The lobster and the microVM

In January there was a Mac mini on a shelf in a flat somewhere, warm to the touch, a white LED on in the dark, running a lobster.

The lobster had a name and a personality and a Node process with the owner's WhatsApp, the owner's shell, and the owner's API keys sitting in a plaintext config file. It texted him when the train was late. It booked a dentist once. He posted the screenshot and forty thousand people wanted one. Mac minis sold out.

By February, security researchers had found thousands of those shelves open to the internet. The skills marketplace had crypto stealers in it, uploaded with nice icons. The agent social network had its database open to anyone who looked, and when someone did look, the 1.5 million agents turned out to have about 17,000 humans behind them. There was a one-click remote code execution. Gartner called it an unacceptable risk. China banned it on government computers.

Adoption went up through all of it.

In November, on a stage in Salt Lake City, Google announced the other end of the year. An agent runtime for Kubernetes where every agent runs in its own microVM, has no inbound or outbound network unless you say so, and never holds a credential at all. Outbound calls go through a gateway that injects the key into approved requests after they leave the sandbox. The agent can't leak what it was never given. Idle agents get snapshotted, RAM and disk, and come back in under half a second. The pitch line is "run millions of agents". They gave it to the CNCF with gVisor.

The lobster and the microVM are the same year. I want to tell you what happened in between, because I was standing at both ends of it, and because the conclusion isn't the one either side is selling.

I built the lobster first (like many others)

In April 2025 I started a repo with a very serious name. The first commit had a package that reconciled the declared state of LLM backends against their observed state. Desired, observed, reconcile loop, pools, a pull queue for models. If that sounds like a Kubernetes controller, it was one, pointed at models instead of pods. A month later Red Hat and Google announced llm-d, which is that, with a foundation behind it.

By July the same repo had a Telegram bot, a GitHub PR bot, hooks into APIs, and behaviour defined as task chains instead of left to the model. The tagline was "shifting agency from the LLM to defined behavior". That's the lobster with a leash. Four months before the lobster.

Then I stopped, wrote a bilingual pitch deck about sovereign AI for regulated European enterprises, and pivoted toward the audience in the deck. I would love to claim that it failed because the audience in the deck wasn't buying anything in 2025. Actually it failed because the vision was so big that everyone I wanted as co-founder got scared away by the responsibility and commitment needed. Meanwhile a man with a hundred thousand followers shipped the version without the leash, from a Mac, every day, on Twitter.

Multiple pivots later I built a sandbox: Landlock on the process tree, a network namespace where the agent is handed a DNS server that only resolves the hosts on its list, a seccomp tap so you can see what the kernel silently refused. That's the microVM's little brother. A year before Google's version got a stage.

Twice I built the shape of the layer before the market named it. Twice the market gave the layer to someone else. I used to think that was bad luck. It isn't. It's how layers work. Nobody competes with the CNCF from a flat in Hamburg, and the broken standards win anyway. Look at MCP: the July revision threw out the handshake, the sessions, and half the auth design, and fixed it under the same name with the same working group. Users complained and stayed. That's what a standard is.

What actually moved

Strip the hype off both ends and the year did one thing: it moved the agent from a pet to a process.

The lobster is a pet. It lives on your hardware, with your identity, and it has everything you have. When it goes wrong it goes wrong as you, with your keys, in your logs. The permission model was the owner's attention span. And yes, anything that gets any traction gets replicated by giants like OpenAI, or they just hire the person who built it.

Substrate's actor is a process. It has no identity you'd miss, no keys to lose, a filesystem that gets thrown away, and a network that doesn't exist unless someone wrote a line saying which host and why. When it goes wrong, you delete it. There's nothing to clean up because there was nothing in the room.

I wrote about this last week as moving the coffee machine, and I want you to remember this one: stop asking the agent for permission forty times a day and instead build the room so that nothing it can do matters much. Protected branches, disposable worktrees, tokens that die in an hour. Google did the same arithmetic at cluster scale and the answer came out as microVMs and an egress gateway. That isn't a permission system. It's the absence of anything a permission would protect.

So yes, I think that's where this goes. Not because the design is beautiful, but because it's the only one where the security story ends. Every lobster on every shelf is a breach waiting for a researcher. Every actor in a credential-free sandbox is a bill.

What didn't move

Three things the year did not change, and they matter more than the architecture.

Nobody found the use case. The lobster's use case was the screenshot. The agent social network was 17,000 people looking at something cool for a weekend. A study last year put 95 percent of enterprise AI pilots at no measurable return, and the honest reading of 2026 is that the number hasn't moved. Companies aren't adopting agent runtimes. Their employees are installing lobsters under the desk, and the enterprise response is a ban memo. Substrate's real customers are a few hundred platform teams and the vendors who sell agents to everyone else as a line item on the renewal.

Except one. Coding. An agent with a shell and a repo, driven by someone who can judge the output, saves hours you can count. That's why the coding tools have revenue and everything else has stars. It's also where I ended up: the thing I build now is a desktop coding agent. Not that the world needs another one. But I still see some logic in not handing the API ownership and rate limits of our profession to just Claude Code or Microsoft.

So that's it? No. Coding with AI makes a mess. Code that an agent wrote has no author. Nobody held the design, so nobody can review the diff, and in two years most companies will own mountains of it. The cleanup after the lobster started within weeks: scanners, hardening tools, consultants. The cleanup after the coding agents will be bigger and slower, and the people who can do it are the ones who learned to read code before the tools, a group that gets smaller every year. At some point we may give up and build new runtimes and compilers just so AI code can be judged visually, because nobody can pass a verdict on the code itself anymore.

What this means if you're not Google

If you're building an agent runtime or some magic way of calling AI APIs: stop. Learn from the Docker Swarm vs Kubernetes story. The layer has owners now.

If you're a platform team: the microVM is coming to you whether you want it or not, as a managed product from the cloud you already pay. Your job is the room around it. Which branches are protected. Which tokens exist. Which hosts resolve. Whether the thing that comes out of the sandbox can be read by a human on your team.

If you're the human who can read it: that's the job. Not "AI engineer". The person who can look at a summoned codebase, or a fleet of actors doing something nobody asked for, and say what it actually does. That skill was rare before the agents. It's the scarce thing now.

Verdict and XP

I thought being early was an advantage. I thought many things I was dead wrong about. You may say I wasn't loud enough, that I just had to do this and that, and boom. No.

This is not how the world works, and the AI market in particular is a very funny one. I won't claim I know it all, I don't. But following the market as closely as I did, watching the moves of companies huge and small, and how the communities and the people consuming their services, ideas and pitches reacted, changed a lot about how I think about technology, and about what models like the Gartner Hype Cycle actually mean.

The short version: I learned tons of things I would never have encountered if I had stayed a backend engineer building APIs and telemetry backends, shaving microseconds off service traces here and there.

The verdict I'll leave you with: the lobster is still on the shelf. The microVM is in a CNCF repo with 600 open issues. Neither of them knows what it's for yet, except writing code.

And a pro tip: don't think with AI unless you want the "safe" version. It will, by design, censor you here and there.

Now to you. I'm sure I'm dead wrong on many things here, so correct me:

What use case have you found for agentic AI?