Y Combinator funds a small industry of startups selling "AI employees" and agent harnesses to other companies. This week it open-sourced the one it built to run itself — MIT-licensed, and yours to self-host rather than subscribe to.
What QM actually is
QM is what its README calls a "multiplayer agent harness for work — in Slack and on the web." The design problem it's solving is specific: most agent products are built as a personal assistant for one person, and that shape breaks the moment an organization tries to adopt one, because nothing stops one employee's context, credentials, or mistakes from leaking into another's. QM's answer is to give every person and every room — a Slack channel, a group message, a project — its own scoped memory, files, keychain, permissions, cron jobs, web apps, and a durable sandbox. You can work with the agent alone or invite it into a shared channel, and either way its access is bounded to what that specific scope was granted.
The security model is explicit about what that access means: an agent "acts as the person it's working for, with their credentials and permissions, and everything it does is audited." Three configurable postures sit on top of that — Strict (every tool call needs human approval), Auto (a classifier screens external data before it reaches the model, the default), and Dangerous (no screening, no pauses) — but the README is careful to note that a predeclared command policy, hard denials for things like recursive deletes or destructive SQL, "applies in every posture, Dangerous included." The permission ceiling is fixed; only the friction underneath it changes.
The part that matters for the harness-lock-in argument
QM's most pointed design decision is that it doesn't pick a winner: "Pick your own harness and model and switch between them — Pi, OpenCode, Codex, and Claude Code all drive the same core, so a deployment isn't tied to any single vendor." Architecturally, the harness, session store, sandbox, and memory each sit behind their own interface, so a production swap is "one wiring file," not a rewrite.
That's worth pausing on against what this blog argued a few days ago: that of the three places AI vendor lock-in actually lives — the API, the coding harness, the consumer app — the harness layer is the one specifically engineered toward zero switching cost, because tools like Cursor made model choice a dropdown rather than an identity. QM is that same logic pushed one level up the stack, from "which model answers my prompt" to "which vendor runs my company's agents" — and it's coming from the entity with the most exposure to the agent-harness market as an investor. If QM's own backers didn't think portability at the harness layer was durable, giving it away as neutral, self-hosted infrastructure is an odd way to protect a portfolio full of companies that charge for exactly that.
Where it came from: a year of running the company on it first
QM isn't a green-field bet — it's the generalized, open-sourced shape of infrastructure YC General Partner Pete Koomen (previously the co-founder of Optimizely) says he's spent more than a year building to run YC itself on agents. In a recent conversation on the Y Combinator Startup Podcast, Koomen described the internal version growing from an initial handful of tools to over 350, all sharing one database, with a nightly self-improvement loop that reads every employee-agent conversation from the day and autonomously rewrites the organization's own skills.
The anecdote Koomen uses to make that concrete: a skill written to draft two-sentence startup descriptions — the kind a YC partner writes by hand dozens of times a batch — started as a human-authored prompt, then kept improving by training on transcripts of real partner office hours where partners corrected its output. Koomen's claim is that it now writes those descriptions better than he does. Whether or not that specific skill is representative of everything else in the 350-tool registry, it's the load-bearing example for YC's own thesis: that any organization can build a "shared organizational brain" simply by recording its work artifacts and letting agents read and act on all of them, continuously — and QM is the scaffolding YC is now handing to anyone who wants to try the same thing without spending a year building it first.
One detail that fits the moment more than it announces itself: several of the repository's commits over its final days of prep — July 29 through 31 — list "claude" as a co-author alongside YC's own engineers. The tool for running an organization's AI agents was itself partly built by one.
What to expect next
- QM becomes the reference architecture other "AI employee" startups get compared against, not because it's the most polished, but because it's free, self-hostable, and comes from the most agent-native organization currently publishing its own numbers.
- The 350-tools-and-growing internal registry is the more important story than QM itself. A harness is infrastructure; a self-improving, nightly-updated skill library trained on a company's own conversations is the actual product idea being tested here, and it's the harder thing to open-source or copy.
- Expect scrutiny of the audit trail, not the access model. Giving an agent an employee's own credentials is a reasonable design once every action is logged — the real test is whether "everything it does is audited" holds up under an incident, not under a README.
References: yc-software/qm — GitHub repository · QM README · Pete Koomen (@koomen) — announcing a year of building YC's agent infrastructure · Y Combinator (@ycombinator) — 350 tools, self-improving skill loops · Y Combinator Startup Library — "Inside YC's AI Playbook" · BigGo Finance — "YC's Pete Koomen: Our Two-Sentence AI Skill Now Outperforms Me"