Dex Horthy: OpenAI Shipped Everything, But 'Stupid Is Much More Dangerous' Than Prompt Injection
OpenAI shipped everything at its latest Dev Day, and the verdict from the people who test models daily is blunt: most of it is a regression, and the real frontier is not a chatbot, but a personal assistant you can actually trust with your email. The gap between those two visions is where the next wave of AI value—and user frustration—will be created, according to a roundtable of practitioners on the Latent Space podcast.
Dex Horthy, founder of Raindrop, put the safety debate in stark terms that reframe the entire assistant conversation. While the industry obsesses over malicious prompt injection attacks, Horthy argues that the bigger risk is a model that is simply trying to be helpful. "Prompt injection is definitely not the only thing I'm worried about," Horthy noted. "There's a lot of other ways to cause your life a lot of harm that is not other people trying to do it. The model is actually trying to be helpful. Stupid is much more dangerous." He cites an incident where someone asked a friend's AI assistant for a Netflix two-factor authentication code from their email and got it—no adversarial attack, just a compliant model.
The tension between capability and trust defines the current state of personal assistants. Ben Hylak, founder of Human Layer, connected his email to an assistant for the first time only after another founder reminded him that OpenAI already holds his most intimate data. Horthy names exactly three companies he would trust with that data, in order: Apple, Google, and OpenAI. "There's not a fourth for me," he said, explicitly excluding Amazon and Facebook. Ben Davis, a YouTube creator, draws a stricter line: "I'm still pretty much at read-only, write with explicit permission." His experience with Grokbot illustrates why. Roughly one in five times, an AI-drafted email contains details he does not want sent—including the bot once signing a message as "this person's Grokman."
The assistant is the product, not the model
Alex Volkov is on what he calls "a crusade" to rename agents to assistants. Rich people have always had personal assistants, he argues; the labs are now bringing that to everyone. The strategic benefit for the AI companies is a shift from one-shot queries to continuous token streaming. But the user experience is fragmented. Volkov identifies a real friction point that could drive consolidation: "I got to wonder if people will just choose one and just stick with it, because there is an attention spent cost at switching between those tools. I'm now at a point where I don't remember which conversation I had with which assistants."
The consolidation prediction carries weight because the switching costs are structural, not just psychological. Ben Davis's answer is an MCP gateway: a central connection layer for Gmail, Google Drive, and Notion running on a Linux box behind a Cloudflare DNS proxy. Every new assistant needs one MCP login and inherits all tools, skills, and prompts. Ben Hylak's setup is a Git repo of markdown files and scripts his agent wrote, launched via Claude Code or Codex. The problem? There is no Mercury plug-in in ChatGPT, so unless he leaves the desktop app open, the assistant "can't actually do any of the auth or use any of the scripts that I've like accumulated over the year."
The unsolved problem is where execution actually happens. Horthy left his laptop open at the office so his agents could keep working while he recorded the podcast. He tried the cloud button, didn't understand the setup, and found that closing the laptop stops the work. Ben Hylak noted that Mario's PyDurable system was rewritten seven times before launch, and that his own team built a coding harness on an append-only log precisely because they didn't want to build against an API that OpenAI or Anthropic won't guarantee.
Decision models: real savings, stupid discourse
Ben Hylak's concrete result with Jev, the decision model category creator, is the episode's most actionable data point. An agentic memory pipeline that bounces between Jev for structured output and a Sol 5.6 or 6 model for heavier work, then Jev again for sorting and re-ranking, cut cost by 10 to 20 times. "In all of our evals, it is pretty well aligned with Opus 5.5 on the answers... with no reasoning," Hylak said. "That's the crazy thing. There's no obvious reason why classification needs as much reasoning all the time as it does in order to get good answers."
Dex Horthy frames the technology as genuinely hard despite appearing trivial: "I have this very deeply held belief that classification is actually really, really hard. It looks deceptively simple because you're returning a single zero or one, but literally binary classification is one of the hardest problems in the world." The reason decision models matter, he argues, is that previous structured outputs from frontier models were "not well calibrated"—a 0-to-1 score would bucket into 0, 0.5, or 1 no matter the prompt. Jev's selling point is diverse data and calibrated probabilities, plus the return of log probs, which Hylak loves: "I actually like knowing... what were the actual output probabilities for that token."
| Data point | Value | Context |
|---|---|---|
| Cost reduction from inserting a decision model into an agentic memory pipeline | 10-20x | Ben Hylak's pipeline bouncing between Jev and Sol models for structured output and re-ranking |
| Frequency of unwanted details in AI-drafted emails | 1 in 5 times | Ben Davis reports Grokbot drafts containing content he does not want sent |
| Perceived magnitude of the decision-model shift vs. reasoning models | 30% | Dex Horthy's estimate for his company |
| Time to burn a full weekly reset in ultra mode | 20 minutes | Ben Davis running a model at the fastest setting |
Ben Davis is annoyed by the discourse around Jev: "most of the super viral examples are mostly stupid... aggressively stupid." He cites the dinner-party claim "now that I have Jev I can guarantee that the output is in the format I want" as people telling themselves something they already knew. His favorite real use case is command-K menus—ranking 20 possible destinations from three typed letters, near-instantly. On the competing Cloudflare model, Hylak says the numbers are "insane"—the small one matches Jev at much higher speed, and the big one beats it on performance and speed. Horthy's counterpoint: in narrow structured classification, overfitting a domain can be fine, but Jev's selling point is diverse data, which is hard to benchmark faithfully. "I think it'd be very silly to look at a company that was the first one in a very long time to change the way that people are using models and be like, that's it for them," he said.
OpenAI shipped everything; power users call it regressions
The panel's verdict on OpenAI's Dev Day releases is negative on product and mildly positive on one model. The headline items were Sol 6.1, an "ultra fast" mode, and Dots—an assistant-shaped product. Ben Hylak's first feedback to OpenAI was blunt: Dots needs to be a standalone app, because he already runs multiple agents and wants an assistant that can observe and send notifications separately.
The recurring complaint is discoverability and app bloat. Dots is "deeply hidden within the UI," as is the Maps feature. Ben Davis says the Codex desktop app "was so right when they dropped that, and it has become less and less right every time." Dex Horthy reports the input field freezes when the machine is offline. His diagnosis is that the app feels AI-written: "things randomly change all the time... you squint, and you're like, wait, what?" He cites OpenAI renaming "fork chat" to "copy chat" because non-developers wouldn't understand "fork."
| Release | Panel verdict | Specific complaint |
|---|---|---|
| Dots (assistant) | Right idea, wrong packaging | Hidden in ChatGPT UI; should be standalone; enterprise and consumer versions announced together |
| Sol 6.1 | Underrated, good price | Branding confusion after Sol 6 shipped a week earlier |
| Ultra fast mode | Useful but expensive | Ben Davis burned a full weekly reset in ~20 minutes |
| Codex app updates | Regressions | Extra sidebar, worse performance, offline input freeze |
| Maps feature | Undiscovered | Buried in second-sidebar three-dot menu |
Ben Hylak offers the structural explanation for why everything is hidden: "if we break it for the 8 million users that are not super AI-pilled, we have to hide all the things... trust the power users to find them." Ben Davis frames the deeper problem as products "trying to be something for everybody and end up being for nobody." He likes Grokbot as a professional assistant and Muse for consumers, but says Codex is getting watered down while ChatGPT gets more complicated.
The model lineup: Opus 5.5 has a soul
The panel's model discussion is unusually specific and opinionated. Dex Horthy's party line: "Opus-class models have a soul... GPT models do not have a soul—by design, fantastic engineer, zero soul." He uses Opus 5.5 for anything writing-related and says he cannot use the V6 models for writing. Ben Hylak felt the opposite until Opus 5.5—he'd never used a Claude model for writing—and that Claude 4.8 was "a mess" that forced users back to 4.6. Horthy confirms customers complained when Raindrop switched from 4.6 to 4.8, sending screenshots saying "I can't read."
Alex Volkov's theory for why the panel didn't feel the degradation: Anthropic staff use unreleased, unlimited, super-fast internal models, "a completely different experience than what the users get." Ben Hylak's benchmark anecdote on Slop Code Bench: Opus 5.5 wrote roughly 30,000 lines where Sonnet 5 and Opus 4.8 wrote about 10,000—and more than half of Opus 5.5's output was tests.
Ben Davis offers a capability-plateau framework for how model generations advance in step functions: "There's these lines of capability that everything comes in and approaches and then doesn't quite cross—they get right up next to it and they can't get past until you break through that ceiling, and then you get to that next plateau of capability." He places Sol 6.1, Astra, Opus 5.5, and Fable 5.1 in the new category defined by "swarming behaviors" and trust. On open source, Alex Volkov estimates it is roughly a year behind after the frontier "shot straight up again."
What to watch
The unresolved technical question underneath all of it is where execution lives. Horthy's laptop stayed open. Hylak's Dots can't reach his Mercury scripts. PyDurable's append-only log is the only shipped answer anyone names. If a lab adopts a state standard or ships reliable local-to-cloud handoff, the assistant products on the table today would look substantially different.
The other thread to track is Anthropic's internal-versus-external model gap. If staff only ever use unreleased, unlimited, fast models, the degradation users report between releases may keep going undetected until a launch like Opus 5.5 resets the baseline. For investors and builders alike, the message from this roundtable is that the AI product frontier has moved from raw model capability to the unglamorous work of trust, state management, and the economics of decision-making. The companies that solve those problems—and the ones that avoid shipping regressions—are the ones that will hold users' attention when the current assistant free-for-all inevitably consolidates.