What the episode covers

Latent Space published a 107-minute conversation on 2026-10-27 with Katelyn Lesse and Angela Jiang of Anthropic. The subject is the engineering behind the Claude Platform: shipping Opus 5.5, scaling the API, running managed agents reliably, and - in the segment the episode is named after - separating the model’s “brain” from the agent’s “hands”.

The show notes break the architecture into three parts explicitly: the brain, the harness, and the sandbox. That phrasing is the most useful thing in the episode for anyone building agents, because it names a boundary that most home-grown agents blur.

The split, explained

A naive agent looks like this: the model is given a tool, the tool runs with whatever permissions the process has, and the model sees every result. Everything lives in one place, including the credentials.

The split looks like this instead:

  • The brain decides what should happen. It reads context, plans, and emits a tool call. It never holds a password, an API key, or a file handle.
  • The harness turns that intent into an actual operation - which tool, which arguments, in what order - and enforces policy on the way.
  • The sandbox executes. It is the only part that touches the filesystem, the network, or a credential store, and it can only reach what it was scoped to.

The value is not elegance. It is that each layer fails differently and can be constrained separately. A prompt injection that convinces the brain to exfiltrate data still has to get past a harness that will not emit that call, and a sandbox that cannot see the file.

Why credentials belong on the hands side

The 1:05:25 segment is about protecting credentials and sandboxes, which is the operational heart of the design. If your API keys sit in the same context window as untrusted text - a web page, an email, a PDF - you have handed the attacker the same primitive you gave the model.

Keeping credentials on the executing side means the model can ask to send an email without ever knowing the SMTP password. The harness authenticates; the model only names the action. That is the difference between “the agent has your password” and “the agent can request one specific operation that you pre-authorised”.

For desktop agents this is the whole ballgame, because the machine holds everything: browser sessions, saved passwords, tax files, work documents. An agent that runs with the user’s full token is not an assistant, it is a remote shell with good manners.

The unglamorous part: rebuilding the API in Rust

At 56:05 the conversation turns to rewriting the Messages API in Rust, which is the kind of detail that rarely makes a launch post but determines whether a platform holds up. The pairing is deliberate: managed agents imply long-running sessions, retries, and many concurrent connections, and those are exactly the workloads where a rewrite pays for itself.

The lesson for smaller builders is about where to spend effort. Most teams spend their time on prompts and tools; the failures they actually hit are timeouts, partial writes, and a process that dies halfway through a task. Infrastructure is the feature.

What to copy on a Windows desktop

You do not need Anthropic’s platform to apply the split. On a single machine, it maps to four concrete choices:

  1. Separate the planner from the executor. One component decides, another performs. If your agent’s model call can call Move-Item directly, you have no boundary.
  2. Scope the executor to a folder, not the drive. The executor should be able to reach D:\work\q4, and nothing above it.
  3. Keep secrets out of context. The model should never see the password it is asking to use. Approval prompts are the interface, not the credential.
  4. Log at the executor. The brain’s narration is a story; the executor’s log is evidence. If the two disagree, the log is right.

That is the model MOOGH uses: the plan is shown to you first, the execution happens under a scoped permission, and the action history is recorded by the side that actually did the work. Download MOOGH to see the approval step in practice.

FAQ

Does this architecture slow agents down?

It adds a hop, and the episode’s own framing is that speed and safety are traded deliberately. For long-running managed agents the bottleneck is usually reliability, not the extra indirection.

Is the sandbox enough on its own?

No. Isolation without scoping just moves the blast radius. The value comes from the combination: the model cannot name an operation the harness will not authorise, and the sandbox cannot reach what it was not given.