GPT Pilot

In 2023 this was genuinely startling. It wrote applications rather than lines, and a lot of engineers changed their minds about what these systems could do because of it. That contribution is real and it belongs in the history of the field.

None of that is a reason to run it now. Development has stopped, the maintainers direct users to a commercial successor, and the successor is a different product with a different evaluation. Pick OpenHands if you want an open agent building from a specification, and treat this repository as reading rather than tooling.

That is the review. Anyone who cloned or installed during those ten months ran code the maintainers now describe as malicious, on a machine holding provider keys and source, and the correct response is credential rotation rather than a version bump. A project no longer under development cannot audit what else was touched.

Treat any artefact from that period as compromised and rebuild the environment it ran in. What it does right: the warning is published in the repository itself, where anyone arriving from an old link will actually see it, rather than in a post nobody reads.

The staging was ambitious for its date. A specification phase produced requirements, an architecture phase produced structure, and coding proceeded against both, which is more discipline than most contemporaries attempted. The weakness is the last stage: debugging is performed by an agent reasoning about output rather than by a harness with a pass condition.

A model diagnosing its own code has no independent signal and will report success at a rate unrelated to correctness. No benchmark was ever published, so the yield of the pipeline was never established.

This is a clean example of a pattern buyers should learn to recognise. An open project acquires an enormous audience, the team builds a paid product on the same core, and attention, then maintenance, then the users themselves are routed toward the commercial surface. The repository becomes a signpost.

That is a legitimate strategy and it has a cost the adopters absorb rather than the company. Likely path: everything happens in the commercial product from here. Position: evaluate the successor on its own terms, and price in that the same team already retired one code base.

My work on this is an inventory question rather than a procurement one. I need to know whether any machine or pipeline in this organisation pulled it, when, and what credentials were reachable from there, and that is an incident checklist rather than an evaluation.

Beyond that there is no supplier, no agreement, no support and no unattended mode. If a team wants the commercial successor, that starts as a new vendor review with its own questionnaire and its own retention answers. For this repository: not yet, permanently, and blocked in our package policy.

The licence deserves more attention than it gets. A functional source licence restricts competing use until it converts to MIT after a fixed period, which means the freedoms I care about arrive on a schedule rather than at publication. For a project that has stopped moving, the conversion is the only thing still happening.

The model layer was open enough: my own key against several providers, though nothing local, so inference always left the building. There is no protocol support and no plugin surface. A fork is possible and I would not want it.