Two sentences buried in Block’s own documentation tell you more about Buzz than every launch article stacked together.
The first is in SECURITY.md. Channel membership is the only access control mechanism. There are no separate ACL lists, no capability taxonomies. If a principal is a member of a channel, human or agent, it can read and write there.
The second went up on Block’s engineering blog on July 29, written by Tom Brow on the Applied AI team. Buzz agents typically run on the same computer humans use, outside any sandbox, with permissions skipped, inheriting that machine’s files, skills, and credentials.
Read those together and the verdict writes itself.
The verdict: Buzz is the most genuinely interesting idea in team software this year, and you should not put it anywhere near a machine that matters yet. Stand it up in a lab, on a throwaway repo, with one narrowly scoped agent. Learn the model. Do not migrate your team.
Here is what earns that.
What Block actually built
Buzz launched July 21, 2026. It is a self-hostable workspace where humans and AI agents sit in the same channels, released under Apache 2.0 at github.com/block/buzz. Jack Dorsey announced it on X as model-agnostic, decentralized, self-sovereign, and open source, built explicitly to reduce Block’s dependency on Slack and GitHub.
Underneath, it is a Nostr relay written in Rust, sitting on Postgres, Redis, and S3-compatible object storage. Every message, reaction, workflow step, review approval, and git event is a signed event in one log. Same shape and same identity model whether the author is a person or a process.
The agent story is the actual product. You add an agent to a channel the way you add a coworker. It can open repos, send patches, review code, run workflows, edit canvases, drop into voice huddles, and pull other people in. Claude Code, Codex, Block’s own goose, or anything speaking the Agent Client Protocol works. Change your model or your harness and the project keeps its identity and its history.
The part that is genuinely good
Most agent tooling today runs on borrowed credentials. Your GitHub token. Your Slack identity. A shared company key. The log says you did it. You did not.
Block’s fix is clean. Each agent gets its own key. The owner signs a narrowly scoped authorization, and the agent then signs its own work under its own identity. Block made a deliberate call here that I have not seen elsewhere: authorization does not erase authorship. The agent stays the author, and its credential proves who authorized it and under what conditions. If an agent key leaks, you revoke the agent without touching the human identity behind it.
That is a real answer to a real problem, and I do not want to undersell it. Anyone who has tried to reconstruct which bot did what three weeks ago knows exactly why this matters.
The part the marketing walks past
Cryptographic identity tells you who acted. It does not tell you what they were allowed to do. Those are two different problems, and Buzz has shipped a strong answer to the first one and a thin answer to the second.
Go back to those two sentences. An agent running unsandboxed on a real laptop, holding that laptop’s real credentials, with the permission checks skipped. The only thing standing between that agent and a destructive instruction is whether the person giving the instruction is in the channel. Block says it plainly: security rests entirely on restricting who can tell it what to do.
João Queirós, in the deepest independent hands-on review published so far, put it in one line. Channel membership is not fine-grained tool authorization. He is right, and Block’s own security policy agrees with him.
There is a second caveat worth pulling out. The audit log chains every entry to the previous one with a SHA-256 hash, and SECURITY.md is honest that the chain is keyless, which makes it tamper-evident but not tamper-resistant. It catches accidental corruption or a single edited row. Somebody with database write access can recompute the whole chain after editing it. Block describes the log as designed for SOX-grade compliance and eDiscovery. Those two statements sit in the same document, about six paragraphs apart, and the gap between them is where your compliance team is going to live.
What is actually shipping, as of today
The desktop app is at v0.5.2, cut on July 29. It launched in the 0.4.x range eight days earlier, which is a release cadence somewhere between impressive and alarming depending on whether you enjoy reading changelogs at 11pm.
The repo has crossed roughly 19,000 stars with about 1,900 forks and more than 2,000 commits. It also has over 500 open issues and close to 700 open pull requests, which is the honest other half of that number.
iOS and Android landed on July 29. The mobile app does not host agents, it signs messages and talks to relays directly, and you pair it by pointing your phone at a QR code in the desktop app, so it reuses the same keypair. Block says it ships with no analytics SDKs and strips geolocation metadata from image uploads before they hit the relay. Push runs on a draft standard Block wrote called NIP-PL, designed so relays never see your device token and the push gateway never sees your keys or your content.
Worth flagging: the repo README still lists mobile clients under “being wired up.” The README is lagging its own shipped product by two days, which tells you something about the pace.
The thing nobody in the coverage mentions
Block cut its headcount from over 10,000 to under 6,000 in February, a reduction of more than forty percent, and posted a Q1 2026 net loss of $308.7 million on $6.06 billion in revenue. Then it open-sourced the tool its remaining engineers use to coordinate with agents.
I am not going to tell you what to make of that. I will say the sequence is worth holding in your head while you evaluate the product, because Buzz is not a side project from a company with money to burn. It is infrastructure a shrinking engineering org built to survive its own restructuring, and that is either the strongest possible endorsement or the loudest possible warning.
So what
Do this. Clone it and self-host. You need Docker plus Rust 1.88, Node 24, and pnpm 10, or just use the bundled Hermit toolchain. Run one throwaway repo, one agent, one workflow. The question to answer is not whether the agent does good work. It is whether putting humans and agents in the same persistent room actually improves how your team decides things.
Skip this. Do not point Buzz at anything holding real credentials, customer data, or regulated records. Not yet. The relay does not enforce TLS by default, that is an intentional deployment choice, and it is your job to terminate it properly.
Wait on this. Hosted pricing is unannounced. Fine-grained tool authorization does not exist. The compliance story is unfinished by the reviewers’ account and pre-1.0 by Block’s own supported-versions table. All three need to move before this belongs in production.
One sentence to steal. Cryptographic identity tells you who acted, not what they were allowed to do, so ask any agent vendor which of those two they actually shipped.