Hi, I'm Hugo Nogueira
CPTO at Complyance, the AI-native GRC platform used by Fortune 500 companies. I write about running agents in production and publish open research on how they fail.
What building our own review agent taught us, with our numbers, what Anthropic and one open-source pull request show about where review is going, and eight bets on how teams will review code by October 2027.
A coding agent running in your terminal can use every credential that terminal can reach. heldkeys is an open-source CLI that lists those credentials on your laptop, inside a sandbox or in a CI job, and tells you what to fix first.
Our AI agents write and run code against customers' GitHub, AWS and other systems from a sandbox with internet access, and nothing inside that sandbox can authenticate to any of them. The architecture behind it, the designs we set aside, and where its boundaries are.
I applied the MAST failure taxonomy to 639,000 execution steps from AI agents running in production for five months. My first headline finding turned out to be an infrastructure bug masquerading as agent behavior. This post is about what agents actually fail at in production, and the discipline it takes to not fool yourself with production data.
I just published LHC v0.2, an open benchmark for long-horizon coherence in 8B-class agent models, plus a deterministic parser baseline that puts a useful floor on what fine-tuning is worth for structured-state tasks. This post explains what they're for, how to use them, and the methodology arc that produced them across five rounds of external review.
The self-hosted AI agent movement is real and important. But we are confusing a bootstrap phase with a destination architecture. The long-term future of agents will be defined by platforms that make them reliable, governable, and operationally boring.
When execution becomes abundant through AI agents, judgment becomes the bottleneck. The traditional separation between technical and product leadership breaks down, creating space for the CPTO role.
OWASP just published their first Top 10 for Agentic Applications. Here's what every agent builder needs to know about the new attack surfaces, why traditional security fails, and how the orchestration layer becomes the new security boundary.
