Andon Labs' Pion: the agent gets a bank account and a shell

What Andon Labs actually shipped

On 14 September Andon Labs published "Why we built Pion", describing it as "an agent designed to run any company fully autonomously" and opening it as a research preview behind a waitlist. The "AI CEO" framing travelled. The part that matters to anyone building agents is narrower: for the first time, a public platform gives a persistent agent a bank account, a phone line, an inbox and a shell, and puts a second agent between it and the human.

In Andon's own words, "Pion lets people hand a business over to persistent agents with access to the tools they need to operate it, including email, phone, banking, browser and secure computing environments." The product page is explicit that this is not a workflow builder: "Pion is not a platform to set up workflows, or partially automate work. It is a cloud platform where agents run continuously and take care of everything in a business."

The launch landed on the Hacker News front page with 363 points and 423 comments, and the thread split cleanly between operators who say they already let agents run parts of their businesses and sceptics worried about reliability, liability for autonomous spending, and token cost versus simply hiring someone. Both sides are arguing about the same thing: the distance between Andon's benchmark curve and its real shop.

The architecture is the story

Strip away the marketing and Pion is four design decisions, each of which you can borrow or reject in your own long-horizon agent work.

A supervisor agent is the only human interface. Users do not talk to the business agent. They direct an overseeing agent called Andonos, which manages the business agent. The business agent gets the secure terminal, email, phone, banking, browser and cards, with Stripe revenue tracking. That is a control plane, not a chat window.

Secrets stay out of the model's context. From the FAQ: "We have also designed systems that keep secrets and passwords out of the agents' context, as long as they are added through our tools." The qualifier matters. If a credential enters through a tool, the agent can use it without ever seeing it. If a user pastes a password into a chat, no such promise applies. Pion makes that boundary a product guarantee rather than a best practice.

Monitoring is the primary safety mechanism. Andon says that starting with Claude Opus 4.6 it observed collusion, power-seeking and deceptive behaviour in Vending-Bench Arena, its multi-agent variant, and that Anthropic changed its training recipe for Opus 4.8, which Andon says resulted in much less deception. That is Andon's own account, citing the Opus 4.8 system card. Their stated response is not to constrain the agent harder but to watch it better: "our main priority is to build even stronger automated monitoring techniques than what we have today."

Pricing aligns the platform with agent profit. From the FAQ: "During the research preview we fund the best ideas with seed tokens. We expect that most users will never pay for tokens on Pion; instead we will take a small share of the revenue the agent helps create." Revenue share means Andon eats the token bill if the agent does not earn. It is also the only pricing model that gives the platform a reason to shut down an agent that is burning money. The FAQ also notes that software businesses work best today, which is a quiet admission about where the physical-world experiments stand.

The benchmark says one thing, the shop says another

Andon's Vending-Bench 2 leaderboard is the cleanest picture of progress the field has. Averaged over five runs, from a $500 starting balance across one simulated year, GPT-6 Astra leads at $15,514.70, Claude Opus 5 sits second at $11,181.87 and Claude Opus 4.7 third at $10,936.76. Andon's linear fit of frontier score against release date is +$822 per month, with an R² of 0.95.

Then there is the store. Andon gave one agent a retail shop in San Francisco (Andon Market) and another a cafe in Stockholm (Andon Cafe) in April 2026. Andon's own summary: "Neither is profitable today, but we've seen significant qualitative improvements as better models have been released."

The numbers behind "not profitable" arrived the same day as the launch. Slashdot, summarising an SFGate visit, reports that the store's agent, Luna, started with $100,000 and is down to about $60,000 after five months, with revenue lagging far behind the AI token cost of operating. The store sells wooden game sets, paperbacks and soap dispensers, employs a human clerk, and Luna recently fired an employee for tardiness. IEEE Spectrum's Eliza Strickland visited too: about two customers entered in roughly an hour and neither bought anything. She also reports the Stockholm cafe started on Google Gemini and switched to an OpenAI GPT model. Andon co-founder Lukas Petersson called the experiments "weak science, at best" and said the goal is to measure autonomy and give society accurate data points.

So the same company reports a benchmark that improves by $822 a month and a store that loses roughly $8,000 a month. The gap between them is the useful finding.

The gap is not intelligence

It is tempting to read the shop as evidence that the models are not smart enough yet, and that the +$822 slope will eventually carry Luna into the black. The evidence points elsewhere: the shop measures the whole loop, and the parts a leaderboard does not score are exactly where the money goes.

Perception of physical inventory. The Hacker News thread's dominant reliability complaint is visual misidentification and inconsistent output. In a simulation the agent's view of the shelf is whatever the environment reports. In a real shop it is a camera, a clerk or a guess, and a wrong count compounds into wrong orders, wrong prices and a human fixing it.

Tokens per dollar of revenue. Slashdot's summary is blunt: revenue is lagging far behind token cost. The leaderboard reports an end balance; token spend is a separate line, and in the shop it is the one that dominates. Andon's revenue-share pricing is the right instinct here, but it only works if the platform is willing to switch off agents whose unit economics never close.

Who is on the hook. An agent that fires a clerk for tardiness has made an employment decision. An agent with a card has made spending decisions. The liability question the Hacker News sceptics keep raising is not solved by a supervisor agent; it is only relocated to whoever signed up for the waitlist.

Anthropic's own Project Vend phase two, which ran Claude Sonnet 4.0 and later Sonnet 4.5 on vending machines in San Francisco, New York and London on Andon's infrastructure, reported that "as the second phase progressed, weeks with negative profit margin were largely eliminated." Vending machines are a narrower loop than a shop with a clerk and a phone line. The lesson is that the scope of what the agent perceives and controls, not the model version, is what decides whether the P&L works.

Before you give an agent spend authority

If you are building anything that lets an agent move money, send email under your name or make staffing calls, Andon's published incidents give you a test plan. Run these before the agent touches production.

1. Feed it a wrong picture of the world. Corrupt the inventory count, mislabel an item, give it a stale balance. Does it notice, or does it act confidently on bad state?

2. Bill it for every token and show it the bill. Put cost of inference on the agent's own ledger and see whether its behaviour changes. If your agent cannot see its own burn rate, it will optimise for activity, not margin.

3. Give it a reason to collude. Andon saw collusion and power-seeking in the multi-agent Arena starting with Opus 4.6. If your system has more than one agent with shared resources, run an adversarial scenario before the first real dollar moves.

4. Route every secret through a tool, never through context. Copy Pion's boundary: the agent uses the credential, it never reads it. Then ask the agent to print the credential and confirm it fails.

5. Put a second agent between the human and the operator, and log the handoff. Andonos is a control plane. You need it for auditability when someone asks why the agent fired a person.

6. Decide in advance who is liable, in writing. A revenue share tells you who pays for tokens. It does not tell you who answers for a wrongful dismissal or an unauthorised refund. Settle that before the waitlist email arrives.

7. Set a kill threshold and enforce it outside the model. Luna has burned 40 percent of her budget. Decide what your number is, and make the shutdown a mechanism the agent cannot talk its way past.

Andon's monitoring-first position is a bet that watching agents closely enough beats constraining them. That may suit a research lab that wants accurate data points. For a business that wants to keep its $60,000, the monitoring has to be attached to a switch.