Claude Sonnet Was the Breakthrough That Unlocked Notion's Custom Agents
Simon Last · Notion’s Sarah Sachs & Simon Last on Custom Agents, Evals, and the Future of Work · Apr 15, 2026 · at 4:20
Simon Last, co-founder of Notion, discusses the specific frontier model releases that made robust autonomous background agents feasible for Notion.
0:00 / 0:08exact quote · 8.2s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“The big unlock was Probably like Sonic 3.6 or seven early last year. And that's when we started working on our agent, which we shipped last year.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Simon Last
Simon Last Argues That Coding Agents Are the Kernel of AGI
“I think one thing that's becoming more clear is I think like coding agents are the kernel VGI, sort of everything is a coding agent.”
Supervising AI Agents Is a Deeply Technical Systems Problem, Unlike Managing Humans
“There's a critical difference
To being a manager, which is that like, it is actually very deeply technical.
The problem of, you know, humans are very like fuzzy and you can't like treat a team of humans like a rigorous system where like, you know, PRs like fle…”
Simon Last: 99% of Agent Failures Are Tool Bugs, Not Model Flaws
“And actually, 99% of the time, it's a bug in one of the tools. Right. And so, just fix the bug.”
Notion Custom Agents Use Standard Pages and Databases as Their Memory
“Another example of this is we have no built-in memory concept. Memory is, is just pages and databases. And so if you want to give it memory, just give it a page and give it access to that page.”
CLI Environments Let AI Agents Autonomously Debug and Fix Broken Tools
“And then I think the most important thing that's super cool is that there it's also inherently a bootstrapped. So if there's an issue of the agent can debug and fix itself within the same environment that it uses the tool, right?”
MCP Provides a Safer Permission Model Than CLIs by Preventing Token Exfiltration
“MCP inherently has a really strong permission model. Like, all you can do is call the tools. A CLI is a little bit murkier. It's like, can I access the API token? Are you, like, properly sort of, like, re-encrypting the token so it can't, like, exfiltrate it? …”