Many tokens make all bugs shallow & open source’s new maintainers | Chainguard's Dan Lorenc

**Andrew Ziegler** (0:05)
Welcome back to Dev Interrupted. I'm your host, Andrew Ziegler, and here on Dev Interrupted, we've been talking about the agentic transformation and how it's been coming for engineering. And there's also a darker side to that speed as well. All of the security debt that we rack up underneath all of that progress and an internet that frankly just wasn't built for autonomous agents. And joining us today is someone who spends his weekends stress-testing the cloud code and all the places that you can take agentic engineering, but then also spends his weekday securing the global software supply chain. He's the co-founder and CEO of Chainguard, Dan Lorenc. Dan, welcome to the show.

**Dan Lorenc** (0:44)
Thanks for having me on. Yeah, a lot is changing right now. I think everyone is scrambling to try to figure out what that means and where we're going to be a year from now. Everyone's guess is as good as mine. I'll start by saying that. I've got a lot of guesses, but I've never seen software move and change this quickly. So yeah, we got to take guesses and see what turns out to be right.

**Andrew Ziegler** (1:06)
Yeah, taking guesses and I think it's about experimenting all the time. You can't be standing still.
Part of experimenting and trying new things is maybe throwing away assumptions about how engineering is supposed to be done or how it can be achieved. We've been following a lot of your work, Dan, about the way that you've been working with agents and thinking about them in a parallelized way and otherwise, getting to a state of eventual determinism through a series of gates and checks that allow an agent to drive itself forward. This is something we've actually talked about a lot on Dev Interrupted, the idea of chaos going in and progress going out. There's a lot of our listeners who are all on different stages of this journey still, of getting to that point of trusting the machine and having the security guidelines and the safety in place to go fast. I want to just start there, Dan. How do you think about the multi-clawed philosophy, for example, and everything that you've been publishing and releasing to the world?

**Dan Lorenc** (2:04)
Yeah. I think if we step back to what's happened in the last 18 months, I would say, agents in coding tools and AI auto-complete and stuff like that aren't new. Copilot in VS Code from GitHub is actually the first consumer LLM product out there. It predates Chachi BT. A lot of people forgot about that because the space has moved so quickly. And it was pretty good for a while. That kind of complemented existing development flows, though. It really was a smarter auto-complete.
Where we've gotten to in the last year, I think it has really started to change the way people are writing code, right? It's a change from you in an IDE writing code yourself, maybe the LLM saving you a little bit of typing, to that flipping. LLMs are writing the majority of the code, the people that are using them anyway are shipping today. The Cloud Code tool itself, I think it's one of the best software tools or programs ever written and released. It was in a crowded space of all of these IDEs that people were using and cranking out, and they kind of inverted it and said, no, no IDE, it's just a terminal app that's going to write all the code with bash and grep and said, just like the creators of Unix intended, right? No IDEs, your IDEs is Unix again and a tool that actually knows all those flags to a level no single person does. But it still didn't really change things until probably about six or four months ago now, which is like a lifetime in AI speak. But the models actually got really good and the tool calls got really good and the harness got really good to the point where it was just kind of, the beginning was kind of mesmerizing to watch it, slam all these grep flags and stuff and write code that way. But it wasn't really any faster and the results went terribly good to now when it's better than any person writing code that I've seen. You still have to prompt it, you still have to steer it, but you can crank stuff out in hours or days that would have taken weeks or months before. And I kind of equate this to like power tools, right? Like imagine that we've all been doing woodworking by hand for decades. Every engineer has some weird fantasy of like retiring, turning off all of their electronics and doing hand woodworking or something like that. And that's kind of how we've been writing code up until now, even with some of these fancy OOMs and IDs like cursor and windsurf and stuff like that. People are still writing every line of code. But now it's like we handed the whole industry circular saws and we're like, go try to use these things with like no safety course or anything like that. Yeah, it's a lot more powerful. People are going to get fingers cut off. You're going to make a lot of mistakes. It's a lot easier to mess something up, but you're going so much faster. And so that's sort of the shift everyone has now of like, how do we do this safely? And then at the same time, this stuff is also getting good enough where you can build entire factories around it. And we're starting to see that a lot more too. Instead of people writing and reviewing and shipping code, robots are doing that. And if you go with that same analogy of like, you know, hand work, woodworking to power tools. Yeah, this is now full assembly line mode that we are either able to create an hour just on the cusp of it. And people aren't even going to be operating those circular saws. They're just going to be operating this actuary itself.