Entanglement

When everyone's AI assistant is wired into everything, who can untangle the knot?

In January, Federico Viticci described the assistant he runs on a Mac mini. He talks to it through Telegram, it works across his Gmail, Notion and Todoist, and "it has access to a shell and your filesystem." Tomasz Tunguz described scripts that send email, update a CRM and draft replies: "All of it lived in a folder on my laptop, accessible only through the terminal." This summer, Thanh Pham's scheduling agent booked a call with a founder who said afterwards, "I had no idea. I just figured it was someone you worked with."

These are early adopters, but every step they took is cheap to copy, so versions of it now show up wherever people use AI tools at work. Each person ties an assistant into accounts, tools and other people, mostly to get more done than they could a year ago. Multiply that across a workplace and the ties run between colleagues, vendors and clients faster than anyone can map them. I've started calling this pattern entanglement. Earlier waves suggest how institutions answer it: not by cutting the knot, but by untangling it.

A Gordian Knot

Entanglement is three things happening at once. An assistant acts on one person's delegated authority. That person has wired it into resources that other people or firms own. And no single party can see or revoke the whole chain. Shadow AI, BYOAI and agent sprawl describe what IT can't see. Entanglement describes what no one controls alone: even with full visibility, an administrator sees only one end of each thread.

It shows up in four strands:

• Tools: instructions flow in. Datadog notes that "a cloned repo can therefore bring skills into a trusted Claude Code session." One person's toolchain quietly runs other people's code.
• Access: authority flows out. The Cloud Security Alliance notes companies connecting to MCP servers "sometimes via individual employees establishing their own OAuth grants." Each connection hands an assistant a scoped slice of one employee's access.
• Memory: context outlives the job. Tian Pan imagines a new hire whose personal AI subscription holds "eighteen months of accumulated context from their previous employer." The context belongs to one firm; the subscription belongs to the person.
• Counterparts: authority crosses firm lines. When Pham's agent booked the call, the founder on the other side couldn't tell whose instructions he was dealing with.

We've been here before

Sachin Benny calls the early phase of a technology kit time: "the brief moments of unstructured space and time where technology gets interpreted and changed." Phone phreaks once whistled 2600 Hz into handsets to take over trunk lines. Workplaces have had several kit times, and each ran informally for years before institutions caught up:

• Employees blogged, and some were fired for it. In 2005 a group of IBM bloggers wrote the company's first social media guidelines themselves. People kept posting, under shared rules.
• iPhones and Dropbox arrived at work before IT approved them, and "BYOD" became a recognized term between 2009 and 2011. People kept their phones; IT walled off work data inside them.
• Spreadsheets turned analysts into programmers. JPMorgan's 2012 London Whale losses involved "spreadsheet miscalculations that caused large valuation errors," per its SEC settlement. Analysts kept their spreadsheets; firms added end-user computing controls for the ones that mattered.
• Bankers moved client conversations to WhatsApp and personal texts. From 2021, US regulators fined dozens of firms for business done in channels nobody recorded. Bankers kept messaging clients, on channels that keep a record. This is the nearest fit: the knot ran between firms, and the untangling came from outside them.

Catching up rarely meant banning the thing. It meant untangling it: pulling a few control points, such as records, keys and approvals, and only those, back to the center, while the work stayed at the edges. Sociologists call the settling of a technology's meaning closure. Untangling is the workplace version: it settles who holds the levers. Matthew McDowell-Sweet captures the balance in his notes on protocol thinking:

Where untangling might happen this time

For the phone network, untangling meant moving control signals off the voice line. After Signalling System 7, Bruce Schneier writes, "it didn't matter how much you whistled into your phone; nothing on the other end was paying attention." Then the catch: "unlike the phone system, we can't separate an LLM's data from its commands."

The instructions can't leave the band, but the authority can. A prompt can ask for anything; it can't mint a token. So the center this time looks like a layer of keys, permissions and identities, not an administrator:

• MCP's authorization spec binds tokens to one server: "MCP servers MUST NOT accept or transit any other tokens." It also leaves authorization optional, and local setups like Viticci's "retrieve credentials from the environment."
• Google's AP2 turns purchase approvals into "cryptographically-signed digital contracts that serve as verifiable proof of a user's instructions."
• The OpenID Foundation notes that current approaches "work well only because today's agents remain relatively simple, operating within single trust domains." Entanglement is what happens outside them.

The analogy has a limit. AT&T controlled the whole phone network; here nobody does, so any out-of-band channel has to be agreed across firms. Replying to Primitives over pixels, Venkatesh Rao named the open question:

Untangling also differs by who does it. An entangled workplace is a kind of thicket, and Aneesh Sathe describes how real thickets are kept through coppicing: trimming growth back while the roots stay, so it regrows stronger. IBM's guidelines worked like that, written and revised by the bloggers themselves. The off-channel fines came from outside: an existing recordkeeping rule, enforced after the fact.

What to watch

• How control comes back without unplugging the assistants: how a firm takes back keys and permissions granted in screens nobody reviewed, while people keep the setups that make them faster.
• How authority travels across firm lines: how an agent shows whose instructions it carries, and what happens to an assistant's memory when its owner resigns. The one cross-firm precedent was untangled by regulators.
• How tinkering moves on: once keys and permissions settle, where people find the next place to experiment, the way phreaks moved from phone lines to computer networks.

Pham's counterpart "figured it was someone you worked with." Increasingly, it is, and so is the knot.