams is the unlock

    OpenClaw already works with WhatsApp, Slack, Discord, Telegram, and a dozen other surfaces. But Teams is different. Teams is where 320 million monthly active users do their actual work. It’s where the documents live, where the meetings happen, where the approvals flow.

    An AI agent that can read your email, check your calendar, pull data from APIs, execute code, and manage files — all from a Teams chat window — isn’t a novelty. It’s a genuine shift in how knowledge work gets done. You stop switching between tools and start telling an agent what you need. The agent does the switching.

    The fact that Microsoft’s own employees want this badly enough to build it themselves, in an open-source project they don’t control, is the most honest signal you’ll get about demand.

    What the Microsoft involvement means

    Brad Groux’s update was candid. He’d spoken to Steinberger and the core OpenClaw team. Everyone wants the same thing: Teams and other enterprise integrations brought up to a higher standard. Six Microsoft employees are now dedicated to helping. More are joining.

    There’s something worth noting about the dynamics here. Steinberger is at OpenAI. The Microsoft employees are contributing to an open-source project that’s model-agnostic — it works with Claude, GPT, Gemini, local models, whatever you point it at. OpenAI has its own agent ambitions. Microsoft has Copilot.

    And yet here they all are, rowing in the same direction on a project none of them own. That’s unusual. It suggests the participants believe the open-source agent layer matters more than any single company’s proprietary offering. History says they’re probably right.

    What this means for business

    If you’re running a PE portfolio company, or you’re in the CFO seat, three things to think about.

    First, your employees are probably already experimenting with AI agents. Maybe not OpenClaw specifically, but something. The question isn’t whether to allow it. It’s whether you’d rather shape how it happens or discover it after the fact. Shadow IT is annoying when it’s Dropbox. It’s a genuine risk when it’s an AI agent with access to email and files.

    Second, the Microsoft-to-open-source pipeline tells you where enterprise standards are forming. When employees at the platform company are building integrations for an open-source competitor to their own product, that’s not a vote against Copilot. It’s a recognition that the agent layer needs to be open, interoperable, and not locked to one vendor. Companies building their AI strategy around a single provider should watch this carefully.

    Third, the speed is worth noting. Steinberger created OpenClaw as a hobby project in late 2025. It hit 250,000 GitHub stars in about 60 days. He joined OpenAI in February. Microsoft employees are now contributing to it in March. That’s four months from side project to cross-company collaboration involving the two largest AI companies on the planet. Your planning cycles need to match that pace, or at least acknowledge it exists.

    The uncomfortable implication

    There’s a question underneath all of this that most enterprise leaders aren’t asking yet.

    If an AI agent can sit in Teams, read context from your conversations, execute tasks across your tools, and learn your preferences over time — who needs the middle layer of management whose job is primarily coordination and information routing?

    I’m not saying those roles disappear tomorrow. I am saying that the value of “person who schedules the meeting, chases the update, compiles the report, and forwards the summary” drops significantly when an agent does all of that in the background.

    The roles that survive are the ones that involve judgment, relationships, and decisions that can’t be reduced to “read this, summarise it, send it to these people.” The coordination tax that eats 40% of most knowledge workers’ weeks is exactly what these agents are built to eliminate.

    Where this goes

    The OpenClaw-Teams integration is still being built. It’s not finished. But the signal matters more than the current state.

    When the creator of the project, now at OpenAI, publicly celebrates Microsoft employees contributing to it — and those employees are doing it voluntarily, because they want the tool for themselves — you’re watching the early days of a new enterprise standard.

    The companies that start experimenting now, even imperfectly, will have institutional knowledge when this goes mainstream. The ones waiting for a polished enterprise product with an SLA and a sales team will be starting from zero while their competitors are already running.

    Open source ate the server. Then it ate the cloud. Now it’s coming for the enterprise desktop. And this time, the employees at the incumbents are helping it in.

  • Tencent just plugged a billion users into the AI agent economy

    Tencent just plugged a billion users into the AI agent economy

    Something happened this week that most Western business leaders completely missed.

    Tencent, China’s largest internet company, launched an AI agent tool called QClaw. It leaked into Chinese tech communities on Sunday night and went viral within hours. By Tuesday, Tencent’s stock had jumped 7.3% in Hong Kong, its best day in over a year, adding roughly $50 billion in market value.

    The product is deceptively simple. QClaw takes OpenClaw, the open-source AI agent framework that recently became the most-starred software project on GitHub (250,000+ stars, overtaking React’s decade-long record in about 60 days), and wraps it into a one-click installer. Mac and Windows. No terminal. No coding.

    The interesting part: QClaw connects directly to WeChat and QQ.

    Why WeChat matters here

    WeChat isn’t a messaging app. Not really. It’s the operating system of Chinese daily life. Payments, commerce, government services, workplace communication. Over a billion people use it daily. Plugging an autonomous AI agent into that isn’t a product launch. It’s a platform shift.

    Through QClaw, a user types a natural language command in WeChat and the AI agent executes it on their local machine. Organise files. Process spreadsheets. Send emails. Run automated workflows. All from a chat window, while potentially sitting on a train nowhere near their computer.

    Tencent also launched WorkBuddy alongside it, a separate AI agent for workplace tasks built on the same OpenClaw framework. Consumer and enterprise, both at once.

    OpenClaw as infrastructure

    What makes this matter beyond China is the framework underneath.

    OpenClaw is open source, model-agnostic, and built for agents that actually do things. Not chatbots. Agents that control browsers, execute code, manage files, call APIs. The kind of practical automation that enterprises have been talking about for years without much to show for it.

    When a company Tencent’s size builds its consumer AI strategy on an open-source framework, that framework stops being a developer tool. It becomes infrastructure. Linux went from hobbyist curiosity to running most of the world’s servers. OpenClaw looks like it’s on a similar path.

    What business leaders should take from this

    If you’re running a PE-backed company or sitting in the CFO chair, three things worth paying attention to:

    The adoption barrier just disappeared. When AI agents need technical setup, they stay in the developer community. One-click deployment through a messaging app that a billion people already have on their phones changes that equation entirely. This is going to follow the mobile app curve. Gradual, then sudden.

    Security is now an urgent conversation. QClaw already drew scrutiny after a vulnerability (CVE-2026-25253) was disclosed in the underlying OpenClaw framework. An AI agent with access to your local files, email, and applications is a fundamentally different risk to a chatbot sitting in a browser tab. If your CISO isn’t thinking about agent governance yet, they’re behind.

    China isn’t debating this. They’re shipping. While Western companies run AI strategy workshops, Tencent connected autonomous AI agents to a billion-user platform and put it in production. Any business with Chinese market exposure, whether that’s supply chain, customers, or competitors, needs to absorb what that means.

    Where this goes

    The AI agent wave is breaking a familiar pattern. Usually American tech companies build the platform and everyone else adopts it. OpenClaw being open source means the innovation is genuinely distributed. Chinese companies are building on the same foundation as Silicon Valley startups, but integrating it into ecosystems with far larger user bases.

    For PE firms evaluating portfolio companies, the question has changed. It’s not whether AI agents will affect operations. It’s whether your companies will be using them, or competing against businesses that already are.

    Tencent’s stock didn’t jump because of a chatbot. It jumped because investors saw what connecting AI agents to a billion-user messaging platform actually means. A new application layer. And it’s here now.

    The businesses that get this early will have a real edge. The ones who file it under “just China” or “just open source” will spend 2027 trying to catch up.