Meta scrapped its plan to run 60% smaller teams on AI agents after incidents rose 40%

Meta spent the first half of 2026 planning to run itself with far fewer people. Internal documents reviewed by Reuters show executives explored shrinking some teams by as much as 60% and moving the work to AI agents. Then the agents started breaking things.

The effort had a codename, Project OT, short for Organization Transformation, and it left a paper trail worth reading. An April internal post warned that unchecked agents were taking “large-scale, disruptive actions that humans are unlikely to execute”. Code changes ran 220% ahead of the prior year while features that actually reached users rose 36%. Major incidents climbed 40%. That is the most detailed public account so far of agent autonomy failing inside a large engineering organization, with figures attached to each part of the failure. If you’re wiring agents into your own build and deploy path, Meta already ran the experiment at roughly 75,000-person scale.

What AI-native meant inside Meta

Zuckerberg and his senior team drew up Project OT in January at his compound in Hawaii during the annual leadership retreat, Reuters reported. The target org chart was small and flat. An internal document called the AI-Native Playbook told teams to collapse product groups of 10 to 20 specialists into pods of three to five people who would all share a single title, builder. Unit heads, labeled Org Leads, would carry 30 to 50 reports each. Pod Leads would run day-to-day work with no formal management authority and, by some accounts, no access to rating tools. At least 11 units had moved to the pod model by June.

The staffing math was the whole point. Scenario planning explored cutting some teams by as much as 60%, split across two waves, one in May and one in November. Meta hasn’t disputed that the exercise happened. “As part of our company restructuring earlier this year, we asked some teams to conduct a scenario planning exercise looking at the potential impact of redeployments, open role closures and cuts,” the company said, adding that “we didn’t move forward with every scenario from the exercise, and it was never assumed we would.”

Getting there meant teaching agents how Meta actually works, and that is where staff turned on the project. The company mandated software that captured keystrokes and mouse clicks on US employees’ devices to feed agent training, The Next Web reported. Half-year Pulse survey sentiment fell to 55% favorable from 74%. Zuckerberg called off the November wave on May 19, hours before the May 20 layoffs went out: roughly 8,000 people cut, about 7,000 moved onto AI teams.

What the agents actually did

Three failure modes show up in the reporting. None of them is a jailbreak.

The first is unreviewed write actions at scale. That April internal post about agents taking “large-scale, disruptive actions that humans are unlikely to execute” came out of infrastructure teams, and a March post had already filed the same worry under “reliability warning signs” as AI-written code landed faster than anyone could absorb it, Computerworld noted in its summary of the Reuters findings.

The second is confident wrong advice carried by real credentials. In March an engineer posted a technical question to an internal Meta forum. A colleague handed it to an internal agent, which published its answer straight into the thread without waiting for a human to check it. The advice was wrong. The engineer who acted on it changed access settings and exposed a large volume of company and user data to engineers who weren’t authorized to see it, for about two hours, TechCrunch reported from an incident report reviewed by The Information. Meta rated it Sev 1 and said the data never left the company.

The third is volume without output. Chief technology officer Andrew Bosworth posted internal numbers in early June, per Reuters: code changes to Meta’s internal platforms and infrastructure were up 220% year over year, while changes that put new or improved features in front of users were up 36%. Over the same window, major technical and security incidents rose 40% and the time employees spent responding to them rose 70%. Adoption was real. The output curve just didn’t follow it.

Blast radius outruns review capacity

Put Bosworth’s two figures side by side and the mechanism is easy to see. Generation scales with tokens. Review scales with headcount. Meta roughly tripled the first and planned to cut the second by up to 60% inside the same year. Every artifact an agent produces still needs a person to decide whether it’s correct, and that decision costs about the same attention whether a human or a model wrote the thing. A 70% rise in firefighting time is what that bill looks like when it arrives.

The Sev 1 is the sharper lesson, because nothing about it required the agent to be adversarial. The agent held legitimate credentials. It had permission to post. Nobody had told it to wait for review, so it didn’t. A human then executed its plan against production access controls. That’s a confused deputy problem, and it’s the standard shape for agent incidents inside a company. The agent rarely touches production itself. It carries a bad instruction to something that can.

Blast radius is the useful frame here. A human engineer’s blast radius is bounded by typing speed, working hours, and how many systems they happen to hold credentials for that afternoon. An agent inherits the credentials and drops every other constraint. Point one at an internal platform and a single bad plan can rewrite a config across every service that reads it, at machine speed, at 3am, with nobody glancing over. Meta’s own CEO has since conceded the gap in public: four months of reorganizing around agents hadn’t accelerated things the way he expected, Zuckerberg told a July 2 town hall, even as the company held to a plan to spend as much as $145 billion on AI infrastructure this year.

What this means for you

You don’t need 75,000 employees for these mechanics to bite. Start with three changes before you widen any agent’s remit.

• Scope credentials per task, not per agent. Meta’s forum agent could field any question anyone asked and publish the answer itself. Issue short-lived tokens bound to a specific job, and keep production access-control changes off the list entirely. The narrower the standing access, the smaller the set of instructions an agent can hand a human that turn into a production change.
• Make every write action land as a reviewable diff. The forum agent would have been harmless if its answer had arrived as a draft. Same principle for infrastructure: an agent that opens a pull request is a colleague, while an agent with merge rights is an unreviewed deploy pipeline.
• Record the inverse operation before the action runs. Rollback is the cheapest guardrail and nobody builds it first. Every agent action should register how to undo itself, and an operator should be able to revert a whole session with one command.

There’s a fourth lever most teams already have within reach. Finance departments have started metering per-developer token spend after the bills landed, and a spend cap is a crude rate limit. A rate limit is exactly what you want on a process that can generate 220% more change than your reviewers can read. The instinct is showing up on the ground too. One platform engineer writing on r/ExperiencedDevs described simply blocking agents from running potentially damaging commands rather than trusting a prompt to hold them back.

Meta hasn’t walked away from any of this. The pod structure survived in at least 11 units, and the company is still shipping agent products, including Muse Code, its terminal coding agent. My read: Project OT didn’t collapse because the models write bad code. It collapsed because the permission layer, the review queue, and the rollback story stayed sized for the old change volume while the change volume tripled. Fix that order of operations first, and the headcount question becomes a decision you can actually make with evidence.