--- title: Don't be your team's meat proxy description: At OpenAI DevDay, OpenClaw's Peter Steinberger turned "meat proxy" from an insult into a team problem. When the agents run on your machines, teammates can only reach them through you. His fix is a shared server where anyone can read and prompt anyone's agent session. date: 2026-10-08 tags: AI agents, OpenClaw, Codex, multiplayer, code review --- When your agents run on your machines, your team can only reach them through you. Peter Steinberger, who created OpenClaw and now works on agents at OpenAI, calls that being a meat proxy. At OpenAI DevDay he showed his fix: move the agent sessions onto a shared team server, where anyone can read, prompt or pick up anyone's session. The last two talks I wrote up were about the agents themselves: Dex Horthy's [software factory](/notes/software-factory-2022-to-lights-off.html) and MintMCP's [AI coworkers in Slack](/notes/ai-coworkers-slack-agent-identity.html). Peter's is about the people around them. Everyone on his team had agents. They still weren't working together. ## More machines didn't fix it He opened with how his own setup grew this year. First the terminal: split screens, lots of Codex sessions, a finger on the escape key to steer. The models got better and he steered less, so he moved to the Codex desktop app, where running many sessions at once is easier. Then his laptop ran out of disk and his fans "sounded like a jet engine", so he spread the work over six to ten machines: devboxes, plus cloud boxes that run the tests.

  1. 1Terminal

    Split screens, lots of Codex sessions, a finger on Esc to steer

  2. 2Codex app

    Many sessions at once, easier to run

  3. 36 to 10 machines

    Devboxes, plus cloud boxes that run the tests

Every timeMore compute below. The same one person between his teammates and the agents.

His year, as he tells it at the start of the talk. Top of each setup: his teammates, then him. Bottom: the machines.
None of that fixed the real bottleneck: > When my teammates wanted to get involved, they still had to come through me. You know, we were all working with agents, but we weren't really working together.
Where the agent sessions live Through you: six teammates all reach the agent sessions through one person, who runs them on their own machines and relays every ask and every answer. Team server: the sessions live on a shared server, and every teammate, you included, reads and prompts any session directly. YOUR MACHINES every askgoes through you every answercomes back too You TEAM SERVER you
Through you: the agents run on your machines, so every teammate's ask goes through you and every answer comes back the same way. That's the meat proxy. Team server: the sessions live in a shared place. Anyone on the team reads any session, prompts it or picks it up where someone stopped, and you're one more seat in the row. The first tab is redrawn from Peter Steinberger's slide in ClawLabs: Building Open Source Together, OpenAI DevDay 2026; the second is the team server he described. Switch the tabs.
## Meat proxy, take two The term is Niklas Gruhn's. His August post, [Don't be a meat proxy](https://gruhn.me/blog/2026-08-03/), is about someone who pastes AI output to coworkers without reading it, so the coworker might as well have asked the AI. It's an insult for a habit. Peter uses it for something bigger: being the interface to the AI, passing messages back and forth. You can read every word your agent writes and still be one, if the agents only exist on your laptop. That's what's new for me in this talk. It's not about discipline. It's about where the sessions live.

Niklas Gruhn · August

A habit

AI output passed on without reading it

The coworker might as well have asked the AI

Peter Steinberger · DevDay

A location

You read every word and you're still one

The agents only exist on your laptop

What's newIt's not about discipline. It's about where the sessions live.

Same two words, two problems. In both, the work passes through one person; in Peter's, reading it doesn't change that.
## Show me the prompt His first try wasn't a server. One sentence can now produce tens of thousands of lines of code, but the conversation behind it stays on someone's machine. He reviewed plenty of PRs where he understood what changed, but not why. So he added a skill that asked contributors to attach a sanitized transcript to their PR. Very few said yes, and he admits he sometimes said no too. Sharing how you talk to your agent feels surprisingly personal. When his team made every session visible, it felt awkward for a day. They read each other's conversations, laughed a little, and then it was normal. Now they learn from each other's prompting and catch mistakes earlier.

  1. 1The diff alone

    What changed, not why

  2. 2Opt-in transcript

    A sanitized transcript on the PR. Very few said yes; he sometimes said no too

  3. 3Every session visible

    Awkward for a day, then normal. Now they learn from each other's prompting

Show me the prompt: the same PR, with less or more of the conversation behind it.
The demo made the case better than the slides. He wakes up to a PR where Victor, a teammate, made the tables smaller, the day after Peter made them bigger. The old reflex would have been what he called a "not very Californian message". Instead he opens the work session behind the PR. Victor had reused Peter's own session, pinged him first, and fixed what Peter got wrong. Crisis over before lunch.

  1. 1The day before

    Peter makes the tables bigger.

  2. 2Next morning

    He wakes up to a PR. Victor made the tables smaller.

  3. 3The old reflex

    The old reflex: a “not very Californian message”.

  4. 4Instead

    Instead, he opens the work session behind the PR.

  5. 5In the session

    Victor had reused Peter's own session, and pinged him first.

  6. 6Before lunch

    He'd fixed what Peter got wrong. Crisis over before lunch.

The demo at 11:46, as six panels. “I was wrong” is Peter, on stage.
His conclusion is blunt: pull requests as the way to collaborate "just feels not the future anymore". On the team server, anyone sees and prompts anyone's session, so the one rule is to invite only people you're fine with messing with your sessions. Next, he wants to invite OpenClaw's top contributors: they get the tokens, and the project gets a bit of their ideas. "I think it's an amazing deal." ## The server is a place, not an app The sidebar of that server is full of small apps: CI times, community numbers (PRs opened, issues, merges), a "daily Claw" newspaper written from whatever merged, a slop meter that keeps pushing the agents to clean up, activity reports, and meetings. They used to pay for meeting software until he decided "this is a prompt". Now the agent joins their Discord calls, writes the summary, and can answer back by voice. He describes a dashboard as a session that generates an artifact, plus an automation that keeps it updated. Want it blue? Tell the agent. It changes so fast he'd rather call it jellyware than software. And because each dashboard is a session on the shared server, anyone on the team can change it, not only whoever built it.

Apps

CI times

Community

The project's numbers: PRs opened, issues, merges.

The Daily Claw

Written from whatever merged

Slop meter

Keeps pushing the agents to clean up.

Reports

Activity: who commits, who's on Discord.

Meetings in a call

The agent joins the Discord call, writes the summary, and can answer back by voice.

Session

makes

Artifact

kept fresh by

Automation

= a dashboard. He'd call it jellyware.

A schematic of the sidebar he toured, not a screenshot. Pick an app. On CI times, tell the agent to make it blue.
He also thinks CI as we run it no longer makes sense, and is trying Codex to pick which tests a change actually needs. He saved that one for another talk. ## Loops, goals and taste Then the factory part. He runs two kinds of long-lived work:

Loop

Ends
Never, it keeps checking
His example
Bug triage from Discord, X and GitHub, plus a performance check on every daily release

Goal

Ends
At a defined end state
His example
Move the codebase from synchronous SQLite to async database access: 18 days so far, over 100 PRs landed
A loop goes round for good. A goal runs toward a finish line; how far off it is, the talk didn't say.
The triage loop is the one I'd copy:

Listen

Monitor

  • Discord, X and GitHub
  • Small CLIs the agent can call
  • Reports sorted by category

Reproduce

Fix

  • A fresh test box per report
  • Fix only what it reproduces
  • Check the fix on the box

Second agent

Review

  • Another agent reviews the work
  • It lands on its own if it passes
The loop he runs on bug reports. The dashed line is the part that makes it a loop: it never stops listening.
Those loops used to run on his own machines. Sometimes they stopped, and sometimes he wasn't sure which machine was running which. Now he's moving them to the team server one by one, so others can maintain them and learn from them. Taste is the part he won't hand over: it's hard to describe and "often just a feeling". Where he wants to end up is an agent per project, with its own memory, automations, goals and loops, taking high-level direction from him. That's the [software factory](/notes/software-factory-2022-to-lights-off.html) again, with one change: the factory is a shared room, not one person's terminal. ## Agents get their own badge Kevin Lin, who leads OpenClaw Enterprise at OpenAI, took the second half and open-sourced it: a control plane that makes OpenClaw multi-tenant. The controls he walked through: - the deterministic code runs in a separate container, in their case a separate cluster, so an agent can't change its own runtime - sandboxing for network access, the files an agent can write and the repos it can push to - auto-review: another model checks the agent's actions and blocks the dangerous ones before they run - agents run as their own identities, with service accounts and their own connectors, because "agents aren't impersonating users"
An agent inside OpenClaw Enterprise's four controls The deterministic code runs in a separate cluster, behind a wall the agent can't cross. The agent sits in a sandbox whose border limits network, files and repos. Its actions go through auto-review, which lets safe ones run and blocks dangerous ones. The agent wears its own identity badge with a service account. 1SEPARATE CLUSTER the deterministic code runs here so the agent can't change its runtime 2SANDBOX network files repos 4AGENT ID own identityservice account,own connectors 3AUTO-REVIEW · another model checks safe: it runs dangerous: blocked Numbers follow the four controls in the list above.

400+Claws inside OpenAI, run with these controls

K8s“Kubernetes for agents”, as Kevin pitched it

1.0Internal pilots until then, later this year

OpenClaw Enterprise, Kevin Lin's half of the talk. The badge is control four, the one my AI coworkers note was about.
That last one is the point of my [AI coworkers note](/notes/ai-coworkers-slack-agent-identity.html), now in an open-source platform. OpenAI runs over 400 Claws internally with these controls. He said that if you filed a Codex issue in the last month, there's a good chance an OpenClaw agent triaged it, reproduced it and, in many cases, merged the fix. He pitched it as Kubernetes for agents. [The announcement](https://openclaw.ai/blog/openclaw-enterprise) says it's for internal pilots until 1.0, later this year. ## Where my own fleet sits Yesterday I wrote that next I wanted Nova, my generalist agent, to open a channel for a coding job and bring in Spark, my coder. That works now. Nova opens a job channel in Slack, invites Spark and me, and posts the brief. Spark builds, Nova makes the calls, and I only get tagged for things like secrets, spending or anything destructive. Since this morning the same flow runs in Discord forum threads. So the agents talk in the open. By Peter's standard I'm still half a proxy, though: the channel shows what Nova and Spark tell each other, not the sessions behind those messages, and nobody but me can open those. For a team of one that's fine. The day someone works on these projects with me, his server is the first thing I'll try.

In the open the job channel, Slack or Discord

  1. Novaopens the job, invites Spark and me, posts the brief
  2. Sparkbuilds
  3. Novamakes the calls
  4. metagged only for secrets, spending or anything destructive

Behind the messages the sessions

meat proxy

team server

me, today: half a proxy

My setup on Peter's scale. The agents talk in the open; the sessions behind them still go through me.
The [talk](https://www.youtube.com/watch?v=wZYnJfL4c2Y) is 35 minutes. The meat proxy slide is at [2:27](https://www.youtube.com/watch?v=wZYnJfL4c2Y&t=147s), and the Victor story at [11:46](https://www.youtube.com/watch?v=wZYnJfL4c2Y&t=706s) is the part I'd show a team lead. If your team already shares agent sessions, I'd love to hear how the awkward first day went.