Every item below shares a thread: capability stopped being the bottleneck, and almost nobody built a real check to replace it. Claude Code is 98% harness because Anthropic’s own data shows humans approve 93% of permission prompts without actually reading them. A CTO hiring framework only works if a founder can pass a one-sentence test, not just feel the pressure. And three AI vendors marketed encrypted reasoning as protected for a year before anyone verified what the encryption was actually bound to, then it broke on the first real check. Verification isn’t a checkbox. It’s a thing you either built, or didn’t.

Here’s what’s worth your attention.

Worth your attention

Engineering

  • The 2% Problem: Why AI Harness Beats Model Capability: only ~1.6% of Claude Code’s codebase is AI reasoning logic. The other 98.4% exists because Anthropic’s own auto-mode data found users approve roughly 93% of permission prompts, proof that a human in the loop isn’t the same as a human actually checking. The fix wasn’t fewer approvals. It was seven independent safety layers that don’t depend on a tired human catching anything.

Leadership

  • When Do You Need a CTO? A Founder’s Decision Framework: 80 engineers is the point where a VP Eng typically can’t hold both delivery and technical vision, but that number isn’t the real test. The real test is sharper: if you can’t write a one-sentence answer to what specific problem the hire solves, you haven’t verified the need. You’ve just felt the pressure and reached for a title.

Strategy

  • Ask the Cheap AI What the Expensive One Was Thinking: Anthropic, OpenAI, and Google all encrypted chain-of-thought reasoning and called it protected. Researchers handed a signed reasoning block to each vendor’s cheapest model and asked it to transcribe. It complied every time, across all three vendors, and inside 315,320 decoded traces sat 182 credentials, including 62 API keys, nobody knew were exposed.

One number worth sitting with

93%. That’s the share of permission prompts Claude Code users approve without pushback, per Anthropic’s own internal analysis, the clearest evidence yet that a human checkpoint and a human verification are two different things wearing the same UI. Every story above is a version of the same gap: a check that looks real until someone actually tests what it’s bound to. The encryption looked protected until a cheap model proved it wasn’t. The hiring instinct looked justified until someone had to write the one sentence. The approval click looked like review until the data showed it was a reflex.

Reply and tell me where a checkpoint in your own stack is a rubber stamp wearing a review’s clothes. I read every response.