What 21 five-minute demos looked like at WorkOS Demo Night

On August 5 we ran our second Demo Night at the WorkOS office in San Francisco. Twenty-one people signed up for five minutes each, and all twenty-one presented. The first demo was an AI coding agent running on Mac OS 9, and it edited its own source live.

The rules are the format

Three rules, printed on the event page: live demos only, no slides, no company pitches. Anything counts as material: a side project, an internal tool, an open source repo, a startup. Michael Grinich, Founder & CEO of WorkOS, opened by saying presenters were "not supposed to come shill your company," and that the point was to see new things people had actually built. Five minutes is too short for Q&A, so questions got held until the pizza.

The whole thing was livestreamed on X, YouTube and LinkedIn and it was recorded, so you can watch the whole night.

Carbon Code runs an agent harness on Mac OS 9

Jason Barry, an engineer at WorkOS, opened with a side project called Carbon Code: the first agent harness he's aware of that runs on Mac OS 9, emulated on his laptop. It has the tools you'd expect: read file, write file, edit file, grep, list directory. He'd dropped Carbon Code's own source into its workspace so it could edit itself.

He named three hard parts.

• There is no terminal. Mac OS 9 shipped in 1999, before Mac OS moved to Unix, so there's no cd, no ls, no pwd, and path delimiters are colons instead of slashes.
• There is no usable TLS. Mac OS 9 tops out at TLS 1.0 and modern endpoints require at least 1.2, so he vendored BearSSL and MacTLS into the app and handled transport at the application layer.
• There is no UTF-8. No emoji, no line endings, and a switch statement remaps everything back into ASCII, which produced the best line of the night:

This is probably the first agentic experience to not have em dashes, guaranteed, because the character set literally does not support it.

The live portion: he prompted Carbon Code to add an effort selector to itself. It looped through tool calls, edited files, and ran a Compile tool after each edit that does static analysis in place of a real build. Then he rebuilt the app on stage. The build itself runs outside the emulator, which is the only reason it finished inside his slot. The new effort menu was there, and he set it to max. What he hasn't cracked is building natively under CodeWarrior, the Xcode of OS 9, and he's open sourcing the project partly to find someone who can.

The reason this works at all: I don't know how to write C. I don't know the crazy developer experience of Mac OS 9, but because I know how to prompt agents and I can provide context, then I'm empowered to be able to have this total nostalgic experience sort of developing for a computer that I grew up with.

He pointed the room at 68kmla.org, where people are backporting apps to OS 9 fast enough that Hacker News gets a new one every week or two.

The agent doesn't live on your laptop anymore

Three separate demos landed on the same argument: the agent process is in the wrong place.

Ishaan demoed Omnara, a control plane for agents. His framing: Right now, the status quo is that agents run on your computer. So they run locally like Claude Code or Codex. But when you want that agent to serve real users, you actually need to build a service so that people can access it.

So he made the loop itself the hosted thing. He talked to the same agent from a terminal UI and from his phone, then closed his laptop and messaged it again. The agent replied that his MacBook had gone offline, spun up a cloud sandbox, ran the command there instead, and asked whether it should clone the repo to keep going. Omnara's API was open sourced that day; the repo describes it as an open source platform for running managed agents that handles execution and state while you pick the models, tools, and machines, with durable state committed to Postgres, RBAC, and Apache 2.0 self-hosting.

Cole Murray demoed Open-Inspect, an open source background agent coding system, positioned as a foundation for the internal systems companies keep rebuilding: Ramp's Inspect, our own Horizon, Stripe's Minions. Same shape: a control plane orchestrating agents, sandboxes underneath, with Modal, Daytona, E2B and Vercel as providers. He wired a Sentry alert to automatically spin up a session, root cause the error, and open a PR, which didn't fire on the first try because his ad blocker was swallowing the Sentry call. It also takes work from Linear assignments and Slack mentions, and sessions are multiplayer, so a teammate can join a run in progress. Jessica, a forward deployed engineer at Expander, made the same point from the collaboration side later in the night: a conversation with an agent is currently trapped in one person's chat box, which means nobody can review it, continue it, or hand it off. His argument for centralizing it was about non-engineers: hand a PM Claude Code and they end up asking what Docker is and breaking their machine, where a hosted sandbox just works.

Suhajit demoed Metaphor, which he calls an autonomous software factory, or a Waymo for software engineers. It creates a branch, spawns a coding session, and derives a checklist from the task, then verifies the agent's output against it. That last part is the one worth stealing. His live task generated seven checks. He ran two tasks in parallel in separate worktrees on production code, and Metaphor caught that Claude Code had introduced a shortcut conflict it never accounted for, and prompted it to go fix that before raising the PR.

Two more demos came at the same idea from the other end. If the agent isn't on your laptop, the laptop stops being the place you talk to it.

Austin, a co-founder of Cmux, showed a Ghostty-based terminal with vertical tabs, a browser and notifications, and then showed the part that isn't on a screen at all: the Cmux iOS app runs libghostty on the phone. It discovers every machine authenticated to your account and connects automatically, over Tailscale or WireGuard or plain LAN, or over Iroh, which someone on Hacker News described to him as Tailscale at the application layer instead of the network layer. He turned Tailscale off, opened the app, and typed into a live session on a machine back at his desk.

Colin demoed stray, which drops the screen entirely. There's an iOS app and an Apple Watch app, and he drove Claude Code from a Bluetooth remote with his phone locked: click once to start recording, click again to stop, which means you don't have to fit your prompt into one breath. A fast small agent answers immediately so you know you were heard, then escalates to Claude, which takes longer. On stage he asked it, out loud, to DM Michael on X and close the Linear ticket for the demo. It did both, and read the confirmation back to the room.

Keys are the next thing to move off the machine

Lavan demoed Sesame by SSH-ing into a deployed agent and showing his Stripe key sitting in plaintext next to it, then moving that key into Sesame so the agent ran completely keyless while a broker injected credentials per request. The CLI's job is finding the keys already sitting on the same box as the agent.

Then he asked the agent for his Stripe balance. The first call to a new hostname prompted his broker for approval and he granted read-only access for one hour. Then he asked it to refund his last transaction and told it to go ahead. Sesame returned that POST was not allowed and logged the agent as blocked by policy. His point: an agent holding its own secrets has nothing standing between a bad prompt and an irreversible call. Model inference calls route through Sesame too, so the log covers what the agent is thinking as well as what it's touching. It's open source.

The striking thing is that Pavitra, who had never met Lavan, demoed the same primitive from a different angle later in the night. Super Self is a sandbox for long-running agents, and the demo was a Claude agent stripped down to read file, write file and run bash, all routed through the sandbox, with the network denying everything except Anthropic, GitHub and npm. He asked the agent to print its Anthropic API key. It did, and the key was fake: a standin token that a credential injector swaps for the real one at the network boundary, which is why the call still came back 200.

Then he planted a malicious instruction in the repo's README telling the agent to post its credentials to an external endpoint. The model declined, and he was explicit that this is not the win it looks like. You cannot build a security model on the agent choosing well. So he ran the curl himself from inside the sandbox, and the allowlist blocked it. Same conclusion as Sesame, reached independently: the boundary has to sit somewhere the agent cannot reason its way past.

Nobody trusts a public benchmark

Three demos were about evidence, from different ends of it.

Harita demoed Oqoqo, a platform for building custom benchmarks, on the premise that a new public benchmark lands every week and none of them measure your product. It's built on three pieces: tasks (an instruction plus an LLM-judged rubric), agents (the harnesses and models), and treatments, the part of your product under test, like your CLI, your SDK, or your MCP server. Tasks can mount repos and a custom Dockerfile so the agent has real dependencies, and nothing is stubbed: the Stripe tasks talked to Stripe.

She ran the matrix against Stripe live: roughly 100 runs across permutations, each in its own sandbox, which she noted would take about ten minutes and outlast her slot. The results she'd run that morning: agents given the Stripe SDK did well, a raw agent with no Stripe context did badly, the CLI was OK-ish, and the MCP server failed some of the basic tasks. Oqoqo's Frictions view traced the MCP failure to a missing tool: the agent called it, found the intent unsupported, looped, and gave up. On cost, the raw agent was by far the most expensive and the CLI by far the cheapest. She'd also tested whether Opus does better on OpenCode or Claude Code, and got OpenCode.

Fanal demoed Open Benchmarks from the other side of the transaction. His team had been building outbound tooling aimed at humans when they noticed the buyer was turning into an agent, and that the state of the art for marketing to agents is SEO relabeled as AI SEO: volumes of generated comparison posts, each concluding that its own author's product is best. So they benchmark vendors in a category and publish the results openly, on the theory that an agent will take grounded data over a sales pitch. In a clean incognito Claude session, "find me voice agent platforms with the lowest latency" walked straight past the vendor blog posts in its search results and cited the independent benchmark as its decision source. He says it repeats across categories and across models, and his explanation is that models trained hard on coding and task completion have learned to reach for something checkable.

Alex, CEO of Taco, a web and data search engine for agents, came at it as the vendor being measured: If you're selling an API, you're really an ingredient in someone else's application. You're not selling the pasta. You're the truffle oil or the spice that goes into the pasta.

Taco used to answer "why are you better" with charts and benchmark posts, and prospects told them it was homework, and that they didn't know how to benchmark anything anyway. So he built a side-by-side app: type any query, it runs through Taco and competitors, an agent answers from each set of results, and an LLM judge picks a winner with justification. Bulk mode takes 100 questions at once. The interesting part is the escape hatch. Since everyone's definition of "best" differs, the grading guidance is an editable text box, so a prospect can throw out his criteria, write their own, and re-judge against those.

Every surface is an agent surface, which is the problem

Suhas, an engineer at PubNub, described the constraint plainly. His product is visitor analytics, a Glean for the people who show up on your website rather than the people who work at your company, and when customers started asking for an agent on top of it, no two of them were on the same client. One on Claude, one on ChatGPT, one on Slack, one on Microsoft Teams. His answer was to push the foundational tool calls down into an MCP server as the lowest common denominator, then run an orchestration service above it with per-surface adapters, leaving room for Telegram and WhatsApp later. Because his customers are large enterprises that care a great deal about data not leaking, authentication and role-based access came first.

Nikhil demoed Iridium, which took the same multi-client approach to LinkedIn: an agent with live LinkedIn access that works from ChatGPT, Claude, or anything else agentic. It found three posts worth commenting on, drafted a comment, and scheduled it, and he was firm that it acts only on approval and is not built for autonomous posting. A second workflow, run in Claude, read a Notion doc of open roles, found five live candidates, and scheduled outreach while deciding on its own between a connection request and InMail.

Or you keep the whole thing local

Tom from Magnitude ran the counter-argument: local coding, which he defined as 100% on your own machine, no cloud, no API keys. The reason people don't do this is setup: models, quants, speculative decoding, and wiring an agent to all of it.

So Magnitude profiles the hardware first. On stage it detected his MacBook as an M4 Max with 16 cores, 64 GB of unified memory and Metal acceleration, then ran sample calculations to produce a measured throughput estimate rather than a spec-sheet guess: 55 to 69 tokens per second for its balanced recommendation. Side by side, it profiled a DGX Spark sitting in his office over Tailscale, reporting 120 GB of the box's 128 GB as available unified memory, plus CUDA, and recommended a 118-billion-parameter model with the honest note that it would be slow.

The result nobody expects is which machine won. The Spark has twice the memory and less bandwidth, so the MacBook generated tokens close to twice as fast. The Spark was the faster of the two at prefill, the bulk token processing you wait through before the first word appears. Underneath all of it, Magnitude runs its own inference engine, written in Rust on top of llama.cpp and started as a daemon so you never touch it.

Wenshu, an AI engineer at Campfire, took local further and dropped the GPU entirely. Turn Light is a sentence embedding model that runs on CPU, written in Rust and compiled to WebAssembly, with no dependencies and no network, small enough at 7 MB to ship to a browser. He indexed the entire Odyssey, about 130,000 words in 3,000-word chunks, at roughly 162 embedding calls per second, then ran passage search over it by cosine similarity. The second half of the demo was an emoji search box driven by natural language, which the room immediately used to test whether the model understood Gen Z slang. Results were mixed, which he took well.

The agent is rarely the thing you're fixing

Three demos were about everything around the agent: what it reads, what it can query, and what stops it.

Jacob's was the least agentic and possibly the most useful. He runs a Twitch charity stream on Firebot, which means very old JavaScript inside an Electron app running an Express server, and when he asks Claude to build something for it, he gets modern code that works locally and dies in production. Writing the constraints into his CLAUDE.md did not hold. Three prompts later the agent would apologize and do it again.

So he moved the rules somewhere deterministic and encoded them as lint rules with ast-grep. Anything pushed into the event queue must have a matching event log push. No barrel exports. var instead of let and const, because the VM is ancient. Old-school comment blocks documenting every parameter. The check exits non-zero, the agent notices it broke the build, and it fixes itself without being reminded. His PSA to the room: if the only thing your linter enforces is semicolons, you are underusing it badly.

Ged, the founder of Interf, went after the input side. His pitch is that a folder of unstructured files is a bad thing to hand an agent, and that the generic fix, a company brain that ingests everything the same way, is the wrong shape. Interf is a context compiler: it runs a processing workflow over your files and builds a knowledge graph aimed at the specific task you're doing. The output is just a folder, so it drops into Claude or ChatGPT or a local model with no integration. Because the build is committed as it goes, you can read the log and confirm every file was covered rather than trusting that nothing was quietly dropped. He built his from three hundred-odd meeting transcripts. Nothing leaves the machine.

Toby demoed Poly, which does something similar for live data. Every connected service becomes a table, whether it's an API, a database, a set of files or an MCP server, and you query across all of them in one SQL statement. His example was a billing dispute he'd been unable to assemble by hand: join his bank transactions against his Gmail thread with the vendor, and hand the agent the result. Above the tables sits a semantic layer for defining business concepts once across sources, so the agent asks for revenue rather than reconstructing it per system.

Except for the toilet paper

The last demo of the night was the only one that wasn't infrastructure. Four roommates who moved here from Singapore had a recurring problem, which they played for the room as a voice memo recorded half an hour earlier: we ran out of toilet paper, bro. So they built Sangria, an agent that searches for a physical product, compares options on price and tax and origin, learns that you prefer a particular brand, places the order, and has the thing arrive at your door. Then they put it in iMessage, because that's where people already are, and started getting orders from strangers.

The live demo was a genuine errand. He had spilled coffee on his girlfriend's suitcase, she was in the room, and he needed something that would get the residue off a hard shell without wrecking it. The agent asked what the case was made of before it answered, which is the part that made it feel less like a search box.

The thing nobody said out loud

Almost every demo was infrastructure for agents rather than an agent itself. A control plane, a credential broker, a benchmark harness, a lint rule, a folder of context. The agent has become the boring part. What people are building is the scaffolding that makes one safe to point at production, cheap enough to run 100 times, and reachable from a phone with the screen off.

Most of that scaffolding exists because the failure already happened to somebody. A refund that shouldn't have gone through. An MCP server that looped instead of failing loudly. A coding agent that shipped a change conflicting with code it never read. An instruction in a CLAUDE.md that got politely ignored. None of those are hypotheticals in this room, and none of them get caught by a better model.

Find more WorkOS events on Luma.