Jun 1, 2026 · 55m · sourcery
"We Don't Trust Agents" - What This CTO Knows That You Don't · Sourcery with Molly O'Shea
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
In this episode of Sourcery hosted by Molly O'Shea, Merge co-founders Shensi Ding and Gil Feig detail their strategy for building multi-product AI integration infrastructure, managing non-deterministic security risks, and scaling an AI-first startup. They share practical lessons on enterprise client acquisition, agent governance, hiring high-agency talent, and maintaining operational discipline in shifting venture markets.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. Molly holds 23.7% of the talking time here. How this is scored →
Molly as informed peer 3.9 Guest teaching 3.4 Guest disagreement 1.4 Molly pushing back 1.1
speaking balance: gold is Molly, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 51:07 Over-engineering custom models hot take
Shensi directly attacks the prevailing industry trend of startups unnecessarily training custom models instead of building functional product features.
Hardest push from Molly ▶ 31:01 Reframing macro trends to internal dataMolly interrupts Shensi to clarify that she is asking specifically about internal telemetry and customer migration data, not public Twitter trends.
Biggest teaching moment ▶ 16:40 Deterministic engineering vs non-deterministic agentsGil educates the audience and host on why traditional code reviews fail with agents, explaining why strict integration guardrails are necessary when agents hallucinate data routing.
Molly holds their own ▶ 7:29 Bifurcation in high-agency autodidact hiringMolly articulates an informed macro observation on how high-growth tech executives evaluate high-agency talent and autodidacts compared to standard applicants.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | Molly as informed peer | Guest teaching | Guest disagreement | Molly pushing back | Why |
|---|---|---|---|---|---|---|
| Episode Highlights and Key Conversation Teasers | 4 | 3 | 1 | 1 | Molly frames the conversation around how fast Merge pivoted into AI, citing their enterprise customers and questioning previous vulnerability. Gil and Shensi explain their three-pronged product shift (Unified, Agent Handler, Gateway) and how pausing a massive deal allowed them to build with AI coding tools. | |
| Cultivating an AI-First Company Culture and Screening Talent | 5 | 2 | 1 | 1 | Molly brings in industry context about high-agency autodidact talent and bifurcated hiring standards. Gil and Shensi explain their cultural AI screening, brown bag lunches, and Keith Raboy's barrels vs. ammunition mental model. | |
| Customer Segments, Use Cases, and Enterprise Adoption | 4 | 4 | 1 | 1 | Molly inquires about customer segmentation across fintech and AI startups. Gil and Shensi explain how AI buyers differ drastically from classic SaaS buyers because they lack MCP protocol knowledge and need prescriptive guidance. | |
| Cybersecurity Threats, Supply Chain Attacks, and Non-Deterministic Agents | 4 | 5 | 2 | 1 | Molly brings up recent breaches like Vercel and Mercor. Gil details how non-deterministic AI agents pushing massive PR volume into open-source supply chains create critical security risks, and why Merge enforces hard guardrails because they don't trust agents. | |
| Live Bot Scanning, AI Threat Actors, and Vulnerability Discovery | 4 | 4 | 2 | 1 | Molly references a doomer interview with Gilly Ronan regarding breach frequency. Gil details live bot scanning attacks and the Mythos/Axios security realities, noting how international attackers now have fluent English and infinite AI manpower. | |
| Sponsor Segment: Brex Financial Stack for Startups | 3 | 5 | 1 | 1 | Following an ad read, Molly asks how CTOs mitigate risks and what hackers do with stolen data. Gil explains that reputation blackmail against corporations is often far more lucrative than selling data on black markets. | |
| Managing AI Spend, Gateway Routing, and Internal Agent Governance | 3 | 4 | 1 | 1 | Molly asks about AI infrastructure bottlenecks. Gil and Shensi explain runaway inference costs and the governance nightmare of employees connecting shadow AI tools to sensitive databases. | |
| Popular Tool Connectors, Consumer Wearables, and Industry Gossip | 4 | 2 | 1 | 2 | Molly clarifies whether Merge tracks API connection shifts internally. Shensi and Gil discuss common productivity connectors and humorous edge cases like tracking stress spikes via Whoop against Asana tasks. | |
| Marc Benioff's 'Beginner's Mind' and Headless Software Architecture | 5 | 3 | 1 | 1 | Molly brings up Salesforce's headless announcement and asks for a technical breakdown. Gil explains headless architecture as UI-less, API-driven workflows where autonomous agents make decisions without human interface bottlenecks. | |
| Founder Resilience, 'Easy Mode', and Startup Recruiting Reality | 4 | 3 | 2 | 1 | Molly prompts a discussion on founder grit and AI-pilled startups. Shensi critiques founders trapped in 'easy mode' and over-intellectualizing company building, while Gil outlines the trade-offs between cash compensation and equity risk. | |
| The 'SaaS-pocalypse' and In-House Customization vs. Ready-Made Platforms | 4 | 4 | 2 | 1 | Molly asks whether the SaaS-pocalypse makes them nervous. Gil and Shensi explain that while in-house vibe-coding lowers the barrier to replicate software, enterprise nuance and forward-deployed customization still keep platform software viable. | |
| Sponsor Segment: Public Generated Assets and Direct Indexing | 4 | 3 | 2 | 1 | Following an ad read, Molly asks about irrational private market multiples in AI. Gil shares Merge's early temptation by 3,000x revenue multiples and warns that many heavily funded AI startups will face brutal down-rounds or collapse. | |
| Climbing the Logo Ladder and Maintaining 99.9999% Uptime | 3 | 3 | 1 | 1 | Molly asks about landing high-profile logos like OpenAI and Uber. Gil and Shensi explain the pressure of maintaining six nines of uptime when powering core infrastructure for mission-critical platforms. | |
| Tech Misconceptions and Over-Engineering AI Usage | 4 | 3 | 2 | 1 | Molly asks for hot takes and misconceptions in tech. Shensi and Gil push back against companies over-engineering custom models and complex workflow harnesses when standard models and natural language prompt artifacts suffice. |
Statements from this episode (21)
Feig: Merge Built Agent Handler With One Engineer and Founders
“Building our next product agent handler, we had one engineer and me and Shensi, and we were helping on nights, weekends. We did whatever we could have because we needed to contribute.”
Feig: Startup Leaders Must Master AI Tooling Hands-On
“If we are the leaders of this company, we have to know everything there is to know about how AI works, how you build with AI so that one, we are more effective and two, we're building for where the puck is going.”
Ding: Merge evaluates AI adoption as part of employee performance reviews
“Like, our whole team is really encouraged to do it, and if you don't do it does, it is a part of your performance.”
Feig: Merge screens candidates for AI enthusiasm rather than advanced tool usage
“We ask about it in the interview process. So what we're not looking for is I use the latest cutting edge, but we're looking for, you know, hey, I use it to code sometimes. My company doesn't let me use it to do all these things, but I really want to. That's wh…”
Ding: Merge Accelerated Revenue Significantly Without Adding Much Headcount
“Last year we didn't increase headcount that much, but our revenue accelerated pretty significantly. And so it's had, like, meaningful leverage on our business.”
Feig: AI Coding Tools Shift Hiring Toward High-Agency 'Barrels'
“It used to be that, you know, a team that had a barrel of a PM or a manager and a bunch of ammunition could get a lot done, But now that you kind of can have one person just go use, you know, Codex, Cloud Code, whatever, to go build something, you really just …”
Feig: AI integration buyers understand their technical requirements far less than SaaS buyers
“When people are buying us for AI use cases, they actually don't really know what they're looking for as much as it was in the past, right? Like we would, yeah, you know, two, three years ago, we go to sell our unified platform to, you know, a classic SaaS comp…”
Ding: AI companies purchase software infrastructure much faster than traditional SaaS buyers
“Also a lot of these AI companies, they purchase much faster like a large financial services, like the deal cycles are definitely just longer. For SaaS platforms, shorter because sometimes we're selling to an existing product that already has product market fit…”
Feig: Enterprise trust in AI models is rising despite cloud multi-tenancy reservations
“Over the past year, You've seen people use the models, trust them more, and now everyone's backing away from that language, but there's still a lot of reservations now around using anything AI in the cloud, and so still demands for, no, we want this running in…”
Feig: Open-source supply chain attacks will surge as AI agents flood pull requests
“Agents are pushing a ton of code. You don't have enough humans to read all that code, and so things are slipping by, things are getting in, and one of them was a vulnerability that gets injected into an open source package that everybody relies on and uses, an…”
Feig: AI agents cannot be trusted without hard data-leak guardrails
“We don't trust agents. We say, Hey, we can try to set rules, but there needs to be hard guardrails and blocks for things like sensitive data being sent across.”
Feig: Merge Faced 1,000 Bot Signups Scanning Endpoints in One Hour
“Yesterday I had to manually go in and intervene because we all of a sudden had over a thousand bot signups in, in, like, an hour, and we could see them actively scanning all the endpoints across our backend.”
Gil Feig: Wiz found vulnerability accessing every hosted repository via single git push
“Basically Wiz found that they were able to do a single git push of a file and gain access to every single repository hosted on the platform.”
Feig: AI token maxing leads to severe CFO bill shock
“You're seeing a lot being built, but then the bill comes to the CFO and it's actually really brutal and way worse than they expected. And even if they got double the productivity, they might not have had double the budget for headcount and they, you know, Spen…”
Ding: Benioff will adjust Salesforce through new tech shifts
“One thing that's really remarkable is, is very hard to have a dominant product and company for 30 years through multiple tech shifts, and so I just would not count Benioff out.
[1992] Shensi Ding: I think, like, he's able to adjust really well to whatever mark…”
Ding: Software companies must go headless to compete for agent traffic
“I think you have to, because I think a lot of times not for all software, but for some software, like you're not going to have time to make a decision for what vendors you use.
[1925] Shensi Ding: We notice this with packages a lot, also in cloud code, scarily…”
Shensi Ding: Over-intellectualizing startup building prevents founders from enduring necessary hardship
“I think the best way to succeed is to just do things, and I think if you over-intellectualize your company building instead of actually doing anything, you're too high on Maslow's hierarchy, and that means that you're not actually able to suffer later.”
Ding: Enterprise SaaS sales are harder because building in-house is cheap
“I mean, I think enterprise sales for these large companies is much harder because the time to build the same exact product in house is just significantly lower. There's also just less leverage. Like when you're doing a negotiation against the customer for why …”
Feig: AI Startups Raising at 100x–1,000x Multiples Will Face Failure and Layoffs
“We know specifically, like we know the numbers, we know sales figures for some of these companies raising at Hundreds of millions to billions, and again, we're looking at thousand x to, you know, hundred to thousand x multipliers, like, a lot of these companie…”
Shensi Ding: Companies over-engineer by training custom models instead of using generic LLMs
“One hot take that I have is that I've noticed a lot of companies, like, kind of over-engineering their, like, ML usage. Like, they'll have, like, They'll build their own custom models. They'll try to train their own models when really, like, you should, you co…”
Gil Feig: Custom agent harnesses and workflow builders will become obsolete very soon
“You see a lot of people trying to build, like, a custom harness, or, You know use something like a workflow builder to build agents that are repeatable and all of that. And I just ultimately think none of it matters because we're almost at the point now where …”