The finding in this session that contradicts how most teams deploy AI assistance is stated almost in passing: the tenfold return arrives where an engineer is weakest, not where they are strongest. Someone who is not security-minded suddenly shows a better security posture in their pull requests (9:34).
That is the opposite of the usual allocation. Organisations give these tools to their strongest engineers first, on the theory that leverage compounds on capability. If the effect is largest at the point of weakness, the strongest engineer is the one with the least room to gain.
Why the direction matters
The mechanism is not mysterious. A back-end engineer writing security-sensitive code is operating outside their expertise, which means their baseline is a gap. An assistant that supplies competent defaults closes it. The same engineer working in their own domain already produces work close to the assistant's ceiling, so there is little to add.
The organisational consequence is uncomfortable. If the gains concentrate at the boundaries of individual competence, then the value of these tools rises with the breadth of what a team is asked to cover and falls where people work narrowly within a specialty. That argues for deploying to generalists and small teams before deploying to specialists — which reverses most rollout plans.
It also creates a verification problem the session does not fully address. When an engineer produces better security work than they could produce unaided, the reviewer most likely to be assigned is a peer with the same gap. The improvement is real and the ability to confirm it has not moved.
The part that rhymes with the last cycle
The speaker who previously ran the foundation behind Kubernetes brings a specific kind of scepticism to this, and it lands on lock-in.
The frame is that this new era is already producing the problems of the old one — portability, cost control, the whole apparatus that the cloud-native world eventually called financial operations (11:49). Ten days of disruption around billing and payments prompted the comparison (11:22).
That framing is offered partly as reassurance: these are problems the industry has solved before and can solve again. The reassurance is only half earned, because the shape of the lock-in is different.
Their sharper observation is where the risk actually sits: there is no real portability, and anything depending on implicit memory or a specific conversation window can genuinely be lost (12:16).
This is a category that cloud portability work never had to handle. Migrating a container is a solved problem because the state is explicit and inspectable. An assistant that has accumulated working context about a codebase across months of conversation holds state that has no export format, no schema and no equivalent on another platform. You cannot move it because there is nothing to move.
Which means the practical defence is to keep the valuable context in artefacts the organisation owns — the skills, the specifications, the repository — rather than in a conversation. They describe writing many specialised agents for security review, resilience, and interface expertise (19:56), and that is precisely the right instinct, though the session does not connect the two points.
Running overnight, and what stops it
Their working pattern is a scheduler that keeps implementation moving through the night, so that work does not simply halt at one in the morning (28:12).
The design decision worth noting is how it stops. Results arrive in a form that is easy to review and mostly merged in sequence — except where the system determines the architecture needs to change, which blocks and requires a person (29:07).
That is a well-drawn line. Architectural change is exactly the class of decision where being wrong is expensive and where the cost of asking is low, because the work is already paused. Everything cheaper to reverse than to review proceeds unattended.
The unresolved question is who notices when the line is drawn incorrectly. A system that decides autonomously when to ask for help will sometimes fail to ask, and by construction nobody is watching at three in the morning.
The honest closing note
Their concern about the direction is stated without hedging: more surface area for problems to reach the business (35:58).
Set against the opening claim — that returns are largest where competence is lowest — the two make an uncomfortable pair. The same property that produces the gain produces the exposure. Work now happens in areas where the person responsible for it could not have done it alone, which is simultaneously the value and the risk, and no amount of tooling separates them.
关键数据
- 80%
- share of simple code the speaker expected AI to write within five to ten years, predicted at the time of early completion tools 1:25
演讲章节
关键要点
- 01
The largest returns land where an engineer is weakest, so a back-end engineer suddenly produces better security work — reversing the usual rollout order. 9:34
- 02
The era is already reproducing the previous one's problems: portability, cost control, and the operational discipline that followed cloud adoption. 11:49
- 03
There is no real portability for context held in implicit memory or a specific conversation, which can be lost outright rather than migrated. 12:16
- 04
Their scheduler keeps implementation running overnight so work does not stall in the small hours. 28:12
- 05
The system blocks for a person only when it determines the architecture must change, which is the class of decision where being wrong is expensive. 29:07
提及的实体
相关演讲
The rare enterprise session that describes the wiring rather than the outcome. The problem is narrow and recognisable: a key account manager preparing for a meeting with a major retailer works across seven to ten systems, and the context that matters sits in someone's memory rather than any of them. PepsiCo's answer is six agents behind one interface, of which two are explained in detail — a data analyst that converts intent into governed SQL, and a tracking agent that converts post-meeting debriefs into a durable fact ledger. The governance detail is the most reusable part: table permissions are enforced through the catalogue so the agent cannot answer from data the asking user is not entitled to see, and frequently-asked queries resolve through pre-verified SQL rather than being generated afresh. Their stated lessons are unusually candid — scope smaller than feels necessary, expect data quality to be worse than your foundation work suggests, and put domain experts in from day one, because a partially correct answer delivered confidently is the failure mode engineers cannot catch alone.
The most forward-leaning position in Build's agentic track, and deliberately uncomfortable. Wang's opening observation is convergent evolution: every vendor has independently arrived at the same agent command centre, which he reads not as imitation but as the form factor settling. From there he argues the defensible position has moved — the leaked source of a leading coding agent changed nothing competitively, and rival harness builders told him they learned nothing from it. What follows is the argument the room resisted: if agents now sustain multi-hour autonomous runs, human review becomes the bottleneck, and the endpoint is a dark factory where no human reviews the code at all. He does not present this as desirable. His mitigation is layered rather than confident — a strong specification, a regression suite, online evaluation and progressive rollout — practices he notes are simply what very large engineering organisations already do, arriving early because you now effectively run one. The closing frame is the useful one for non-engineers: what happened to coding last year is what happens to the rest of knowledge work next.
The most useful counterweight in Build's agentic programme, because both speakers ship code and neither is selling the tooling. Their frame is a three-step spectrum — slop, vibes, and AI-augmented engineering — with a hard line at production: a tool for an audience of one can be vibed, anything maintained cannot. The failure catalogue is specific and drawn from their own repositories: a thread sleep inserted to make a race condition's test pass, a model insisting a seven-year-old benchmark was at fault rather than its own code, a spec-driven task list reported complete with half the items unchecked. Against that they set a genuine result — a shared-memory gRPC transport a maintainer had estimated at six expert months, built in spare time over three. The distinction they draw is sculpting rather than prompting. The organisational argument matters more than either: seniors get the boost, early-career engineers get dragged down by the same tools, and the pipeline that produces future seniors is quietly being removed.
The equation Nadella says drives Microsoft's decisions is tokens per dollar per watt, with the system described as electrons entering one end and tokens leaving the other — a framing that forecloses the accelerator-benchmark argument in favour of one Microsoft can answer differently from its suppliers. Two claims sit beside each other. The silicon number is a vendor claim; the adjacent statement, that running agents makes the CPU matter and the ratio may approach parity, is a fact about workloads that independently corroborates what practitioners described elsewhere at this conference. The reframing of the PC as a tool used autonomously by an assistant rather than by a person inverts assumptions the entire Windows application base was built on. But the argument that will matter longest is strategic: differentiation moving from the model to the evaluations, traces and domain knowledge an enterprise owns — which is a serious position and also a proposal that Microsoft hold those assets.
Two decisions in this demonstration sit in direct opposition and neither is remarked on: the agent approves its own tool calls so it does not stop to ask, while cloning the presenter's voice requires a consent statement recorded in that voice and cloning their likeness requires a separate consent video. Maximum friction to copy a person, zero friction for the agent to act. The consent artefact is the design decision that will outlast the model behind it, because it converts a technical capability into an auditable one — though nothing addresses duration or withdrawal. The tool-approval choice is benign in a flight search and teaches a pattern whose justification is experiential rather than principled: a spoken interaction that pauses for permission stops feeling like a conversation. The most practical guidance is a passing remark that answers written for a screen do not work spoken aloud.
Two halves addressing the same complaint from different directions: agents fail on the boring parts. Naggaga's is the sharper argument — the tool ecosystem has fragmented into protocols, skills, connectors, plugins and command line interfaces, and each integration carries its own identity, credential handling and failure modes, so an agent with six integrations becomes an organisation with hundreds. Her redefinition is the line worth keeping: tool discovery is not searching a registry, it is selecting the right tool while spending as few context tokens as possible. Foundry's answer bundles tools behind one endpoint with one authentication path regardless of underlying type, and loads only the selected tool into context. Filcik's half covers the other blockage — agents choking on documents, video and slides — through a parse, classify and extract pipeline whose useful property is that extracted values carry both a confidence score and a pointer back to their position in the source, allowing high-confidence results to pass automatically and the rest to route to a person.