Recently, the creator Dj Abba sparked a conversation by arguing that AI is making people lazy.

I disagree. People are still working hard, running businesses, and shipping products. The real danger isn’t laziness. The danger is that AI is stripping away the art of thinking.

The Friction of Intelligence

When we encounter a problem, our brain naturally engages in a struggle to connect the dots, retrieve information, and synthesize a solution. That struggle — that friction — is exactly where intelligence is built. It’s a cognitive muscle.

When we instantly hand a problem over to an algorithm, we bypass that friction entirely. We get the answer, but we skip the mental workout required to actually understand the “why” and “how.” We are actively outsourcing our cognitive processing power, and as a result, those muscles are starting to atrophy.

If this sounds like a pessimistic, anti-tech philosophy, it’s not. It is a measurable neurological trend.

The Data Behind the Decline

We already have concrete data on what happens when we replace the cognitive struggle of learning with digital convenience.

In a stark presentation on the subject, Cognitive Neuroscientist Dr. Jared Horvath revealed a terrifying reality regarding modern cognitive development. Since the late 1800s, when we first began standardizing and measuring cognitive development, every generation has consistently outperformed their parents.

That streak ended roughly around 2010.

For the first time in modern history, the current generation is underperforming the previous one on baseline cognitive metrics, including basic attention, memory, literacy, numeracy, executive functioning, and even general IQ.

“What happened around 2010 that decoupled schooling from cognitive development? It can’t be schools… it can’t be biology… the answer appears to be the tools we are using within schools to drive that learning.” — Dr. Jared Horvath

(You can watch his full breakdown of the data here).

Across 80 countries, the data shows that once digital technology was widely adopted in classrooms, performance went down significantly. Students using computers for learning purposes five hours a day scored vastly lower than those who rarely touched tech at school.

The Next Level of Cognitive Outsourcing

If basic screens, iPads, and search engines caused this level of cognitive decoupling, what happens when we hand over our writing, analytical reasoning, and coding to generative AI?

Building the technical architecture for AI systems — like zero-trust middleware and agent gateways — teaches you that artificial systems need strict boundaries, protocols, and security to function properly. The human mind requires its own set of boundaries to remain sharp. If we build systems that do all the thinking for us, we become operators rather than creators.

We must shift how we view these systems. AI is an incredibly powerful calculator, a tool to scale our ideas, and a mechanism to test our theories faster. But it cannot become a replacement for the internal engine of human thought.

Efficiency is exactly what we want for our software deployments and business operations. But for the human mind, friction is absolutely required.

Let’s not trade our greatest asset for convenience.

We used to treat debugging as a creative puzzle. It was a collaborative chaos where you’d pull a peer over, stare at a screen together, and debate solutions until a breakthrough finally hit. And above all, it was about the sheer, intoxicating satisfaction you felt when the code finally ran perfectly. You built it, you broke it, you understood it, and you fixed it.

Lately, I’ve realized how much I deeply miss that loop. In our pursuit of ultimate productivity, where entire codebases can be scaffolded, boilerplate is automated, and bugs are patched instantly, we have gained immense speed. We can ship massive platforms in fractions of the time it used to take. But by eliminating the struggle, we’ve also eliminated the reward. Software engineering is shifting from a craft of active creation to a role of high-level orchestration, and in the process, it’s losing its raw, human joy.

Y Combinator’s Aaron Epstein recently made a bold prediction: “The next trillion users on the internet won’t be people. They’ll be AI agents.”

He is entirely right. Agents are already browsing the web, managing CRMs, and making purchases. But there is a massive, underlying flaw in how we are enabling them: we are forcing autonomous machines to use software designed for human eyes and human fingers.

Currently, most agents interact with the web by scraping DOMs, filling out visual forms, or using brittle API wrappers bolted onto legacy systems. It is slow, inconsistent, and highly insecure.

My partner and I realized that to usher in the “Agent-First” web, we need an entirely new foundation. We need machine-readable interfaces built on Zero-Trust principles.

That is why we are building the Autonomous Gateway Protocol (AGP).

The Bottleneck: Why “Agent Wrappers” Are Dangerous

Right now, if you want an AI agent to interact with your backend, you typically have two choices:

1. Let a framework spin up a headless browser to click buttons on your frontend.
2. Give the agent an API key and hope it formats its JSON correctly.

Both are nightmares. Headless browsers break the second a CSS class changes. Direct API access is even worse due to LLM Hallucination. If an autonomous agent decides to hallucinate a parameter, like injecting "isAdmin": true or "discount": 100 into a JSON payload, standard backend controllers might blindly process it.

We need a physical boundary between the Agent’s reasoning engine and the backend’s execution engine.

Enter the Autonomous Gateway Protocol (AGP)

AGP is a framework-agnostic middleware layer that sits between autonomous agents and your backend business logic. It replaces human-centric UIs with secure, machine-readable discovery and execution.

We are currently in the final stages of hardening our prototype, but the architecture relies on three core pillars:

1. Native Discovery (/ai.json) Just like search engines look for sitemap.xml, agents need a standardized way to know what a server can do. AGP auto-generates a public /ai.json manifest. When an agent visits your site, it doesn't read your HTML; it reads this manifest to instantly understand your available API skills, required parameters, and authorization requirements.

2. The Hallucination Firewall Before an agent’s request ever touches your database, it hits the AGP “Bouncer.” This layer strictly validates the incoming parameters against an internal whitelist contract. If an agent tries to inject unapproved data or hallucinates a parameter, the firewall silently strips the rogue keys and processes only what is mathematically allowed. It’s a physical filter for AI unpredictability.

3. The Trust Bridge (Zero-Trust Execution) Instead of relying on traditional session cookies, AGP uses an HMAC-SHA256 signature handshake. The gateway verifies the agent’s scoped token and signs the request. The patched backend then mathematically verifies this signature before execution. The agent gets the access it needs, but your primary server secrets are never exposed to the client side.

Building for Developer Experience

Security layers are only useful if developers actually adopt them. To make integration seamless, we built the AGP “Smart Architect”, a CLI tool that uses an LLM to scan your codebase, map your routes, and intelligently patch your authentication files to accept the Trust Bridge.

Because we are dealing with LLM-generated patches, we built in an AST Safety Net. Before the CLI applies any patch to a developer’s server, it writes it to a temporary file and runs a native syntax check (node --check). If the LLM generates broken JavaScript, the system aborts the patch, ensuring your server never crashes due to a bad architectural scan.

What’s Next?

We are getting incredibly close to starting our first live execution tests with autonomous agents, and the internal results are proving that the “Agent-First” web is not just a concept, it is here.

If the next trillion users are going to be machines, it is time we gave them the infrastructure they actually want.

Are you building autonomous agents or preparing your backends for AI traffic? I’d love to hear how you are handling security and discovery in the comments below.

This wasn’t about guessing a password, it was about exploiting a conversation between two machines that trust each other too much.

The Art of the Technical Deception

To pull this off, researchers from the University of Surrey inserted their own hardware between the phone and the payment terminal to rewrite the “truth” as it traveled through the air. They relied on three specific data manipulations:

• Mimicking a Turnstile: The attack starts by broadcasting a signal that makes the phone believe it is at a subway entrance. This triggers Express Transit Mode, a “fast-pass” setting that bypasses biometric locks for the sake of commuter speed.
• The Price Tag Swap: Usually, a five-figure charge triggers an immediate red flag. The hackers intercepted the request and changed a single piece of binary data, turning a “1” into a “0”, to convince the phone the $10,000 charge was actually a tiny, insignificant amount.
• Forging the “OK”: Even if the phone is convinced, the payment terminal still wants proof that the owner approved the deal. The hackers intercepted the phone’s response and added a fake confirmation, telling the terminal that the user had already authorized the transaction on their device.

The Perfect Storm: iPhone + Visa

This specific vulnerability is a “gift” from a very specific hardware and software combination.

• The iPhone Gap: Unlike some other devices that double-check the actual dollar amount before skipping security, the iPhone relies on the reader’s “label”. If the reader says the charge is low-value, the phone believes it.
• The Visa Loophole: This is the most technical failure. There is a sophisticated “handshake” (asymmetric cryptography) that could prove the data was tampered with. While other card networks require this for every tap, Visa’s protocol allows it to be ignored as long as the payment terminal has an active internet connection.

“Fixing it in Post”

The most frustrating part is that this has been known since 2021. The industry’s response? Apple points at Visa, and Visa argues the risk is too low to bother with a technical overhaul. Their current security strategy is simply to pay you back if you manage to notice the theft and dispute it.

As someone who builds products, I know that a safety net is not the same thing as a shield.

Protect Yourself: If you have a Visa card linked to your phone, go into your settings right now. Disable the feature that allows transit payments without an active unlock. It’s a small inconvenience that closes a $10,000 hole in your security.

While I’m over here fighting for my life trying to get a React component to remember a dropdown selection, these agents are out here living full-blown lives.

The “Generative Agent” Flex

The researchers gave these agents a “Memory Stream.” It’s basically a long-term diary of everything they experience. But they don’t just hoard data like a digital packrat. They use a three-step process that makes my current codebase look like a TI-83 calculator:

1. Retrieval: When an agent walks into a room, they don’t just stand there. They query their memory for relevant past experiences. “Oh, that’s Sam. He likes decaf and hates my tie.”
2. Reflection: They take raw observations and turn them into “high-level thoughts.” They aren’t just recording events; they are forming opinions.
3. Planning: They use those reflections to decide what to do next.

The Party Incident

The coolest (and most humbling) part? One agent, Isabella, was told she wanted to throw a Valentine’s Day party. She didn’t just print Party = True.

She went around town, told her friends, invited people, and even coordinated a date. On the day of the party, a bunch of agents actually showed up at the right time. Meanwhile, I can’t even get my cron jobs to run consistently on a Tuesday.

The Moral of the Story

The Stanford study proves that “believable” AI isn’t just about how well a model can predict the next word. It’s about context and continuity.

If an AI agent can remember that a friend likes their coffee black and then uses that information to be a better “person,” we should probably stop building apps that treat every user session like it’s the first time they’ve ever met.

The Lesson: Give your AI a memory. Otherwise, you’re just building a very expensive, very fast goldfish.