Y Combinator Open-Sourced Its Internal AI Agent Harness

The Company That Automated Itself Just Gave the Playbook Away

Y Combinator has open-sourced QM, the multi-agent "harness" it built to run its own back office — accounting, legal, events, and engineering — and it's now free for anyone to fork, self-host, and point at their own business. For AI agencies and automation teams who've been stitching together Claude Code, Codex, and a dozen brittle scripts to get agents to actually do company work, this is worth a close look.

What QM Actually Is

QM isn't another chatbot wrapper or a single-agent coding tool. It's infrastructure for running many agents across an entire organization at once. Each person and each "room" (a channel, project, or workspace) gets its own scoped memory, files, credentials, permissions, scheduled jobs, and a durable sandbox. Employees can work solo in an isolated workspace or bring the agent into a shared Slack channel, group message, or project — so the same system handles both "do this task for me" and "let's all work on this together."

Y Combinator says it already runs QM across its accounting, legal, events, and engineering functions — including using QM to help build QM. The project is MIT-licensed and available now on GitHub at yc-software/qm.

Why This Matters for Agencies and Automation Builders

Most agent frameworks optimize for a single developer wiring up a single task. QM is explicitly built for the shape of problem agencies actually deal with: many people, many recurring workflows, shared context, and the need for guardrails that don't require a developer to babysit every run.

Three details stand out for anyone building automation for clients:

It's harness-agnostic. QM doesn't lock you into one model or one coding agent. Pi, OpenCode, Codex, and Claude Code all drive the same underlying core, so a deployment isn't tied to a single vendor — a real concern for agencies that need to swap models as pricing and capability shift. It ships with a real security model, not a toggle. Organizations pick one of three postures, and narrower scopes can only tighten them, never loosen them: Strict pauses every tool call for human approval (except the two no-effect turn-enders), Auto — the default — runs a classifier over external data and tool results before they reach the model, and Dangerous removes screening and pauses entirely for trusted, sandboxed use. That's the kind of policy layer agencies usually have to build themselves before they can put an agent in front of a client's real systems. It's cloud-first with native Slack and web UI. Rather than living only in a terminal, QM is designed to be where the team already is — which matters when the "user" of an automation isn't a single engineer but an ops, legal, or events person who will never touch a CLI.

How It Works in Practice

The core idea is a room-based memory model: every room — whether it's a person's private workspace or a shared project channel — keeps its own scoped files, keychain view, permissions, and cron jobs. That means an agent working on a client's bookkeeping doesn't accidentally see credentials or context from an unrelated engineering project, and scheduled/recurring work (crons) can live inside the same room it operates on instead of a separate scheduler bolted on afterward.

Because the harness sits above the model layer, teams already using Claude Code or Codex for coding tasks don't have to abandon those tools — QM is designed to orchestrate them rather than replace them, adding the multi-person, multi-room structure those tools don't provide on their own.

Who Should Actually Try This

If your team is currently running one-off agent scripts per client, or has built ad hoc Slack bots to trigger Claude Code jobs, QM is worth evaluating as the coordination layer underneath that work rather than something to build from scratch again. It's most interesting for agencies managing multiple concurrent automations across departments (ops, legal, finance) where permission boundaries and shared memory actually matter — less interesting if you're a solo builder shipping single-purpose scripts, where the overhead of standing up rooms and permission postures may not be worth it yet.

It's also a useful reference implementation even if you don't adopt it wholesale: the three-tier security posture (Strict/Auto/Dangerous) is a clean pattern worth borrowing for any client-facing agent deployment, regardless of which harness ultimately runs it.

Key Takeaways

• Y Combinator open-sourced QM, an MIT-licensed multi-agent harness it uses to run its own accounting, legal, events, and engineering work.
• QM supports multiple underlying agents and models (Pi, OpenCode, Codex, Claude Code) rather than locking teams into one vendor.
• Its three-tier security model — Strict, Auto, Dangerous — gives a concrete template for how much autonomy to grant an agent touching real business systems.
• Room-based scoped memory and permissions make it built for teams and multiple concurrent workflows, not just a single developer's coding sessions.
• For agencies already duct-taping together agent scripts across clients, QM is worth evaluating as shared infrastructure rather than reinventing the coordination layer.