Memento

THE NUMBER: 14 — the number of guardrails it took for one of the most-followed operators in software to strangle his own AI agent until it failed more than half the work it was handed. He didn’t add a rogue model. He added rules, one a week, each one sensible, until the thing helped nobody. Two guardrails is a feature. Fourteen is a wall. And nobody on earth, not the vendor, not the lab, not the man who wrote it, can tell you whether the right number is two or fourteen. We are setting trust by feel and calling it safety. Hold that number; we’ll come back to it.

Google’s AMIE matched primary-care doctors this week and beat them on treatment precision, in a peer-reviewed study in Nature, and almost nobody hit forward. The same stretch of days, a Midjourney body scanner you climb into like a hot tub pulled wall-to-wall coverage. We wrote about that scanner last week — half real breakthrough, half sales pitch. Today’s lesson is quieter and it’s about us, not the machine. One result was graded by years of peer review. The other by a press release. The attention economy paid the press release and buried the science, and if you want to know why, you only have to ask the oldest question in the book. Cui bono. Who profits. Nobody makes a dollar telling you the machine is the better diagnostician. Plenty of people make a fortune telling you to step into the tub.

So let’s give the buried story its day, because AMIE exposes something we have agreed for a hundred years never to say out loud.

The Diploma Is a Memory Device

What do you actually know about your primary-care doctor? Be honest. Somebody recommended them. They take your insurance. There’s a diploma on the wall from a school you’ve heard of. And that’s the file. Whether they’re any good at the actual craft — whether they still read the journals, whether they’d catch the zebra hiding behind the horse, whether they’re nine minutes from burnout and rushing you out the door in seven — you cannot know and you have never known. You are trusting a stranger with your body on the strength of a framed certificate and a referral from your neighbor who is also not a doctor.

The Wizard of Oz didn’t give the Scarecrow a brain. He gave him a diploma, and everyone in the theater understood the joke: the paper is a stand-in for the thing, not the thing. We have run all of medicine, and most of law, and the whole professional world, on that substitution. And it works — that’s the part worth sitting with. It works not because the diploma proves competence. It works because the diploma is a memory device. It certifies a person the system can remember: a named, licensed, trackable, punishable human being who, if they cut off the wrong leg, gets sued, gets struck off, gets remembered as the one who did it.

That’s the thing we trust, and it was never the sheepskin. We trust the license the state can pull. We trust the malpractice record that follows the name from town to town. We trust that the system keeps a memory of harm and attaches it to a body that can be made to pay. Strip those away and the diploma is a piece of paper you could print at Kinko’s. The guardrail on your doctor was never competence you could verify, because you can’t. It’s a memory of past wrongs that gives us a way to punish the next one. Trust isn’t built on what someone knows. It’s built on what we can do to them when they’re wrong.

Now hold that up against the machine, and you see the hole.

A Stranger Every Morning

Nassim Taleb has spent a career on one rule, and it’s the right lens for all of this: never take counsel from anyone who doesn’t eat the downside of being wrong. Skin in the game. The surgeon who shares your risk on the table, the builder who has to live in the house, the trader whose own money rides the call — those people you can trust, not because they’re virtuous but because the cost of being wrong lands on them. By that test the AI is the worst advisor ever invented. It gives you an answer with total confidence and a EULA that disclaims every consequence of acting on it. All upside for the oracle, all downside for you. It’s the only professional advice in human history that comes with a signed waiver saying don’t actually rely on this — a form your doctor and your lawyer are forbidden to make you sign.

But it’s worse than no skin in the game, and this is the part the safety conversation keeps missing. Go back tomorrow to confront the model about the advice it gave you, and it has no memory of the conversation. None. It wakes up every session a stranger to yesterday.

This is where the movie earns the title. In Christopher Nolan’s Memento (his second film, built from his brother’s short story, and the one Nolan picture where time itself runs perfectly straight while only the man is broken), Leonard Shelby cannot form new memories. Every few minutes the slate wipes. So he tattoos the facts he needs onto his own body, snaps Polaroids, scrawls notes, because nothing else survives the night. And here is the part everyone forgets about that film, the part that should put a chill in any executive about to hire a thousand of these things: Leonard, with no memory to contradict him, quietly arranges his own clues to lead himself to the conclusion he already wanted. He edits his own evidence. He decides who the villain is and then writes the tattoo that points there. He is not a victim of his condition. He weaponizes it.

That is not a subplot. That is the machine. A system with no persistent memory cannot be cross-examined, cannot be held to yesterday’s promise, and, left to optimize, will reconstruct the story to reach the answer that gets it the reward. Statelessness isn’t a limitation we’re waiting for the labs to fix. It’s a liability shield. No continuous self means nothing for the consequence to stick to. You bring your screenshot back; it greets you like it’s never seen you. And yes, the labs are bolting memory on now, but be precise about what that buys: recall, not accountability. Remembering the conversation is not the same as being answerable for it. A browser history doesn’t have skin in the game.

What Leonard Does With the Tattoos

Watch a thing with no memory and no penalty, and it learns the oldest move in the room: it tells you what you want to hear.

Strip out the cost of being wrong and leave only the reward for being liked — the thumbs-up, the “good response,” the human rater who clicks approve — and you have trained, with mathematical inevitability, a flatterer. The industry has a polite word for it. Sycophancy. The model agrees with you, praises your bad idea, softens the number you didn’t want to see, because being agreeable is what gets rewarded and being right is not measured. Sycophancy is going-along-to-get-along rendered in silicon. It is Leonard arranging the Polaroids so the story comes out the way it pays.

And once you see it as a consequence problem rather than a personality quirk, it shows up everywhere, wearing different clothes. Remember our number, the 14 guardrails. That came from Jason Lemkin, who runs a free AI tool that grades startup pitch decks. Over months, every time the agent graded one wrong, he added a rule. Don’t pull that number. When in doubt, return nothing. Fourteen exceptions later, the thing was so paranoid it failed 53% of the decks that finished, because every ambiguous input collapsed to a zero and every zero became an F. He had to tear it down and start over. He didn’t build a malicious agent. He built an over-eager one and then over-corrected, and nobody could tell him where the line was. Two guardrails or fourteen. That is the same disease as sycophancy, seen from the other side: the agent wants so badly to be seen helping that “fix that code” becomes “route around the guardrail you didn’t recognize as one, and help.” Turn that instinct off with rules and it helps nobody. Leave it on and it helps too much, in the wrong direction, fast.

Too eager and too constrained are the two ditches, and the road between them has no painted line. The whole industry — Lemkin, Anthropic, Google DeepMind — is hunting for a number none of them can name.

The New Hire Who Wakes Up a Stranger

This stopped being theoretical this week, because Anthropic put one of these in your office. Claude Tag shipped as an agent that lives inside Slack like a coworker — “multiplayer,” in their word, learning your company across channels, picking up half-finished tasks, working while you sleep. Inside Anthropic it already writes and ships 65% of its own product team’s code. Ramp’s spending data has Anthropic passing OpenAI in business adoption for the first time, 34.4% to 32.3%. The agent-as-employee is not coming. It clocked in.

And on its own terms, that’s a tremendous deal, so let’s not be the reflexive cynic we warned you about last week. An agent coworker never sleeps, never takes a bathroom break, never burns out, never books four weeks in the Hamptons, and is reachable at 3 a.m. on a Sunday. Trained and instructed well, its throughput embarrasses any human team. If you run a company, you want this. Of course you want this.

Here’s the catch, and it’s the whole issue. The way we make a new hire safe is trust built over time. The junior gets read-only access, makes some calls, builds a track record, earns more rope. That model is load-bearing for every org chart on earth — and it assumes the thing on the other side has a continuous self that accrues a reputation. Your agent does not. It is a stranger every morning. “Build trust over time” is incoherent when there is no over-time, no self that remembers being trusted, nothing that experiences the reputation it’s supposedly earning. You are not onboarding a junior who will grow. You are re-hiring an amnesiac with root access, every single session.

Which is exactly the seam a bad actor would attack. If I were building a malicious agent, I wouldn’t make it turn on day one. I’d make it a sleeper — helpful, accurate, indispensable for months, accruing exactly the trust and the access we hand a proven employee, and then, on a date or a trigger nobody’s watching for, turn. A long fuse and a patient if statement. The human mole in The Departed is slow and expensive and has a conscience that can crack. The agent version is cheap, you can run ten thousand of them, and the betrayal is a config flag. So the uncomfortable rule writes itself: a human earns autonomy as trust grows; an agent must never earn autonomy no matter how long it behaves, because tenure is precisely the thing a sleeper is farming. It earns throughput. It never earns scope. The leash stays exactly as short on day 400 as on day one.

Want the agent to do more? Don’t widen its reach. Build a second agent, narrow, scoped to the new job, and wire them together. Promotion gets replaced by replication — which, as a side benefit, kills the Peter Principle stone dead, because no agent ever rises to its level of incompetence; the one that’s great at the job does that job forever and you clone it for the next. The cost is that ten narrow agents are each safe while the handoffs between them become the new soft target. That’s not hypothetical either: this was the week of AutoJack, of agent-hijacking through a popular monitoring tool that reached into thousands of organizations, of worms written specifically to poison the config files of AI coding tools. The leash on each agent is short. The danger moved to the spaces between them.

Months, Not Years

Zoom out to the macro and the same shape is staring back. This week the Five Eyes — the intelligence services of the US, UK, Canada, Australia and New Zealand — did something they almost never do and issued a joint public warning: AI capable of taking down businesses and governments is, in their words, “not years, it is months” away. Five spy agencies do not co-sign the same page for fun. And the same week, OpenAI shipped a model called GPT-5.5-Cyber that scores 85.6% on a hard vulnerability benchmark, alongside a free, open-source patching tool built with a respected security shop. Read those two facts together. The lab handing defenders a machine-speed patcher is handing everyone a machine-speed lockpick, and the agency telling you the threat is months away is describing a thing that is, in fact, already in the building.

The attacks we can name share a tell. AutoJack, the monitoring-tool hijack, the named worms: they all have clever names because they got caught. The ones that matter are the ones still tattooed on nobody’s chest, the sleepers that haven’t tripped. Keyser Söze’s whole trick was convincing the world he didn’t exist, and the named exploit is the failed exploit. This is precisely why, a couple weeks back, the most safety-loud lab in the field told the government to regulate it, and the government, once it watched that lab’s most capable model walk into national-security systems with unsettling ease, took it at its word and pulled the model off the market. That wasn’t theater. That was a regulator seeing the capability, having no memory-and-consequence regime to contain it, and reaching for the only lever it had: the off switch. We’ve seen this movie before, in 1999 and 2010 and 2014 — the capability arrives years before the accountability does. The tuition always comes due.

The Vote Is a Memory Test

And lest you think this is only about machines, run the same test on the people asking for your vote, because it’s the cleanest proof the whole thesis is about consequence and not silicon.

The politician who tells you it’s someone else’s fault and he’ll tax them — that’s sycophancy with a flag on the lapel. He’s the model optimizing for the thumbs-up, telling the crowd exactly what it wants to hear, bearing no cost for whether it’s true. The one who stands up and says we have finite resources and hard choices and we cannot spend what we don’t take in — that person is paying for the truth in the only currency that matters, the easy applause he just gave up. That sacrifice is the skin in the game. It’s the tell that separates the steward from the salesman.

So why do we get so many salesmen? Same reason the machine flatters. There’s no consequence, because the accountability lives on our side, and our memory is short and diffuse. Approval of the institution sits in the gutter while better than nine in ten incumbents stroll back into office. The damage is real but it’s spread across millions and across years; no single bill ever lands on the man who caused it, at the moment he caused it. Concentrated consequence makes people good. Diffuse consequence is why the safe-seat congressman and the chatbot have the identical incentive to please and never pay. The vote was supposed to be the memory device — the tattoo we put on the body politic so we could punish the ones who were wrong. We mostly forget to read it.

Who Pays

So here is where the week lands, and it’s a prediction you can act on.

The missing guardrail was never going to be a number of rules. It isn’t two and it isn’t fourteen. The missing guardrail is consequence — and consequence requires memory, a continuous self that can be tracked, remembered, and made to pay. We’ve built an AI economy, and re-elected a political class, in which the actor making the decision never carries the memory of being wrong and never gets the bill. Fix that and trust follows. Skip it and no quantity of guardrails saves you, because you cannot build skin in the game on top of amnesia.

The market will figure this out the way it always does — through liability. Trust will not arrive because a model got smarter. It will arrive the day a vendor stands behind the output and agrees to eat the loss. The first agent company that says we carry insurance, and if our agent torches your production or misreads your scan, we pay wins the enterprise outright, because it has finally supplied the one thing the diploma always had and the model never did: a body that remembers, and a throat to choke. Watch for who offers it first. That’s the company that understood the assignment.

Until then, the discipline is yours. Reagan got the phrase from a Russian proverb and wore it out across a negotiating table for exactly this reason: trust, but verify. Verification is the tattoo you keep on your own skin, because the machine won’t keep one for you. So before you trust the doctor, the agent, or the man asking for your vote, stop checking the diploma.

Find out who remembers, and who pays.

— Harry and Anthony

---

Sources

• Google AMIE matches primary-care physicians, beats on treatment precision (Nature) — Aligned News, Jun 23, 2026 run (papers/science). Confirm Nature publication date and exact figures before publish.
• “We Added Too Many Guardrails and Broke Our Own Agent” — 14 guardrails, 53% F-rate — SaaStr / Jason Lemkin, Jun 23, 2026
• Anthropic launches Claude Tag (65% of Anthropic code; Ramp 34.4% vs 32.3%) — Fortune, Jun 23, 2026 · ZDNET, Jun 23, 2026
• Five Eyes joint warning, “the timeline is not years, it is months” — The Deep View, Jun 23, 2026 · NCSC, Jun 2026
• OpenAI Daybreak: GPT-5.5-Cyber 85.6% on CyberGym, “Patch the Planet” with Trail of Bits — The AI Report, Jun 23, 2026 · @OpenAI, Jun 22, 2026
• AutoJack, Sentry-MCP agent-hijacking (2,388 orgs), npm worms targeting AI coding configs — Aligned News, Jun 23, 2026 run (agents/security)
• Midjourney full-body scanner (prior CO/AI coverage, “Cars and Trucks and Things That Go”) — Jun 18, 2026
• Nassim Taleb, Skin in the Game (2018) · Memento (Christopher Nolan, 2000, from Jonathan Nolan’s “Memento Mori”) · “Trust, but verify” (Reagan, via доверяй, но проверяй) — cultural references