Search for a command to run...
Crafting seamless user experiences with a passion for headless CMS, Vercel deployments, and Cloudflare optimization. I'm a Full Stack Developer with expertise in building modern web applications that are blazing fast, secure, and scalable. Let's connect and discuss how I can help you elevate your next project!
No comments yet. Be the first to comment.
A Codex long-running agent workflow succeeds when responsibility, state, wake conditions, acceptance criteria, and stopping boundaries remain visible and reviewable. OpenAI developer experience lead J
The Codex–ChatGPT Pro dual-agent workflow separates implementation from acceptance; it does not prove that one AI system is the strongest coding agent. Codex can hold the repository, requirements, per
Japan's physical AI strategy entered an execution phase in 2026, with a national model program running through 2030. The government is funding factory-data preparation and robotics foundation models.
The AI infrastructure bubble may stay contained while chips, power, and construction capacity remain scarce. In July 2026, NVIDIA CEO Jensen Huang told Axios that a bubble was highly unlikely within f
QM agent is Y Combinator's July 2026 multiplayer harness for work; by August 4, its GitHub repository had about 9,700 stars. It gives each employee and project a scoped workspace, memory, keychain view, permissions, scheduled work, web apps, and a durable sandbox. Pi, OpenCode, Codex, and Claude Code can all drive the same core.
That architecture addresses a real organizational problem. It does not turn QM into a certified enterprise security product. The project's own security policy calls it early, experimental software and limits its interactive trust boundary to authenticated users inside one organization. QM is not a hardened public or hostile multi-tenant boundary.
OpenClaw and Hermes Agent proved that a personal agent can do useful work across browsers, email, files, messaging, and a local shell. Their official security documents also define narrow trust models. OpenClaw assumes one trusted operator boundary per gateway. Mutually untrusted users should get separate gateways, preferably on separate OS accounts or hosts. Hermes Agent describes itself as a single-tenant personal agent and treats OS-level isolation as the only security boundary against an adversarial model.
Those are coherent designs for personal software. Trouble starts when an organization copies the assistant fifty times and then tries to share data, credentials, projects, and operating responsibility.
YC says it first ran a basic Ruby agent loop with access to internal data. The team added scheduled jobs and webhook triggers, then provisioned more than 50 Hermes agents for individual employees. Managing that fleet became difficult. QM is the result: a shared control layer for identity, policy, state, delivery, and execution.
QM is a harness rather than a new reasoning engine. A deployment can select Pi, OpenCode, Codex, or Claude Code for model-driven work. The core resolves who initiated a turn, which scope owns it, which resources are available, whether an effect needs approval, and where the result may be delivered.
The project moved fast. The public repository was created on July 29, 2026. At the August 4 fact check, it had roughly 9,700 stars and more than 1,000 forks. Its latest listed release was v0.1.4, published on July 31. YC itself has funded more than 5,000 companies since 2005, correcting a common claim that it reached that total only after 2025.
A personal assistant can get away with treating every request as coming from one person. A company agent cannot. Every turn has to answer four questions: who asked, which project owns the work, which resources are available, and where side effects may land.
QM models those answers as scopes. Each person and room can have its own memory, files, keychain view, permissions, scheduled work, web apps, and durable sandbox. Personal work stays in a personal scope. Slack channels, group messages, and projects use shared scopes. Identity and configuration can carry between Slack and the web interface.
A local interface test illustrates the intended workflow. An administrator creates an "AI Research" project, adds a second user, and both participants continue the same conversation while watching tool and command progress. A regular member who has not been added to another project cannot see that project's content through the normal interface.
That result does not prove that administrators cannot read private content. QM's security policy says an organization administrator is a privileged content reader. A scope-authorized administrator may read transcripts, captured provider requests, documents, memory, connector and keychain metadata, mirrored message bodies, user details, and skill bodies. The read is audited, but it does not require separate user consent.
Any rollout policy should state that clearly. "Private from coworkers" and "private from administrators" are different promises.
Calling one product secure and another insecure hides the decision that matters. Their maintainers describe different operating boundaries.
| Decision | OpenClaw | Hermes Agent | QM |
|---|---|---|---|
| Tenant model | One trusted operator boundary per gateway | Single-tenant personal agent | Authenticated users inside one organization |
| Separation for untrusted users | Separate gateway plus OS account or host | Separate agent instances and allowlists | Personal, room, group, and project scopes |
| Default execution posture | Trusted single-user host execution may run without per-command prompts | Default terminal backend executes on the host | Auto screens supported external content; Strict pauses for harness tool approval |
| Product responsibility | Personal gateway and tool policy | Personal agent and adapters | Identity, policy, scheduling, audit, and multiple harnesses |
| Published limitation | Prompt injection cannot be solved by system prompts alone | In-process scanners and approval gates are heuristics | Command policy is bypassable; some browser actions sit outside core approval gates |
QM has more native objects for organizational governance. That is a meaningful advantage for teams. It is not evidence that the project has eliminated agent risk. OpenClaw and Hermes make stronger external isolation the operator's job; QM moves more governance into the application core while still depending on the deployment boundary.
QM offers three organization-level postures. Strict pauses almost every harness tool call for human approval. Auto, the default, screens supported provenance-labeled external text and tool results with a classifier. Dangerous removes content screening and pauses between tool calls. A declared command policy still applies across all three modes, including hard denials for configured destructive operations.
The labels sound stronger than the guarantees. QM acknowledges that its shell-text command policy can be bypassed through obfuscation, encoding, or writing and executing a script. Browser-runner actions do not always re-enter command policy or human approval. Auto screening does not cover every command result, background process, multimodal result, or raw webhook payload. A classifier decision is not authorization.
Credential handling has the same boundary. Core can enforce a grant's owner, audience, one-time or standing mode, expiration, revocation, and audit trail. When a process needs the credential, however, the value can materialize as plaintext in an environment variable or file inside the sandbox. A compromised process may still spend or exfiltrate it.
The durable sandbox deserves to be treated as a sensitive computer. Persistence saves setup time because tools and files survive across turns. It also preserves risk. QM says exact model request capture is on by default when durable stores are enabled, file artifacts have no expiry, secret scanning on file writes is absent, and an organization-wide kill switch is incomplete.
The project adds a seven-day cooldown before newly published npm dependency versions may enter a lockfile. That is a concrete supply-chain control. It reduces one class of fast package takeover; it does not change the runtime limitations above.
The following sequence preserves the source demonstration while aligning it with the published architecture:
execute run inside that scope's durable sandbox with its authorized files and credential grants.This path turns model calls into an accountable operating process. It does not guarantee "self-evolution." Memory and audit data provide more context for the next run. Improvement still requires evaluation, version control, and a person who owns the outcome.
QM uses the MIT License and deploys into an organization's own Fly.io or Amazon Web Services (AWS) account. Company-specific settings, tools, skills, sandbox images, and infrastructure live in a deployment directory rather than in the generic core. Organizations that need deeper changes can maintain a standalone private repository and keep company material under deploy/layers/<org>/ while syncing the upstream core.
This structure can reduce merge conflicts. It does not outsource operations. The deployment operator still controls the cloud account, identity provider, Postgres, object storage, encryption keys, model and browser providers, runtime configuration, and initial admin grants. The initialization flow does not create or enable production deployment CI.
The official bootstrap path is shown below. Replace <slug> and <fly-or-aws> with deployment-specific values.
npm exec --yes --package=@yc-software/qm@latest -- \
qm init . --org <slug> --target <fly-or-aws>
npm install
That cost structure matters. There is no license fee for the core, but a production deployment still consumes infrastructure, model usage, browser services, security review, incident response, and platform engineering time. An open-source license is not a total-cost estimate.
The best early use case is a controlled internal pilot with authenticated employees, low-sensitivity data, limited credentials, and reversible work. Public access, hostile tenants, heavily regulated data, or policies that prohibit privileged admin reads fall outside QM's stated boundary.
The practical question is whether every material risk has an owner and a test.
QM agent is Y Combinator's open-source multiplayer agent harness. It manages identity, scope, policy, scheduling, audit, and durable sandboxes while Pi, OpenCode, Codex, or Claude Code performs model-driven work.
QM includes more team-governance primitives by default. Its maintainers do not claim a security certification, and the project documents gaps in command policy, browser approval, credential use, retention, and governance. The defensible conclusion is that its architecture fits teams more directly, not that risk disappears.
A regular member is constrained by scope and grants. A scope-authorized organization administrator is a privileged content reader and may access transcripts, documents, memory, and related metadata without separate user consent. The access is audited.
QM's interactive boundary assumes authenticated internal users in one organization. It is not a hardened public multi-tenant service. Published apps use separate bearer capability links, and anyone holding a copied link may reach that app until the relevant authorization changes.
It is suitable for a controlled internal evaluation when the team can operate identity, sandbox, credential, egress, retention, and audit controls. Sensitive, regulated, external, or hostile multi-tenant use needs a deployment-specific threat model, penetration test, and incident response design first.
The most useful thing QM adds is not another model selector. It forces a team to represent who may let a model do what. That is better than another layer of prompt advice. Scope and audit still live in the control plane, though. The final boundary remains the host, network, credential, and operator.