AI Builder Notes - May 2026

May’s feed was dense. Lots of people converging on the same ideas from different directions - workflows over agents, cheap models in good loops, and security as a harness feature rather than an afterthought.

Six things worth knowing

1. Design the workflow first, pick the agent second. A useful agent task has a source of truth, a narrow action, a verifier, and a stop condition. “Review this repo” is vague and useless. “Find auth bugs in these routes, cite file and line, run the relevant tests, and stop after the first credible exploit path” is a workflow you can build around.

   Claude Code’s dynamic workflows feature captures this well. Describe a multi-step workflow in natural language - “update docs, run tests, do security review, run playwright” - and it generates a JavaScript orchestration script that figures out which parts can run in parallel and which must be sequential. [1]

2. Split planning from execution. Spend the expensive model on taste, decomposition, and risk discovery. Once the task has tests, rubrics, logs, or examples, switch to cheaper or narrower models for the repeatable implementation work. [2]

3. Don’t judge a workflow by the model name. If the loop has repo access, a rubric, tool call inspection, and a verifier, a less fashionable model can still do genuinely useful work. The Letta Code + GLM 5.1 review-bot is a good example - interesting because the loop made a cheaper model viable, not because “someone used X instead of Y.” [3]

4. MCP tool definitions are rotting your context. The monday.com GraphQL comparison was the sharpest warning: one task used 15k tokens through SDK/code-mode and 158k tokens through a real MCP server. Same task. MCP is useful, but a broad menu of tools is not automatically an efficient interface. [4] [5]

   My takeaway: prefer CLI over MCP by default. Use MCP only when you’re actually accessing a remote service.

5. For browser work, save the trace. Run the workflow once, watch what the agent wastes time on, replace repeated clicking with direct reads or JavaScript where it’s safe, and save the shorter path as a skill. That’s how browser agents get cheaper over time instead of just more automated. [6]

6. Security is a harness feature, not a prompt instruction. Stop rules, restart paths, permission gates, package-age delays, secret proxies, branch gates, logs, human approval - that’s the system. “Tell the model to be careful” is not a system.

Workflows in practice

The mechanical version of “dynamic workflows” is more interesting than the marketing version. You give Claude Code a high-level task, say “workflow,” and it writes an orchestration script. That script creates smaller work units, spins up coordinated subagents with bounded targets, and pulls their outputs back into one final answer or patch. [1]

This works when the task has real shape: inspect five services, compare three implementations, test each candidate fix, collect account-specific data from a logged-in browser, review a large diff from multiple angles. It’s a bad fit for questions where one careful answer is enough.

Same pattern at smaller scales. One thread framed GPT-5.5 xhigh as the planner with Composer 2.5 subagents as implementers - the stronger model investigates, writes the plan, and delegates branches, worktrees, and PRs. [2] Cursor review skills running for 30 minutes are the same idea with a time budget: deeper search, more files read, more call paths followed, fewer drive-by comments than a quick /simplify. [7]

The “100 tool calls before answering” Codex prompt names something that’s missing from a lot of agent runs. Don’t stop at the first plausible answer. Read more. Falsify more. Show the trail. [8]

And since Claude Code and Codex fail differently - different failure modes, different blind spots - the harness needs stop conditions, escape routes, and restart logic tailored to each. [9] The model can plan the work, but the harness has to notice loops, stale branches, broken assumptions, tool spam, and situations where the agent should stop and ask.

Cheaper models in better loops

The Letta Code + GLM 5.1 review-bot raises a useful question: what did the loop provide that made a cheaper model viable? Answer: repo context, a review objective, expected output shape, examples of good comments, and a way to reject junk. Those things matter more than the logo on the model card. [3]

Ramp’s spreadsheet retrieval case is the same lesson from a different angle. A specialist RL-trained model reportedly beat Opus on a narrow task. [10] That doesn’t mean every team needs custom RL. It means narrow, verifiable work can reward narrow training, narrow evals, and narrow interfaces.

If you know exactly what you want the model to do, and you want to scale it, aim narrow with the loop and harness. You can get away with a much smaller bill.

Command Code repairing tens of thousands of tool calls is another version of this. Tool use fails in repeatable ways - malformed JSON, wrong argument shapes, missing state, wrong sequences, bad retries. If those errors can be caught and repaired automatically, the model gets a better workbench. [11]

The Cloudflare Code Mode comparison is the practical reminder. A GraphQL API task took 1 step and 15k tokens through SDK/code-mode, versus 4 steps and 158k tokens through a real MCP server. [4] [5] Give the model a small, typed, task-shaped API when you can. Don’t assume a broad tool menu is better just because it feels more general.

Browser skills that actually got faster

The most concrete browser-agent example this month is Hermes Agent / Autobrowse. A Hacker News workflow went from 102 seconds to 35 seconds, 23 turns to 8 turns, and $1.46 to $0.28 - after the trace was simplified and saved as a skill. [12] [6]

No magic browser control involved. The trick was noticing the repeated slow path. If the agent clicks through the same UI every time, inspect the page, read state directly where possible, remove wasted navigation, and save the shorter path. That’s a real skill - the agent gets faster because the workflow gets smaller.

Adjacent tools worth tracking: OpenAI’s Chrome plugin [13], BrowserCode [14], Autobrowse [6], browser-harness [15], Pi browser extensions [16], and Hermes browser skills [12]. The category is logged-in browser work - support queues, internal tools, research, scraping, QA, admin ops. Anything where the useful data sits behind a session.

Memory and retrieval

Birdclaw [17] gives agents access to a Twitter archive, which is more useful than it sounds for building context from past conversations. GBrain [18] points at a personal recall layer around OpenClaw / Hermes-style workflows. PageIndex [19] is a useful reminder that simple BM25 retrieval still has a place - you don’t always need embeddings.

The “RAG comeback in about 8 months” take [20] lands because the archive problem is still unsolved in practice. A giant archive isn’t memory. Memory is knowing when to search, what to retrieve, how much to inject, and how to preserve provenance. A liked-tweets feed becomes useful only if the distillation keeps links, dates, claims, and enough source texture to audit later.

Security and guardrails

Cloudflare tested Anthropic Mythos against fifty repositories. [21] Separately, Claude Mythos Preview reportedly helped Firefox fix more security bugs in April than in the previous fifteen months combined. [22]

Don’t read either of those as “AI fixes security now.” Read them as: scoped security work is becoming agent-shaped. Known repo, known bug class, patch candidates, review loop, humans still responsible for merging.

The most useful boring guardrail: package-age delay. Both pnpm and npm have settings that prevent installing packages published too recently. [23] [24] This matters more with agents because agents install dependencies at machine speed. A small delay catches some supply-chain attacks before they enter your workflow.

pnpm config set minimumReleaseAge 2880

npm config set min-release-age=2d

Clawvisor [25] belongs in the same bucket - approve agent access without handing raw credentials to the model. These boring permission layers are more interesting than another demo where an agent clicks around a dashboard with full access.

Tools worth opening

• Harness engineering learning site - useful vocabulary for the parts around the model: evals, stop rules, retries, logs, verification
• LiteParse v2 - Rust PDF parsing for agent/RAG workflows where PDFs are the bottleneck. The useful question isn’t “is it fast?” but “does it preserve what your downstream model needs?”
• Patter - voice AI in a few lines with multiple providers. Good for prototyping voice workflows without committing to one stack
• Minions - mission-control style UI for Hermes Agent tasks. Worth a look if you’re running multiple local agents and need a control plane
• OpenRouter Pareto Code - route to the cheapest code-capable model above a score threshold. The right kind of boring optimization for frequently-running agent loops
• OpenRouter Response Caching - useful for tests, retries, and repeated agent prefixes. Caching isn’t glamorous, but repeated context is where agent bills quietly grow
• Flue - TypeScript sandboxed-agent framework with runtimes and a secret proxy. Run the agent in a controlled runtime instead of giving it everything
• Zero - programming language for agents with explicit capabilities, JSON diagnostics, and typed safe fixes. Explicit capabilities are a cleaner interface than vibes and instructions