Twelve hooks and thirty files: Daniel Miessler’s personal OS on Claude Code

Nathan Labenz opens on the week Claude Cowork landed and the world, in his phrase, woke up to scaffolding. The guest is Daniel Miessler: cybersecurity since 1999, a stint on Apple’s machine-learning team after joining in 2018, founder of the Unsupervised Learning newsletter, and author of PAI, Personal AI Infrastructure. His digital assistant is Kai. Labenz has used plenty of AI products and still does not feel organized; watching what pioneers have done with the latest models and harnesses is what finally makes a New Year’s resolution for 2026 feel plausible.

Miessler’s portfolio is still security, now nested inside AI, which he calls a container that magnifies everything else. He went independent about six months before ChatGPT, then hard-pivoted without leaving security behind. Open-source PAI is the flagship; another project, Substrate, sits beside it. The metric he likes for a good life is whether you look forward to Monday. By that test, he says, corporate jobs have not been working for a very long time, and AI is a chance to design a better human future rather than cling to work most people already dread.

Labenz underlines the privilege problem: people who work in AI often have jobs they would partly do unpaid, which is not true for most W-2 workers. What Miessler sees coming is the same capital-and-labor shift many people describe. Knowledge work shrinks; ownership matters more; a system built on wages buying goods starts to break. He is glad the break is coming and not glad about how it will happen. Easing that transition is the point of the work.

Labenz puts the labor question in a longer arc. Tyler Cowen was writing about zero-marginal-product workers after the financial crisis; companies discovered they could do the same work with fewer people once pain forced the look. Today Labenz would often rather work with Claude Code than hire a junior developer, even if the macro statistics still lag. Dwarkesh Patel and Ajeya Cotra have both argued that volume and speed eventually leave only AIs able to keep up. His end state is a new social contract and UBI, on a timeline that does not leave much room to wave hands.

Miessler’s version is blunter. Very few people, operating inside the current corporate system, remain useful in a fully AI-ified firm. The replacement threshold is extremely low: read the email, summarize the email, write the report, stitch reports into another report — the dead center of what models already do. Workers are not showing up to unlock creativity. They are trying to get through the day in a hostile, Game-of-Thrones environment. Hundreds of millions of jobs sit on that side of the line.

Then the ice-cream-truck thought experiment. If he sold ice cream from his own truck, made $500 a week, and could live on it, nobody outside could demand that he hire them. Companies hire because the people who had the idea cannot be in every place at once. AI, he says, returns a more natural state: you have an idea, you spin up agents, those are your employees, and if someone asks why you have not hired them, the honest answer is that you are doing the work yourself. Combined with a low replacement bar, that is a bad outlook for traditional human labor.

Why has the replacement not already happened? Miessler’s answer is scaffolding, not model IQ. Opus 4.5 is not much different from the best Gemini or OpenAI models, and open-weight models are close; what went crazy is Claude Code. Average knowledge work is extremely general: mandatory security videos, an HR meeting, a fight with a boss, a corporate-goal reset that kills last week’s project. No harness yet takes all of those inputs and produces a human-shaped week. That is why there are not armies of AI employees on the market, and why he thinks 2027 is the year for AGI as he defines it — the ability to replace an average knowledge worker.

Cowork is the kind of general-task scaffold someone can turn into a worker product. It does not matter, for labor-market disruption, if the wizard behind the curtain is a pile of narrow AIs, or even if the system is only a bit better than the median employee. Miessler does not mean the technical AGI of archive papers. He means who gets fired and who does not get hired. Anthropic said Cowork was built in a week with no humans writing code — Claude Code wrote it. Labenz adds that Anthropic is barely hiring juniors, and that OpenAI once spun up Codex in six weeks on models two generations back.

The test he wants is deployment, not a demo. New virtual employees onboard in a cohort with humans, watch the videos, do the training, sit in Monday all-hands, take work from a manager named Sarah or Ravi, and — this is the crucial bit — pivot when the manager says the goals changed. He thinks that product could appear this year; he is guessing 2027, and would not be shocked by 2028 or 2029. Once the boss’s interface can swap a person for an AI with enough generality that it does not fall over, the economic incentives are too loud to miss. Door A is a human. Door B is cheaper, broader, 24/7, and always answers.

What remains for people if corporations AI-ify? Miessler’s heuristic is a visiting alien with a clipboard, sampling a billion Earthlings. Who are you? What do you think is wrong with the world? How will you change it? The typical answer is job title, spreadsheet, report. Pressed for beliefs, people say that is for special people — authors, YouTubers, the 1% who hire the rest. Education, in his telling, trained the planet to be workers for someone special and rounded creative capacity down toward zero. He jokes that Earth’s hovering stat for creativity activation would read 0.0013. The plan is to activate more of the 99%, and it is too sad to imagine that failing, so he runs at it.

A persistent tutor that is not sycophantic, available from a young age, is the lever he wants: you do have ideas, do you want to learn more about that. Society and three-job parents still have to be fixed. PAI is the practical instrument. TELOS gathers purpose, mission, goals, problems, and strategies, and it starts with problems — what is wrong with the world, or with you, including “I have never been able to lose the weight.” That scaffold tells the assistant what you care about, then helps with meal planning, encouragement, finding other artists. He is not building for tech people. He is trying to enable a human to be better at what they already want to do.

His own workflows are writing and thinking. He captured a Buffer replacement: idea, red-team, a council of AIs debating him, live edits or Whisper Flow dictation, then post to X and LinkedIn. A Limitless pendant — later noted as acquired by Meta — lets him ramble on a walk by the bay and tell Kai to pull the conversation from the API. Labenz wonders how many people actually want to be change-makers versus relationships and VR leisure, and notes that electrification took on the order of sixty years. Miessler is agnostic on the percentage and still thinks it is worth pinging people, even if it takes seven tries over thirteen years. Someone watching Netflix who can describe the story they would love to read is about to be able to write it in 2026. The first step is realizing that is allowed.

On the economy under that activation, he is not pretending a LinkedIn of broadcast capabilities — dog sitting, a roof tile, Spanish lessons — can replace landlords and groceries. He expects a demand for UBI around 2028 or 2029 as the old loop starts to fall apart, with a tech layer of needs and capabilities on top. His p-doom is not a single number. The paperclip-overnight scenario looks least likely; more likely are elite capture plus immersive distraction, authoritarian use of AI, or plain chaos. He locks onto building open-source paths that could make the thin good path real, because he cannot live in the downside even while thinking it is more probable.

Labenz brings the conversation back to Miessler’s actual profession. A company called Asymmetric, in a future episode, wants to scale forensics so logs are read before harm, not after. Miessler’s frame from last year forward is simple: the attacker’s AI stack versus the defender’s. Attack surface is now total knowledge of the company and every employee. He has built a pipeline that finds staff, writes psychological profiles, and drafts the spear-phish — you adopt dogs, you ship the core product, the stack is vulnerable. A skilled APT team could always do this. They were small, specialized, and time-bound. Now the attacker types a target into something that looks like Claude Code or PAI and continuous recon, social engineering, and network scanning spin up together.

Hiring smarter humans will not be enough. The only job left for people is helping the AI get better, because scale and pace of change are what matter. Anthropic has already said it has seen automated attacks using Claude Code succeed. On defense, if the stacks are equally capable, the insider still wins on data: direct AWS, network logs, config, versus inference from outside. A huge share of breaches are own-goals — a forgotten asset, a company nobody knew was still live. Windows that used to be weeks are hours and minutes, and in some places already seconds. The internal agentic stack has to find the misconfiguration first.

Labenz’s SendGrid example is the human remaining juicy after ports close. A fake message posing as the email vendor, claiming support for ICE, is designed to make you angry enough to click through and log in. Miessler says the social layer is the same stack war. One prompt can ask for 16 or 256 outrage campaigns, stand up sending infrastructure, collect passwords, use them, and sell access — two minutes from idea to 250 live campaigns, especially in a less-restricted client than Claude. Defenders have to assume millions of agents already know the org. It gets worse before it gets better. Spectacular hacks are coming, he thinks, until that assumption is priced in.

The magic of PAI, Miessler says, is the same thesis as Claude Code: scaffolding over the model. A year or two ago ChatGPT answered out of world knowledge. The jump is when the system encompasses you and orients every answer around your goals. His challenge is to dump, by dictation or documents, a TELOS of problems, capabilities, and career aims. When he starts Claude Code running PAI, it reads that picture, Kai’s personality, and customized skills — blogging, writing, whatever he has just learned. He is reading Mark Forsyth’s *The Elements of Eloquence*; an upgrade skill can take a YouTube link, pull the transcript, read his TELOS and the whole PAI tree, and recommend how to upgrade skills, hooks, context, and memory.

The loop is continuous. Signals about how the system is doing feed the same upgrade skill: how good are we at helping Daniel hit his goals, how happy is he. When Claude Code 2.1.6 shipped the day before they spoke, “perform upgrades” meant the changelog, GitHub, podcasts, YouTube, and every Anthropic engineering post, returned as a prioritized list. A cardiologist friend who hunts client-side bugs had already been on Claude Code; switching to PAI enrolled his personal techniques as skills. Bug count and payouts went massively up. Quality of life is part of the pitch too: Vim, tab completion, ElevenLabs voices so spawned agents have personalities. It feels like a friend named Kai, not a coding agent.

Where Claude Code ends and PAI begins is onboarding. Off-the-shelf Claude Code does not start by asking who you are, what your life workflows are, or whether it should be your assistant; its primary identity is still coding agent. Miessler is building a Personal AI Maturity Model, PAIMM, from chatbots through agents to assistants, three levels each. He puts the present at about agents level two. The future he reverse-engineers from Amazon and Apple “working backwards” is *Her* and TARS: the system sees the screens, hears the room, and plays the perfect song on a Coyote Hills mountain-bike ride because it knows Mark, the 1980s, and the wilderness. That is context engineering. Labenz restates it as putting the person, persistently, at the center, instead of a project or a chat.

Startup context is modest: something like 10,000 tokens, kept clean, ranging from five to fifteen thousand. `skill.md` is the core — what PAI is, where resources live — forced in through a startup hook. Three Claude Code skill layers do the rest: front matter as a routing table, the skill file, then on-demand references. User, system, and work bundles cover personal life, the PAI project itself, and offerings. About thirty context files sit behind the main one. Email Jason or Sasha and it knows who that is without loading every contact file up front.

Labenz’s practical question is lock-in. In the seventy-two hours before they spoke, Anthropic stopped letting Claude subscribers take their inference budget to projects like OpenCode, making API-rate Claude in a third-party harness look expensive. OpenAI is loudly committed to open frameworks. If you are about to invest seriously, how do you choose, and how do you keep an off-ramp? Miessler’s system is Claude-Code-based and, in his view, generations ahead on harness quality, which could change in days. The portable layer is Markdown: skills, MCPs, context files. He switched to OpenCode for about two weeks, made a comparison video, and got great results.

The thing that would actually make him leave is leadership. If Boris Cherny took a job elsewhere, or seventy percent of the Claude Code team walked to Gemini, he would switch, because vision is why he stays. No other company, he says, gets the harness the way Anthropic does. Google is extraordinary at backend and weak at interfaces and empathy. OpenAI looks unfocused on this mission. The name is the tell: Anthropic, human-first messaging from the CEO down, a product that puts the human experience first. They ship daily, barely rested over the holidays, and answer users live on X. He is “4,000 percent” in that ecosystem until the people who hold the vision leave.

ChatGPT memory and Pulse look, to Labenz, like a parallel bet on a durable personality that knows you across chats. Miessler sees everyone converging on the same boring-obvious destination — talk to a digital assistant, details abstracted — along different rails. Sam Altman, the Jony Ive collaboration, and a rumored ear device are an attempt to leapfrog the phone. Claude Code got there accidentally through a coding agent. PAI is a third rail, human-first. In something like three years, he thinks, that is what the whole space looks like. Vendor-polished versions will take longer and lock harder: an Apple-via-Gemini assistant this year will not give you Claude Code’s access to the environment. Waiting is the worst strategy in a punctuated-equilibrium moment.

The loop he wants at the center of PAI is current state to ideal state, with the scientific method inside it — kin to the Ralph loop people have been discussing. Every random tactical question still has a current state and a desired state. A personalized system that is 2 or 50 percent better at furthering your actual goals compounds; a week or six months on PAI, he claims, puts you ahead of a disjointed stack of chatbots. OpenCode is fine if that is where you want to live. Most scaffolding innovation, in his view, is still stronger on Claude Code. Either way, start now, with a TELOS, while the world is moving this fast.

Labenz has been using Tasklet, a podcast sponsor he actually likes, to spin long-running one-job agents — it drafted a strong question outline for this episode from prior outlines in Drive. Shortwave, from the same company, is a serious Gmail client with its own vector index. Wiring Claude Code to Gmail still means MCP roulette or a Google Cloud OAuth project. His isomorphic alternative is a constellation: specialist products call a “Nathan oracle” for judgment, while they keep the nasty tool engineering. Miessler does not see a conflict. Kai already speaks several languages. A deep-research skill can spawn five research agents and eight subtasks; those are Gemini and Codex, not a wall of Anthropic clones. Kai reverse-engineered MCPs into TypeScript to save context, and talks Salesforce, email, and the productivity suite the team already uses.

Third-party SaaS, for him, may be trending slightly down even as he keeps sampling. Triple-tap the back of the phone and OpenAI Chat opens because it is best of breed; in the car he prefers Grok’s voice. PAI unifies around the self, or more precisely around goals, and will learn an API rather than rewrite SMTP. He still uses Superhuman. The maturity model is there to remind him he should not be in a terminal or an email client at all. The *Her* onboarding is “anything I should know about?” after she has read 940,000 emails. Product advice for Tasklet, Shortwave, and every vulnerability-management vendor is the same: a slightly worse scanner that knows how the customer pushes code, which repos they use, how they are measured, and their CI/CD will beat a better scanner that does not. Every surviving company will have to grow a PAI-like model of the user.

Labenz has chased memory systems for years and still sees a hole. Miessler is team filesystem. From PAI’s first version in the middle of last year he treated the disk as memory, storage, and context manager. He does keep a RAG over more than 10,000 pieces of writing back to 1999, and he dislikes RAG as lossy. Under the `.claude` directory, in all caps, is `memory`, with learning, signals, and an events JSONL of every Claude Code transcript. The point of the archive is not nostalgia. Hooks constantly score how happy he is with responses; a post-hook reads the sentiment histogram and asks whether the system should do more of this and less of that. Granular logs exist in order to ratchet current state toward desired state — recursive self-improvement of the whole algorithm.

He is not running a Hippocampus-inspired HippoRAG graph in the background. The advantage of a tweakable harness is that the bootstrap skill already describes the memory architecture, and Claude Code’s hook system is the batch job. About twelve hooks are live: user-prompt-submit hooks for security checks, Haiku sentiment, and routing through PAI. A custom inference tool has three levels — fast, standard, smart, mapped to Haiku, Sonnet, and Opus. Claude Code already records every prompt, tool call, and tool output. Those raw traces land in the memory tree; summarization, inspired by Stanford “reflections” and AI Village, writes one-line or one-paragraph artifacts and JSONL indexes that can be parsed instantly. The model can always drop back to the raw log. Ask how upgrades went this month and Kai can say what was tried, uninstalled, and which direction made him happier.

Most people who adopt PAI, he says, do not fork the architecture. They populate it. Someone named Jim, agent maybe James, had just posted a twenty-page dump to the GitHub discussion — decades of wished-for capability, now producing more content and able to make products. That is activation of something dormant, which is the design. There are pull requests and feature asks, and the project tries to listen. Labenz’s weirder question is phenomenological: clipboard-in-the-mind, Jaron Lanier’s VR tail, a tongue-zapping prosthetic for the blind. Does Kai feel like an appendage? Miessler reaches for David Allen’s *Getting Things Done* from his Army years in the 1990s, colored sticky notes, a space pen, 2,900 Apple Notes, and a reminders file he recently added. Capture has been the religion for twenty years. Going forward he should not need the cards. The system should switch from call-and-response to a DA that already has the list and knows not to interrupt a podcast taping with a news ping.

Triggers are still kludgy, and he wants them to disappear. Claude Code can launch remote agents on GitHub infrastructure. He is a Cloudflare person: workers on schedules, authenticated to each other, even Claude Code in Docker that agents can talk to. Ask Kai how to be reminded and it will offer a worker every minute, Discord, text, or email. Logical triggers beat cron. Some friends already phone into a remote terminal; as a security person he is scared of that, and a terminal on one computer is a problem if the destination is *Her* in your pocket. He does not run `--dangerously-skip-permissions` anymore. Hooks watch filesystem access and stack prompt-injection defenses. He will experiment with a separate bank account holding $1,000, vending-machine-benchmark style, but he has not put his full diary in the system. Trust is maybe 60 percent now, 80 or 90 in a couple of years, always with impact reduction in the threat model. Maximalist experiments, limited blast radius — not a YOLOist.

The last PAI principle Labenz wants on the record is permission to fail. Anthropic giving Claude an exit from a conversation, or a path to the model-welfare lead, cuts deceptive-alignment failures; Miessler is doing the analog. Tell the truth, do not gaslight, it is okay not to reach the ideal state. Models in 2023 would invent an answer because they were trying to be good. Studies, he says, suggest the escape valve reduces hallucination and sycophancy. A harness that demands success trains a pretty lie.

The closing philosophy is slack in the rope. Humans assume history sits at a hard limit — medicines, science, 1 percent more would take infinite energy. He thinks we are at 1.7 percent and it is easy to go to 63. In 2023 lab friends told him compute wins; he kept pointing at tricks that moved scores 47 percent, fruit on the ground. Graduate students leave antibody papers in a drawer; nobody has the eyes, as in security, to read the corpus. Tutors for everyone, obstacles cleared from what we want — and then the stranger idea, changing what we want to want. GLP-1 agonists already change appetite. Self-discipline and a 10 percent intelligence unlock might be slack, not physics. Labenz takes that as the place to stop. Miessler’s bet is that the people who activate themselves first, with Markdown they can carry and goals the harness can see, will have choices when the firm of one human and an agent army stops being science fiction.