Home
May 9, 2026
View All

Claude Code in the Wild, Vercel's Chat SDK Expands, and OpenAI on Safe Codex

The Short Version#

Simon Willison's hands-on Claude Code experiments are yielding concrete patterns for PMs who build with AI tools — particularly around HTML as a surprisingly durable output format. Vercel's Chat SDK is quietly expanding its surface area (Messenger adapter, web adapter, conversation history all in one day), and OpenAI published its internal Codex safety model — which is less about security theater and more about what responsible agentic deployment actually looks like in practice.

Simon Willison — The Unreasonable Effectiveness of HTML with Claude Code#

Source: https://simonwillison.net/2026/May/8/unreasonable-effectiveness-of-html/#atom-everything Credibility: High (first-person practitioner account from a recognized developer and tools expert)

What happened: Simon Willison published a detailed account of using Claude Code to generate self-contained HTML files as a primary output format for small tools and experiments. His thesis: HTML is a surprisingly underrated target format for AI-generated code because it's portable, inspectable, shareable without infrastructure, and requires zero deployment friction. He found Claude Code particularly good at generating complete, working single-file HTML apps — interactive data explorers, quick converters, visualization tools — that he can iterate on in seconds.

Key patterns:

  • Single-file HTML apps generated by Claude Code can be opened directly in a browser with no build step, no dependencies, no server — making the feedback loop nearly instant
  • Willison uses this workflow for one-off tools he'd otherwise never build because the activation energy is too high (e.g., a quick data formatter, a CSV visualizer)
  • The format is especially useful for sharing: send anyone a file, it just works, no accounts or logins required
  • He treats Claude Code's HTML output as a "good enough first draft" that's fast to inspect and modify — he can see exactly what was generated without the abstraction of a framework
  • The pattern inverts the usual AI code generation frustration: instead of debugging a broken environment setup, you're looking at raw output in a browser

Why it matters for PMs: This is a practical pattern for PMs who want to build quick research tools, internal dashboards, or prototypes without spinning up engineering resources. The "vibe coding to HTML" workflow is low-risk (no prod deployments), fast (open in browser), and shareable (send a file). If you're doing user research or building stakeholder artifacts, this is a legitimate shortcut. It also surfaces a broader point: the value of AI coding tools often shows up first in the "tools I'd never have built otherwise" category — not replacing existing workflows but enabling new ones.

Critical questions:

  • How far does this pattern scale? HTML works for solo tools, but breaks down quickly for anything that needs a backend, auth, or shared state
  • What does the maintenance story look like? A file you generated in 30 seconds is also a file you're unlikely to document or maintain
  • Is "good enough first draft" actually good enough for the use cases PMs would reach for? Or does it create a false sense of confidence about untested edge cases?
  • Does this pattern change how PMs should think about prototyping fidelity — are we now in a world where "working prototype" is faster than "wireframe"?

Action you could take today: Pick one recurring manual task you do (reformatting data, building a quick comparison table, visualizing a metric) and use Claude Code to generate a self-contained HTML file for it. Time how long it takes from prompt to working tool. If it's under 10 minutes, that's now a data point about your own build-with-AI velocity.

Vercel — Chat SDK Adds Messenger Adapter, Web Adapter, and Conversation History#

Source: https://vercel.com/changelog/chat-sdk-adds-messenger-adapter | https://vercel.com/changelog/chat-sdk-adds-web-adapter-support | https://vercel.com/changelog/chat-sdk-conversation-history Credibility: High (first-party changelog, three shipped features in one day)

What happened: Vercel shipped three Chat SDK updates on May 8 in quick succession. First, Messenger adapter support — agents built on the Chat SDK can now integrate with Facebook Messenger, supporting messages, reactions, multimedia downloads, postback buttons, and direct conversations with automatic display name fetching. Second, a web adapter that extends the same capabilities to web-based chat contexts. Third, persistent conversation history — the SDK now maintains conversation context across sessions.

Key capabilities:

  • Messenger adapter: Build agents that operate natively inside Messenger — not just via webhook passthrough, but with full support for Messenger-native features (reactions, multimedia, postback buttons)
  • Web adapter: Same structured adapter pattern for web-based chat interfaces, enabling consistent agent behavior across channels
  • Conversation history: Sessions now persist context, which is table stakes for any non-trivial agent interaction — without this, every conversation starts from scratch
  • The adapter pattern is notable: Vercel is standardizing how agents connect to communication channels, similar to how their AI SDK standardized model provider connections

Why it matters for PMs: Vercel is methodically building out the infrastructure layer for multi-channel AI agents — and the adapter pattern is the key insight here. Rather than building custom integrations for each channel, you write agent logic once and swap adapters. This dramatically reduces the cost of deploying an agent to a new surface. Conversation history is the more immediately impactful feature: without persistent context, AI assistants can't handle anything requiring memory of prior interactions, which limits real utility. These three features together move the Chat SDK meaningfully closer to production-grade agent infrastructure.

Critical questions:

  • How does the conversation history implementation handle privacy and data retention? Especially relevant for any regulated or sensitive context
  • What's the model for Messenger compliance? Meta has strict policies for bots operating in Messenger — does the adapter handle policy constraints or leave that to developers?
  • The adapter pattern is clean architecturally, but how does it handle platform-specific behaviors that don't generalize? (e.g., Messenger read receipts, typing indicators)
  • Is Vercel positioning the Chat SDK as a competitor to dedicated agent orchestration frameworks like LangChain/LangGraph, or is this complementary?

Action you could take today: If your team is building or evaluating any customer-facing AI agent, check whether conversation history was on your requirements list — and if so, whether you were planning to build it or buy it. The Chat SDK now handles this out of the box. That's a build-vs-buy decision worth revisiting.

OpenAI — Running Codex Safely at OpenAI#

Source: https://openai.com/index/running-codex-safely Credibility: High (first-party post, describes internal production deployment practices)

What happened: OpenAI published a detailed account of how they run Codex internally — specifically the safety and operational controls they've built around using an AI coding agent at scale within their own organization. The post covers sandboxing (Codex runs in isolated environments without network access by default), human approval workflows for higher-risk actions, network policies that restrict what the agent can reach, and agent-native telemetry that logs agent reasoning and actions for audit and compliance.

Key technical details:

  • Sandboxing: Codex operates in isolated containers with no outbound network access by default — it can read and write files but can't call external APIs or exfiltrate data without explicit configuration
  • Approval gates: Certain action types (e.g., pushing to production branches, external calls) require explicit human approval before execution — this is a structured human-in-the-loop model, not just "you can always cancel"
  • Network policies: Admins can define allowlists for what Codex can reach — useful for enterprise contexts where you want agent access to internal APIs but not the broader internet
  • Agent-native telemetry: Every agent action is logged with enough context to reconstruct the reasoning chain — this is specifically designed for compliance and incident review, not just debugging
  • OpenAI describes this as their internal playbook, with the implication it informs how they advise enterprise customers on Codex deployment

Why it matters for PMs: This is one of the clearest published frameworks for what "responsible agentic deployment" actually looks like in practice — not as a policy document but as a shipped system. The four-part model (sandboxing, approvals, network policy, telemetry) is directly applicable to any team evaluating AI coding agents for their own engineering org. It also signals where the industry is heading on agent governance: audit trails, explicit approval workflows, and environment isolation are becoming table stakes, not optional add-ons. If you're building agent features into a product, this is the expectation your enterprise customers will bring.

Critical questions:

  • The approval gate model works for internal use, but how does it translate to autonomous agents running on behalf of end users? Who approves what, and how do you prevent approval fatigue?
  • Telemetry that logs "agent reasoning" raises its own data handling questions — what's the retention policy, and who has access?
  • How does this safety model affect Codex's utility? If every high-risk action requires human approval, does that break the autonomous coding agent value proposition?
  • OpenAI is describing how they run this internally — how does the same model translate for a 500-person company without a dedicated security team?

Action you could take today: If your team is evaluating any AI coding agent for internal use, map these four controls (sandboxing, approvals, network policy, telemetry) against your current security requirements. Which of the four do your current vendor options actually provide? That gap analysis is worth having before you're in a procurement conversation.

Quick Hits#

  • Simon Willison: Quoted Luke Curley's observation about AI tooling — short but worth noting as a signal of ongoing discourse about what "good" AI tools actually look like in practice (May 9): https://simonwillison.net/2026/May/9/luke-curley/#atom-everything
  • Cursor: PR Review, parallel agent execution, and Split PRs shipped in v3.3 (May 7) — covered at URL already in the prior list, but the parallel agents detail (running multiple agents simultaneously on a build plan) is notable for teams thinking about agentic development velocity: https://cursor.com/changelog/05-07-26
  • Dario Amodei at Anthropic Financial Services Briefing: Presented alongside JPMorgan Chase CEO Jamie Dimon, framing AI's labor impact through Jevons Paradox (efficiency gains expand total demand) and Amdahl's Law (remaining human bottlenecks become binding constraints). Interesting dual-framework for PMs thinking about AI's effect on white-collar workflows (May 5): https://www.anthropic.com/news
  • Vercel Chat SDK: Conversation history now supported alongside Messenger and web adapters — if you're evaluating agent infrastructure, the full changelog is worth reading: https://vercel.com/changelog/chat-sdk-conversation-history
  • Ben Tossell: "Wife just asked if I've heard of Claude" — anecdotal but meaningful as a consumer diffusion signal. Claude is crossing into mainstream awareness beyond the tech-forward early adopter base (May 6): https://x.com/bentossell/status/2052120724148498576

The Thread#

Agentic infrastructure is maturing from "can we do this" to "how do we do this safely." OpenAI's Codex safety post, Vercel's Chat SDK persistence and multi-channel adapters, and Cursor's parallel agent execution all shipped within the same 72-hour window — each one addressing a different layer of the same problem: making agent-powered workflows reliable and production-ready enough that teams can actually trust them. The conversation is shifting from capability demos to operational controls.

Sit With This#

OpenAI described running Codex internally with four specific controls: sandboxing, approval gates, network policies, and agent-native telemetry. They're calling this their production playbook for safe coding agent deployment.

For your team: If you were deploying an AI coding agent to your engineering org starting Monday, which of these four controls would you consider non-negotiable — and which would you defer until you saw a real incident? What does that prioritization tell you about your actual risk tolerance versus your stated one?