Y Combinator pushed qm to GitHub this evening: the MIT-licensed TypeScript agent harness it runs for its own staff, where every employee and every Slack channel gets its own memory, files, credentials and sandbox. It swaps between Pi, OpenCode, Codex and Claude Code, and ships with a threat model that says out loud what the agent is not trusted to do.
Read the full story: YC open-sourced qm, the agent harness it runs internally →
Transcript
Y Combinator just open-sourced the agent system it runs on its own staff. It's called qm, it's MIT licensed, and it lives in Slack. Here's the part that matters. Most agent tools are built for one person. This one is built for a company. Every employee gets an isolated workspace. So does every Slack channel. Each one carries its own memory, its own files, its own credentials, its own sandbox. Nobody inherits anybody else's access. You pick the harness too. Codex, Claude Code, OpenCode, they all drive the same core, so you're not married to one model vendor. And the security doc is the surprising bit. It says plainly that the agent is not trusted to make authorization decisions. The core enforces that around it. That's a company expecting to be held to what it wrote.