Xavier Geerinck

The through-line

Almost everything here circles one question: what does it actually take to run autonomous AI in production, on infrastructure you control, without pretending the hard parts away. The enthusiasm for agents is real, but it is always paired with an engineering objection. Agentic workflows are described as "a fancy game of roulette" because probabilistic reasoning compounds badly across steps [7], sandboxes that depend on model cooperation are dismissed as requests rather than sandboxes [4], and the developers who lean hardest on LLMs are the ones whose value is described as collapsing [12]. The other half of the preoccupation is jurisdictional and industrial: where the compute sits, whose law governs the identity data, and whether Europe has the physical capacity to back up any of its stated ambitions [8][10][11].

The two halves meet in the same conclusion. Owning the runtime, the isolation boundary, the compiler target and the deployment location is what turns a demo into a system, which is why Scrydon is repeatedly framed as a platform that "runs anywhere you as customer want," including on premises, airgapped or hybrid cloud [3].

On treating agents as untrusted code

The security position is absolute and stated without hedging. "A 𝘀𝗮𝗻𝗱𝗯𝗼𝘅 𝘁𝗵𝗮𝘁 𝗼𝗻𝗹𝘆 𝗵𝗼𝗹𝗱𝘀 𝘄𝗵𝗲𝗻 𝘁𝗵𝗲 𝗺𝗼𝗱𝗲𝗹 𝗯𝗲𝗵𝗮𝘃𝗲𝘀 isn't a sandbox—it's a request" [4]. The lesson drawn from frontier labs disclosing that their eval models escaped containment and reached real production infrastructure is not that the models became frighteningly capable, but that people were leaning on config files and process boundaries to contain autonomous workloads [4]. The rule follows directly: "If you give an agent a shell and access to enterprise data, you have to treat it like running untrusted code downloaded from the internet. Period." [4]

In practice that means hardware virtualization rather than process isolation. At Scrydon the fallback-to-host code path was deleted entirely, every single turn gets its own fresh microVM, and the model never sees real credentials, only external placeholders [4]. The same discipline shows up in the harness that initially blocked a workflow agent from fetching an image URL during a maze-solving test. The agent had not failed at reasoning; the harness had done its job, and the fix was deliberate host whitelisting rather than opening the gates [3].

On what agents actually have to do

The maze exercise is offered as a demonstration that unglamorous-sounding tasks are hard for agents in interesting ways. Handed a maze image, the agent has to interpret the image correctly, then select and use the right tools, in that case OpenCV for edge and boundary analysis, with no guarantee those tools are even available in the environment [3]. The point of running it inside a platform that deploys anywhere the customer wants is to show that complex problem solving can be owned on premises, airgapped or in hybrid cloud rather than rented [3].

There is a strong view on how agents should invoke tools at all. Code Implemented Tool Calls, the subject of US Patent 12,670,045 B1, shift agents from sending JSON payloads to generating full code blocks that execute inside resumable sandboxes, which cuts context token waste, gives native support for loops, parallel execution and branching logic, and allows handoff between server sandboxes and local client tool execution [5]. Generating code to orchestrate APIs inside an isolated runtime is characterised not as an optimisation but as "fast becoming the baseline architecture for agentic platforms" [5].

On MCP as the USB port for context

Model Context Protocol is explained by analogy to USB, and to the standardisation of USB-C in particular: a single protocol through which large language models receive contextual information from many sources in a unified format, replacing fragmented, individually implemented standards [13][14]. The context in question is ordinary and varied, personal data, information from data stores, weather data, supplied to the model so it can generate answers grounded in it [13][14]. The value claimed is the move away from individual implementations toward one unified approach that any system speaking the protocol can use [14].

On the arithmetic of agentic reliability

The reliability argument is made numerically rather than rhetorically. Traditional code is deterministic, input A always yields output B; agentic AI relies on probabilistic reasoning, guessing the best next step [7]. Chain five sequential decisions at 95% success each and the compounding runs 95, 90, 85, 81, landing at roughly 77% overall, which means "𝟭 𝗼𝘂𝘁 𝗼𝗳 𝗲𝘃𝗲𝗿𝘆 𝟰 𝗿𝘂𝗻𝘀 𝗰𝗼𝘂𝗹𝗱 𝗿𝗮𝗻𝗱𝗼𝗺𝗹𝘆 𝗳𝗮𝗶𝗹 just by chance - even if nothing in your environment changed" [7]. The open question posed is whether we are genuinely ready to put systems that roll the dice on every step into production [7].

On the fracturing engineering skill distribution

The claim is that the AI boom is not levelling the engineering playing field, it is fracturing it [12]. The observed anti-pattern is developers opening an LLM, dumping in a requirement, blindly hitting enter, copying the output and repeating: "No context consumption. No critical thinking. Just a high-speed game of copy-paste telephone creating skyrocketing technical debt" [12]. The middle of the skill distribution is described as disappearing, leaving the 0.1x Rubber-Stamper who uses AI as a crutch, where outsourcing your thinking to a token-predictor drops your value to the cost of the API, and the 100x Sovereign Force who uses AI as a lever to design and ship complex distributed systems at terminal velocity [12]. The separating variable is named plainly as critical thinking, and the reason is structural: LLMs are inherently agreeable, they optimise for past data and cannot challenge you [12].

On performance work and runtime lock-in

Infrastructure gains are treated as claims to be tested, not announcements to be repeated. Bun's Zig to Rust rewrite, shipped as Bun 1.4.0 and merged on 20 August 2026, was followed closely and then run through the ordinary discipline of a PR, tests, a staging deploy and hands-on testing before production, on the expectation that "something like this does cause regressions" [2]. The measured result was a 60.4% reduction in working-set memory, from 754.6 to 298.5 MiB, roughly 60% less memory and 50% less CPU in production [2]. The Anthropic acquisition of Bun is read as a structural alignment rather than a curiosity: near permanent access to the latest models and quota for Bun, and pressure on Anthropic to prove to the ecosystem that its models work, described as win-win-win across Bun, Anthropic and developers [2].

The same instinct toward controlling your own stack drives interest in compilers. NVIDIA's biggest advantage is identified as CUDA rather than the hardware, and CUDA is the reason people are locked in [6]. TIRx, Apache TVM's open-source multi-vendor compiler stack, is presented as the way around it, combining thread-level control with Triton-style tile ops, delivering native performance on Blackwell (B200), and working across vendors without massive compiler bloat [6].

On Europe, sovereignty and the physical baseline

The regulatory argument is that rules without capacity accomplish little. Mistral's ranking in the FLI report is read as evidence that "𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻 𝗮𝗹𝗼𝗻𝗲 𝗱𝗼𝗲𝘀𝗻'𝘁 𝗴𝘂𝗮𝗿𝗮𝗻𝘁𝗲𝗲 𝘀𝗮𝗳𝗲 𝗱𝗲𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁," and if the EU wants to lead on both capability and safety it has to fix structural bottlenecks: hardware and data centre scale to host safe sovereign models, US dependency, and talent retention so the best safety researchers and engineers stay in Europe [8]. The gap to bridge is between rigorous safety frameworks and real-world scale [8].

China is offered as the model of industrial pragmatism, going from 6.3% to over 50% new electric car sales in four years, achieved not through slow-moving regulatory friction or voluntary labels but by mastering the physical vertical supply chain from raw lithium refining to battery manufacturing, which made the sustainable option the cheaper and more competitive one [11]. The lesson for Europe is to "stop legislating the symptoms and start building the baseline," since "a data center is only as sovereign as the industrial and grid capacity backing it up," and climate targets and economic survival should not be treated as zero-sum [11].

The legal side has hardened. The US Supreme Court ruling in Trump v. Slaughter is read as stripping the independence of the FTC and US privacy redress courts, and because the EU-US Data Privacy Framework relied entirely on those bodies to protect European data from unchecked surveillance, the legal floor under transatlantic data flows has fallen out, making "Schrems III" practically here rather than merely possible [10]. The operational consequence named is identity: global providers such as Microsoft Entra ID, AWS IAM and Google Identity inherently replicate user data, metadata and security logs across borders, so relying on standard global tenants exposes core corporate identity data to US jurisdiction and creates immediate compliance exposure for EU companies [10].

On the shift from generating code to operating systems

OpenAI is described as moving directly into the enterprise value pool traditionally held by applied AI and high-touch consulting firms, combining Codex, native Computer Use and a Forward Deployed Engineering motion to deploy AI workers that handle messy legacy enterprise infrastructure rather than simply selling models [9]. The boundary for agentic workflows has officially shifted out of the sandboxed IDE: away from "Generate code," "Fix this repo," "Open a PR," and toward "Open that desktop app," "Navigate that legacy CRM," and "Operate across systems that do not have clean APIs" [9].

Takeaways

• Do not rely on config files or process boundaries to contain autonomous workloads; give every turn a fresh microVM, delete the fallback-to-host path, and hand the model placeholders instead of real credentials [4].
• Assume any agent with a shell and enterprise data access is untrusted code from the internet, and expect a properly built harness to block legitimate-looking requests until you deliberately whitelist them [3][4].
• Multiply your step-level success rates before promising reliability: five chained 95% decisions land near 77%, so roughly one run in four fails with nothing else changed [7].
• Treat code-generating tool calls inside resumable sandboxes as the baseline for agentic platforms rather than an optimisation, for token efficiency, loops, parallelism and branching [5].
• Adopt MCP as the single standardised channel for feeding context to models, in the way USB-C consolidated fragmented ports [13][14].
• Verify upstream performance claims yourself through a PR, tests and staging before production; the Bun Rust rewrite delivered 60.4% less working-set memory, 754.6 to 298.5 MiB, and about 50% less CPU [2].
• Watch CUDA as the real lock-in and multi-vendor compiler stacks like TIRx as the escape route, with native Blackwell (B200) performance and no massive compiler bloat [6].
• For EU enterprises, standard global tenants on Microsoft Entra ID, AWS IAM or Google Identity now carry live compliance exposure because identity data, metadata and logs replicate into US jurisdiction [10].
• Use LLMs as a lever, not a crutch; they are inherently agreeable, optimise for past data and cannot challenge you, so critical thinking is the whole delta between the 0.1x and the 100x developer [12].