I Stopped Asking Which AI Is Best. I Started Building an AI Team.

After years of experimenting with AI, I realized I didn't need one model to do everything. I needed to figure out what job each one should have.

For the last few years, I've spent an unreasonable amount of time experimenting with AI.

I've used ChatGPT extensively. I've worked with Claude and Claude Code. I've used Codex and Cursor for software development. I've experimented with Gemini. I've built workflows around Base44. I run models locally with Ollama and generate images locally with Stable Diffusion.

Some of these tools have become part of my daily workflow. Others I pay for and sometimes realize I'm barely using.

And like everyone else, I've spent plenty of time wondering:

Which AI is best?

Is Claude better than ChatGPT?

Is Gemini better at this particular task?

Should I use Codex or Cursor for this project?

Should I run something locally instead?

Those comparisons can be useful. But after years of experimenting with these systems, I've started thinking that I may have been asking the wrong question.

Recently, a much more interesting question occurred to me:

If these AIs were people working on my team, what job would I give each one?

That simple change in perspective has started reshaping my entire AI workflow.

I'm no longer trying to find one AI that does everything.

I'm starting to build an AI organization.

And a security experiment involving 114 Git repositories made the idea click.

I Had a Gemini Problem

My Gemini problem wasn't that Gemini wasn't useful.

It was that I wasn't using it enough.

I already had a software development workflow I liked. For serious coding, I found myself gravitating toward Codex, Claude Code and Cursor.

Meanwhile, I was paying for access to Google's AI ecosystem without really taking advantage of what I had.

That bothered me.

Not just because I was paying for something I wasn't fully using. I started thinking about the enormous amount of AI compute available to me across all these subscriptions.

Why was I having several powerful AI systems compete to perform essentially the same jobs?

So I started joking about something I called "token maxing."

The name is intentionally ridiculous.

The idea isn't.

I wanted to extract as much useful work as possible from the AI resources I already had.

And then I thought about the git directory sitting on one of my Linux systems.

It contains local copies of projects I've accumulated over years: websites, applications, experiments, utilities, abandoned ideas and projects at various stages of development.

I didn't even know exactly how many repositories were in there.

And suddenly I had a job for Gemini.

Audit everything.

Have at It

I launched Google's Antigravity agent from my home directory and gave it what was probably one of the most comprehensive prompts I've ever written.

The instructions were intentionally restrictive:

• Find every Git repository under my local ~/git directory.
• Inventory them.
• Understand the technologies and architecture.
• Review authentication and authorization.
• Look for injection vulnerabilities, exposed credentials, insecure configurations, API problems, supply-chain risks, infrastructure weaknesses, dangerous deserialization, container issues and other security problems.
• Trace potential vulnerabilities through the code rather than simply flagging suspicious strings.
• Distinguish between confirmed findings, likely findings, potential findings and things requiring manual verification.
• Don't modify my repositories.
• Don't install anything.
• Don't push anything.
• Don't touch production.
• Write the results somewhere else.
• Create individual repository reports.
• Create a master security assessment.
• Don't stop just because you've found some interesting vulnerabilities.
• Account for every repository.

Antigravity started crawling the directory.

Then it came back with a number that surprised me.

114 repositories discovered.

I laughed.

Perfect.

This was exactly the kind of job I had been looking for.

I wasn't asking Gemini to generate another React component that I could just as easily have asked Codex or Claude to write.

I had essentially walked into my new security department, dropped 114 projects on the desk and said:

Have at it.

Gemini Antigravity working through my local repository portfolio during the security audit.

Then I Realized I Couldn't Go to Sleep

There was one problem.

Antigravity kept asking me for permission.

Approve this command.

Approve that operation.

Approve another analysis step.

The security model made sense, but I had created an audit that could potentially run for hours.

And I needed to sleep.

That led to another unexpectedly important part of the experiment.

I had to think about agent autonomy as a permissions problem.

I didn't want Gemini to have carte blanche over my machine.

I wanted it to operate autonomously inside the job I had defined.

• My repositories were read-only.
• Reports could be written to the security-audit directory.
• Temporary analysis files could live in Antigravity's workspace.
• No commits.
• No pushes.
• No destructive Git commands.
• No production access.
• No installing dependencies.
• No exposing credentials.

Eventually I configured Antigravity to proceed without constantly asking for approval while reinforcing those restrictions in the audit instructions.

And off it went.

That experience changed how I thought about AI agents.

The interesting question isn't simply:

Can this agent operate autonomously?

It's:

Within what boundaries should I allow this agent to operate autonomously?

Those are very different questions.

I Went to Sleep. My Security Auditor Didn't.

By the time the analysis finished, Antigravity had produced a security assessment covering the portfolio.

And the output wasn't merely: "Here are some things you should probably check."

It identified specific potential problems tied to repositories, files, functions and configurations.

It produced a prioritized remediation roadmap.

It identified credential issues, authorization problems, infrastructure and container concerns, information disclosure, potentially dangerous deserialization, cross-repository patterns, and things requiring manual verification.

Antigravity's audit eventually produced a prioritized remediation roadmap rather than simply a list of generic security recommendations. Specific findings have been redacted pending independent validation.

And then I decided to push the experiment one step further.

I told Gemini to take all of that existing audit data and build me a self-contained HTML security dashboard.

No external libraries.

No CDN.

No server.

No Internet connection required.

Just one HTML file containing the audit.

The final dashboard summarized the audit across 114 repositories, including portfolio coverage, findings by severity, repository risk, and areas requiring manual verification.

The result stopped me for a second.

At the top of the dashboard:

• Repositories discovered: 114
• Audit completion: 100%
• 114 of 114 fully audited
• Total findings: 20
• Critical: 3
• High: 4
• Medium: 6
• Low: 6
• Informational: 1
• Manual verification: 2

Below that were severity visualizations, vulnerability categories, a findings explorer, secrets and credentials, cross-repository analysis, a repository risk view, the complete repository inventory, security strengths, coverage and limitations, report metadata and a validation workflow.

It looked less like the output of a chatbot and more like something I might expect from an internal application-security team.

And I hadn't personally reviewed 114 repositories.

I'd assigned the job.

That distinction is important.

But I Don't Trust the Report Yet

This may actually be my favorite part of the experiment.

Gemini says there are three Critical vulnerabilities.

Do I have three Critical vulnerabilities?

I don't know yet.

And I'm deliberately not treating those two statements as equivalent.

Large language models are remarkably capable.

They're also remarkably capable of producing convincing explanations that turn out to be wrong.

The solution, at least for me, isn't pretending that problem doesn't exist.

It's designing the workflow around it.

So my next step isn't necessarily:

Gemini found it → Codex fixes it.

It's:

Gemini found it → another AI tries to prove Gemini wrong.

I'm planning to take the serious findings and independently give them to Claude Code or Codex.

Not: "Gemini found this vulnerability. Please confirm it."

Something closer to: "Independently analyze this code path. Determine whether this vulnerability actually exists. Identify existing mitigations. Trace attacker-controlled input to the vulnerable operation. Determine the realistic impact."

Then compare the conclusions.

A Gemini finding might ultimately become:

• Validated
• Partially validated
• False positive
• Requires manual testing

Only validated issues should move into remediation.

And after another agent implements a fix?

Ideally, a different model reviews the change.

That led me to another principle that I'm increasingly interested in:

AI should audit AI.

My AI Org Chart Started Appearing

Somewhere during this experiment, I realized I wasn't really thinking about these products as competing chatbots anymore.

They were beginning to occupy different roles.

Gemini and Antigravity were becoming useful for broad, long-running analytical jobs: portfolio security audits, cross-repository analysis, dependency reviews, technical-debt analysis and other work where I want an agent to chew through a large amount of material.

Codex, Claude Code and Cursor occupy much more of my engineering world: implementation, debugging, refactoring, architecture and testing.

And then there's Victor.

Victor is different.

I Text Victor

Victor is the name I've given my personal agent built around Base44.

Most of my communication with Victor happens over text messaging.

That sounds like a small detail.

I don't think it is.

I increasingly don't want my interaction with AI to require me to consciously "go use AI."

I don't always want another browser tab.

Another dashboard.

Another application.

Another prompt window.

Another model selector.

Sometimes I just want to send a message.

Victor has become part of the operational side of my experiment.

I use him for things such as checking emails, helping manage scheduled publishing, producing daily briefings and handling other recurring tasks.

I'm still refining what belongs with Victor and what doesn't.

But I'm starting to see him as something like the front door to my personal AI infrastructure.

That's different from my coding agents.

I visit Codex because I want to build something.

I open Claude Code because I want to work deeply inside a codebase.

I launch Antigravity because I have a large analytical job.

Victor is becoming something I simply communicate with.

And that feels much closer to where I think personal AI gets interesting.

Some of My AI Doesn't Live in the Cloud

There's another part of my setup that complicates the org chart in an interesting way.

I also have a local AI workstation.

It's an HP Z4 G4 with an NVIDIA RTX A5000 with 24 GB of VRAM, and I use it for things including local models through Ollama and local image generation with Stable Diffusion.

I built it because I've always enjoyed experimenting with hardware and technology.

But increasingly I see that machine as another layer of my AI organization.

There are things I simply prefer doing locally.

Sometimes it's privacy.

Sometimes experimentation.

Sometimes control.

Sometimes I want to run a model without thinking about tokens.

Sometimes I want to generate images locally.

Sometimes I just want to see what I can make a machine sitting in my house do.

The local model doesn't need to "beat" ChatGPT or Claude for it to have a job.

That's the realization that keeps repeating itself.

It just needs to have a job.

Stop Making Five AIs Compete for One Job

This is probably the biggest change in how I think about my subscriptions.

For years, the natural behavior was:

I have a problem.

Open ChatGPT.

Maybe ask Claude.

Maybe try Gemini.

Perhaps compare the answers.

That's useful sometimes.

But imagine doing that inside a company.

You hire five talented people and then ask all five of them to write the same memo every day.

Eventually someone is going to ask why you're paying five salaries.

That's essentially what I was doing with AI.

Now I'm trying to think differently.

If Gemini isn't my preferred coding environment, that doesn't mean Gemini has no value to me.

It means I need to find the work where Gemini provides leverage.

Apparently one answer is: "Here are 114 repositories. Go find out what's wrong with them."

That's a pretty good job.

And security is only the beginning.

The same portfolio could eventually be analyzed for:

• Technical debt
• Dependency health
• Documentation quality
• Test coverage
• Dead code
• Architecture consistency
• Accessibility
• Performance
• Licensing
• Deployment documentation

Those are jobs I don't necessarily want interrupting my primary development workflow.

So maybe they belong to another member of the team.

The Human Is Still the Manager

There is a temptation when discussing agents to jump immediately to some vision of fully autonomous AI systems running everything.

That's not what I'm trying to build.

I don't particularly want an AI discovering a security vulnerability, rewriting my application, deploying the fix, emailing everyone about it and congratulating itself while I'm asleep.

I want delegation with governance.

I decide what work needs to happen.

I decide which AI gets the assignment.

I decide what systems it can access.

I establish the boundaries.

I decide when another model should independently review the work.

And consequential actions still require my approval.

Ironically, the more autonomous these systems become, the more I've started thinking about very traditional management concepts.

• Roles
• Permissions
• Separation of duties
• Independent review
• Escalation
• Accountability
• Quality control
• Trust

AI isn't eliminating management from my workflow.

It's making me think much more deliberately about management.

The Personal AI Organization

I'm still figuring out what this ultimately becomes.

Right now, conceptually, my little organization looks something like this:

• Me — direction, judgment, governance and approval.
• Victor / Base44 — personal interface and ongoing operations.
• Gemini / Antigravity — broad analysis, audits and long-running portfolio work.
• Codex / Claude Code / Cursor — engineering, implementation, debugging and architecture.
• Local AI / Ollama / Stable Diffusion — private inference, experimentation and local creative workloads.

But those roles aren't fixed.

I'm experimenting.

Some assignments will fail.

Some will overlap.

Some models will turn out to be much better at jobs I didn't expect.

And some workflows that look brilliant on paper will probably waste enormous numbers of tokens without producing much value.

That's part of what makes this interesting to me.

I'm not trying to create the perfect AI architecture.

I'm trying to discover what happens when I stop treating these systems like websites and start treating them like resources I manage.

Token Maxing, Revisited

Which brings me back to my ridiculous phrase.

Token maxing.

It sounds like trying to burn through as many tokens as humanly possible before the billing cycle resets.

That's not what I mean.

What I'm really trying to maximize is leverage.

If I'm paying for several extremely capable AI systems, I want those systems doing useful work.

I want the security auditor auditing while I'm coding.

I want the operational agent handling recurring work while I'm doing something else.

I want local compute taking workloads that make sense locally.

I want one AI challenging another AI's conclusions.

And I want the results flowing back to me at the points where human judgment actually matters.

The scarce resource in that system isn't necessarily tokens.

Increasingly, it's my attention.

That's what I'm actually trying to optimize.

The Experiment Is Just Starting

The 114-repository security audit gave me something tangible.

It took this idea out of the realm of diagrams and AI-agent hype and turned it into an actual experiment.

I gave one AI a large assignment.

I established boundaries.

I let it work unattended.

It produced an artifact I can inspect.

Now another AI can challenge its findings.

Another can potentially implement validated fixes.

Another can review those fixes.

And I remain responsible for deciding what actually happens.

There are still a lot of questions I want to answer.

• How accurate were those 20 findings?
• How many of the three Critical findings survive independent review?
• How many are false positives?
• How deeply did Gemini actually inspect all 114 repositories?
• Where did it perform particularly well?
• Where did it fail?
• Which tasks genuinely benefit from running for hours?
• When does cross-model validation improve quality?
• When is it just expensive redundancy?
• What should Victor eventually be allowed to orchestrate?
• What belongs in the cloud?
• What belongs on my local AI box?
• And where should I deliberately keep a human in the loop?

I don't know all those answers yet.

That's precisely why I'm continuing the experiment.

Maybe “Which AI Is Best?” Was Never the Interesting Question

I still enjoy model comparisons.

I'll still test a new Claude release against ChatGPT.

I'll still see whether Gemini handles something differently.

I'll still experiment with local models.

That's part of the fun.

But I'm becoming less interested in declaring a winner.

Because I'm starting to suspect the real advantage won't come from discovering the single best AI.

It will come from learning how to combine them.

A coding model doesn't need to be my researcher.

My researcher doesn't need to be my operational assistant.

My operational assistant doesn't need to generate images.

My local model doesn't need to outperform a frontier model.

And the AI that discovers a vulnerability doesn't necessarily need to be the AI that fixes it.

They need roles.

They need boundaries.

They need ways to hand work to one another.

They need independent checks.

And they still need someone deciding what they're ultimately trying to accomplish.

A few days ago, I thought I was just trying to get more value out of a Gemini subscription I wasn't using enough.

Then I pointed it at a directory full of code.

It found 114 repositories.

I told it to audit them.

Eventually, I went to sleep.

My security auditor didn't.

When I came back, there was an enterprise-style security dashboard waiting for me.

And somewhere in that process, the question changed.

I stopped asking:

Which AI is best?

Now I'm asking:

What job should I give each one?

I have a feeling that's going to be a much more interesting question to spend the next few years answering.