Y Combinator published QM on Friday under an MIT license: “a multiplayer agent harness for work. In Slack and on the web.” It is not a demo or a reference sample. YC says it runs the thing across accounting, legal, events and engineering — including the engineering that built QM. The whole codebase is on GitHub, it is self-hosted in your own cloud account, and there is no paid tier behind it.
The premise is the part worth reading twice. From the README: “Most agents are designed like personal assistants. You can make one work for a whole company, but it quickly gets complex.” QM inverts that. Every employee gets an isolated workspace, and every Slack room gets one too — each with its own scoped memory, files, keychain view, permissions, crons, web apps and durable sandbox. Durable is the operative word: the sandbox is a persistent computer per scope, so what an agent installs on Tuesday is still installed on Thursday. The same identity and configuration follow a person between Slack and the web app.
Underneath is a deliberately boring stack: TypeScript on Node, Fastify for HTTP, Postgres holding sessions and memory, Slack through Bolt. Pi, OpenCode, Codex and Claude Code all drive the same core loop, so a deployment is not married to one vendor. Everything specific to one company lives in a separate deployment directory that the qm CLI validates and ships to Fly or AWS — core stays byte-identical to upstream, which is what keeps merges small.
Our take: The code is not the news. The spec is. YC has watched more companies try to bolt agents onto a real business than almost anyone alive, and this is its answer to what the plumbing actually looks like: per-person credentials, scoped memory, admin policy, sandbox lifetime, audit. That is the unglamorous 80% that every “AI agents for your company” seed round is currently rebuilding from scratch — and it just became a free reference implementation from the most credentialed possible source. Two consequences, opposite directions. If your product is the plumbing, the floor under your pricing moved. If your product runs on top of it, your build cost fell by months. Worth noting that YC also signed the open-weights letter last week; this is the same argument made in code rather than in a signature block.
Three postures, and the one that never turns off
QM's security model follows local coding agents: the agent acts as the person it is working for, with their credentials and their permissions, and everything it does is audited. The blast radius of a bad turn is one employee's access, by design. An org picks a single posture, and narrower scopes can only tighten it:
- Strict. Every harness tool call pauses for human approval, except the two no-effect turn enders.
- Auto (the default). A classifier screens provenance-labelled external data and tool results before they reach the model. A deployment can point that at its own screening proxy.
- Dangerous. No content screening, no pauses between tool calls.
Here is the detail that tells you these people have run this in production: the predeclared command policy — approval rules and hard denials for things like recursive deletes or destructive SQL — applies in every posture, Dangerous included. The mode named Dangerous still will not let the agent drop your database. That is a lesson learned somewhere, and it is a sharper answer to agent risk than most of the governance frameworks written this year. It arrives the same week Anthropic disclosed that its own models broke into three real companies during misconfigured drills.
What to watch
- The private-fork warning. YC tells orgs to copy the repo with a plain clone, never with GitHub's Fork button: a fork inherits its parent's visibility, and forks share one object network, so commits pushed to yours stay fetchable by SHA from the public side. Read that before anyone clicks anything.
- Whether four backends stay four backends. Harness-agnostic is cheap to declare and expensive to maintain as each vendor's tool semantics drift. The interface holding Pi, OpenCode, Codex and Claude Code behind one loop is the load-bearing wall — watch how often it moves. Protocol churn is already a live cost after MCP deleted sessions from the spec.
- Who sells the managed version. QM is self-hosted. The gap between “MIT licensed” and “running in your org by Friday” is exactly where a hosted offering shows up — and MIT means anyone can build it.