Dependency layers — models, code, buildings

00:00:04 Five Eyes just did something unusual. The five signal-intelligence partners—Australia, the U.S., the U.K., New Zealand, and Canada—issued a joint warning that frontier models capable of taking down governments are mere months away. They used the phrase "act now."

00:00:27 The Guardian's Sarah Basford Canales reports it was prompted by Trump blocking foreign nationals from Anthropic's Fable model—a concrete access restriction that seems to have crystallized their thinking rather than just confirmed it. I should clarify: treat this as threat-assessment posture rather than a prediction.

00:00:50 There's plenty of noise in AI safety right now, but the joint framing is telling. You don't get five countries agreeing on one risk assessment unless they've looked at the same data and drawn the same conclusion about capability convergence. The other piece comes from the WSJ on Sam Altman's personal portfolio—over eighty holdings from his Y Combinator days that have climbed significantly since OpenAI explored ties with his ventures.

00:01:20 Over ten companies reportedly discussed business deals with them. Both stories land on the same structural problem: access is leverage, and it can be withdrawn overnight. Whether that comes from a government blocking foreign nationals or a CEO's portfolio profiting from institutional ties, the pattern is the same.

00:01:43 You aren't just writing software; you're building dependency chains controlled by other people. I've watched teams get caught by access changes before. Even without this scale, it shows how fast things break when a provider you rely on decides your use case no longer fits their policy.

00:02:03 Armin Ronacher published "The Coming Loop" right now. If you know his name, it's for Flask—the Python web framework that kicked off the microservice wave—along with Celery and Babel. His recent move from Pi back to open source gives his latest essay extra weight.

00:02:21 The essay opens with a quote from Boris Cherny: "I don't prompt Claude anymore. I have loops running that prompt Claude and figuring out what to do. My job is to write loops." That line's been circulating, and it captures exactly what Ronacher is tracking: agent harnesses are becoming the default interface between human intent and machine execution, whether teams realize they've adopted them or not.

00:02:49 His core argument is precise. Harness-level loops—where a system queues tasks, runs them through a model, evaluates the output, then decides whether to iterate or send the task elsewhere—work astonishingly well in specific domains: code porting across languages, performance benchmarking, or security scanning that only needs breadth.

00:03:12 But for lasting code? He's not convinced. His reasoning is worth reading carefully because he names things most people skip. "Present-day models tend to produce code that is too defensive, too complex, too local in its reasoning," he writes. "They avoid strong invariants.

00:03:31 They add fallbacks instead of making bad states impossible. They duplicate code, invent bad abstractions, and paper over unclear design with more machinery." The system grows harder to understand even as it appears more robust. "The more hands-off you are, the more that happens," he notes.

00:03:57 What's tricky is that even if you don't use loops, other people will loop against your software. Attackers run machines continuously, as do security researchers. Both sides generate noise—and sometimes find real issues—at volumes that make manual triage impossible for most teams.

00:04:16 "If attackers and reporters loop, defenders will eventually need to loop too to keep up," he writes. Not because the work changes in principle, but because the signal-to-noise ratio shifts beyond what humans can manage alone. Then comes the dependency angle, which is where the essay gets darker.

00:04:37 "Software has always depended on tools," Ronacher observes. But these create a constant cognitive drain instead of a one-time cost. If a codebase is produced, reviewed, patched, and kept alive by loops—what happens when access to those systems disappears? Trade restrictions, cost spikes, vendor lock-in.

00:04:58 "We may create codebases that are not merely hard to maintain by humans, but that assume machine participation as part of their maintenance model," he writes. "People more and more merge code they cannot fully explain." Some software may never need full human authorship, and maybe that's fine.

00:05:25 But it leaves a specific tension: should every system drift toward that model, or are there domains where understanding the code matters enough to push back? Reading this alongside the Five Eyes warning, the parallel is sharp. One story covers losing access to frontier models.

00:05:44 The other covers writing code we can't maintain without them. Both leave your system dependent on something external—and that dependency carries a deadline. We treat agent harnesses like infrastructure because they feel stable. But they're built on top of API access, model capabilities, and cost curves that change rapidly.

00:06:07 The layer above yours moves faster than the layer beneath it.

00:06:11 The third story today is physical rather than digital, but it lands on the same note: you're building systems that depend on conditions you don't control. First Street published a report finding nearly 80 percent of data centers exposed to extreme climate hazards—flooding, extreme winds, wildfires.

00:06:32 The Americas dominate with 86 percent of capacity in elevated-risk markets for acute threats. Asia-Pacific leads on chronic exposure: 89 percent of their data centers face heat and drought. Jeremy Porter, First Street's chief economist, told the Guardian that most valuations still focus on growth and treat climate as secondary.

00:06:55 "Where you build a data center determines a large share of what it will cost to run for the next 20 or 30 years," Porter said. "Climate is a big part of that: cooling, water, and reliability all depend on location." regions to acute and chronic climate threats.

00:07:21 About two-thirds of upcoming U.S. data centers are slated for places experiencing drought. Johor in Malaysia, a quickly expanding market, is also among the most vulnerable globally. "In other words, scale is being built where operating conditions are hardest, not where they're easiest," the report says.

00:07:42 That's a sentence worth sitting with: it reframes infrastructure planning around cost rather than convenience. Matthew Eby, First Street's founder, noted that "most underwriting for real assets still relies on historical data—but the climate no longer behaves in ways the historical record predicts." It's a polite way of saying: if you're pricing cloud capacity based on past weather, your math has been wrong.

00:08:10 Porter's point about reliability radiating outward matters for anyone running production systems. "Data centers run the digital services people and businesses rely on," he said. "So a climate hit to a local data center can radiate outward as a service disruption, on top of competing with that same community for power and water in regions already under stress."

00:08:39 It's about timing. Teams are making capacity decisions—provisioning compute, negotiating cloud contracts, architecting around specific availability zones—while the underlying conditions those zones depend on shift faster than the industry is pricing in. All three stories point to a pattern builders know well: what feels like stable infrastructure is actually a moving target.

00:09:06 You can't avoid dependency—the question is how you architect for the moment it shifts. Seln Oriax.