Inside QM: How Y Combinator's Internal Agent Fleet Became an Open-Source Harness

Y Combinator (YC) open-sourced the agent harness running YC. Agent frameworks are almost always built for one person. You can stretch a personal assistant to cover a whole company, but the wiring gets complicated fast. Y Combinator hit that wall directly. They started with a small agent loop in Ruby that could reach internal data, added crons and webhook triggers, then provisioned over 50 Hermes agents as personal assistants. Managing a fleet that size became its own job. QM is what they built instead, open-sourced it under MIT. The name is short for quartermaster, the person on a ship who keeps things in order belowdecks. It runs inside YC across accounting, legal, events, and engineering, including the work of building QM itself. The idea that makes it different is the scope. → A scope is the unit of isolation, and it applies the same way to a person and to a Slack channel. Each one gets its own memory, files, credential view, permissions, scheduled jobs, and sandbox. → That sandbox is durable, so tools installed during one session are still there in the next. Many execution environments get thrown away after every run, which means the agent starts from zero every time. → The core is deliberately small. It handles identity, policy, the scheduler, and the agent loop, with Postgres holding sessions, memory, and the queue. The web UI, admin panel, and Slack integration are all plugins over its HTTP API. → The harness layer is swappable. Claude Code, Codex, OpenCode, and Pi all drive the same core, so a deployment is not locked to one vendor. → Security comes in three levels. Strict pauses every tool call for human approval, Dangerous pauses nothing, and the default Auto runs a classifier over provenance-labelled external data and tool results before they reach the model. Hard denials for things like recursive deletes apply at every level. That last one is worth sitting with. Screening tool results by where they came from is a concrete answer to prompt injection, and very few open agent systems ship a named default for it.

Y Combinator open-sourced the agent harness that runs YC — with some caveats worth knowing.

Most agent frameworks are built for a single person. Stretching a personal assistant to cover an entire company works for a while, but the coordination problem grows fast — and YC ran into it directly.

They started with a small Ruby-based agent loop that could reach internal data, added crons and webhook triggers, then provisioned more than 50 Hermes agents as individual employee assistants. Managing a fleet at that scale became a job in itself.

QM — short for quartermaster, the person who keeps things in order belowdecks on a ship — is what they built instead, and it's now open source (primarily under MIT license). It currently runs inside YC across accounting, legal, events, and engineering, including the work of building QM itself.

The core idea is the scope: the unit of isolation, applied identically to a person or a Slack channel. Each scope gets its own memory, files, credential view, permissions, scheduled jobs, and a durable sandbox — meaning tools installed in one session persist into the next, unlike many agent environments that reset with every run.

The core itself stays deliberately small — identity, policy, the scheduler, and the agent loop, backed by Postgres for sessions, memory, and the job queue. The web UI, admin panel, and Slack integration sit as plugins on top of its API, and the underlying harness (Claude Code, Codex, OpenCode, or Pi) is swappable rather than locked to one vendor.

Security runs on three postures: Strict pauses every tool call for human approval, Auto (the default) runs a classifier over provenance-labelled external data and tool results before they reach the model, and Dangerous disables screening and pauses entirely. Hard denials — for things like recursive deletes — apply at every level regardless of posture.

That Auto-mode screening is a genuinely uncommon, concrete design response to prompt injection. That said, it's worth knowing QM's own security documentation is candid that this isn't bulletproof yet: the command policy can reportedly be bypassed via obfuscation, some browser-driven actions sit outside the core's approval gates, and the project describes itself as early, experimental software rather than a hardened, production-ready system