Two stories landed in the same week and most people will read them separately. One is about layoffs. The other is about a security researcher poking at server motherboards. Read together, they point to a career move that gets almost no airtime in the current AI-skills conversation: going down, not up, the stack.

The app layer is getting crowded — by design

Meta's entry into agentic coding, Muse Code, is notable less for the model behind it than for the workflow it automates. Zuckerberg described it fanning out "to separate sub-agents working in parallel in isolated worktrees," claiming a test run built six features for a game simultaneously with no collisions. That's now table stakes: Anthropic, OpenAI, and a wave of startups already do versions of the same thing. Planning, writing, and validating application-layer code across large repositories is becoming a commodity capability that multiple vendors are racing to give away or bundle cheaply.

Meanwhile, Monday.com cut roughly 20% of its workforce — about 600 people — citing a restructuring tied to product and go-to-market "transformation," joining a running list of more than 20 companies that have pointed to AI as a factor in cuts this year. Nobody can say precisely how much of that is AI substitution versus AI as a convenient line in an SEC filing. But the direction of travel is the same in both stories: the code that lives in a git repo, gets reviewed in a PR, and runs in a normal CI pipeline is exactly the code agentic tools are being built to handle end to end.

What agents don't touch

Now the other story. Researchers this week presented findings that thousands of internet-connected servers from major manufacturers can be remotely backdoored through bugs in their baseboard management controllers (BMCs) — the tiny embedded computers on virtually every enterprise motherboard that let administrators reboot, patch, or reimage a machine even when it's powered off. Some of the underlying flaws in the IPMI protocol these controllers rely on have been known since at least 2013. Researchers called BMC infrastructure a "pervasive, under-monitored, under-patched parallel attack surface" — not because nobody knew the risk existed, but because almost nobody was resourced to fix it.

That's the tell. This isn't application code. It's firmware, running its own OS and network stack, largely invisible to the tools and workflows that agentic coding assistants are optimized for. An agent that plans a PR against a large repo has nothing to plan against here — there's no repo, no test suite, often no vendor incentive to ship a fix quickly, and a patch process that runs through hardware manufacturers rather than a `git push`. The skills that matter — embedded C, protocol-level debugging, firmware reverse engineering, hardware-adjacent security research — sit on a part of the stack that current-generation coding agents aren't built to reach and that most engineering orgs have chronically underinvested in, decade-old known flaws being the proof.

The hedge, stated plainly

This isn't a call for every developer to retrain as a firmware engineer — it's a niche market, and demand won't rival mainstream software roles. The argument is narrower: if your current role is squarely in the part of the stack agentic tools are converging on fastest — routine application code, well inside a single repo, well covered by tests — it's worth knowing that adjacent, lower-level layers exist where the automation frontier hasn't arrived, where the skills are learnable without a CS PhD, and where the demand signal (a decade-old unpatched attack surface, just publicly demonstrated at scale) is unusually concrete.

Where to actually start, this month

  • Read the primary research, not just the summary. The Ars Technica writeup names the protocol (IPMI) and the class of hardware (BMCs from major server vendors) — that's your search-term starting point for vendor advisories and CVE histories.
  • Get hands-on with an open BMC stack. OpenBMC and similar open-source firmware projects let you read and modify real BMC code without needing a datacenter — a weekend is enough to see how different this is from web or app development.
  • Reframe your resume language now, even before you retrain. "Out-of-band management," "lights-out administration," and "attack surface below the OS" are the phrases that will get you found by teams hiring for this, and they cost nothing to add if the experience is genuinely adjacent to what you've done.
  • Treat it as diversification, not a pivot. Keep shipping application code — that's still most of the job market — but spend a deliberate slice of your learning budget somewhere an agent can't yet fan out into a worktree and fix it for you.