The Agentic Infrastructure Architecture of Joe Duffy and Pulumi

The intersection of Infrastructure as Code (IaC) and artificial intelligence has entered a transformative era, primarily driven by the strategic vision of Joe Duffy, Co-Founder and CEO of Pulumi. For nearly a decade, Pulumi has operated on the premise that general-purpose programming languages are the optimal vehicle for cloud orchestration, a bet that is now yielding significant dividends as Large Language Models (LLMs) become central to technical operations. In the current landscape of July 2026, Pulumi is pivoting from traditional infrastructure management toward an agentic infrastructure era. This shift is characterized by the deployment of Neo, an in-house infrastructure agent capable of autonomous operation, and a suite of tools designed to remove the friction between AI agents and cloud environments. The objective is to move beyond simple code generation toward a future where AI agents drive the entirety of infrastructure operations, shifting the role of the human engineer from a manual operator to a high-level supervisor of autonomous systems.

The Strategic Vision of Joe Duffy

Joe Duffy serves as the Co-Founder and CEO of Pulumi, leading a leadership team that includes Co-Founder and Executive Chairman Eric Rudder, Chief Marketing Officer Michele Pilgrim, and Head of Product Tatiana Cooke. Under Duffy's leadership, Pulumi was launched as an open-source cloud development platform with the ambitious mission of enabling as many people as possible to harness the modern cloud. Duffy identifies a critical gap in the industry: while the raw capabilities of cloud platforms are growing at an unbelievable pace, they remain difficult to use for the estimated 20 million developers in the industry.

Duffy's approach to this problem centers on the belief that the cloud should be programmed using real, general-purpose languages rather than domain-specific languages. This philosophical choice has created a unique synergy with the rise of agentic AI. Because LLMs are trained on massive repositories of production-grade Python, TypeScript, and Go, they possess a high degree of fluency in these languages. In contrast, they struggle with HashiCorp Configuration Language (HCL), the foundation of Terraform, because HCL examples in the public domain are often limited to tutorials rather than complex, real-world production systems. By aligning Pulumi's core architecture with the languages LLMs understand best, Duffy has positioned Pulumi as the native infrastructure layer for the AI agent era.

Neo and the Agentic Infrastructure Loop

The centerpiece of Pulumi's current evolution is Neo, the company's proprietary infrastructure agent. Launched in September 2025, Neo is designed to handle the complex, long-horizon, and high-blast-radius work that typically exhausts human engineers. The agent is not merely a chatbot but an operational entity capable of executing changes across cloud environments.

One of the most significant applications of Neo is in the realm of compliance and large-scale remediation. In one instance, a healthcare customer preparing for HITRUST compliance certification discovered 400,000 violations within their policy framework. Given a board deadline of less than one year, the task was viewed as impossible for a human team. Neo was deployed to address these violations, demonstrating that AI agents can handle the scale of remediation that would otherwise lead to catastrophic project failure.

Additionally, Neo has proven its efficacy in migration scenarios. A customer successfully migrated 500 Terraform workspaces to Pulumi within a single hour using Neo. This capability is particularly relevant as many organizations reevaluate their infrastructure stacks following the IBM acquisition of HashiCorp.

Tooling for the Agentic Era

To facilitate the transition to agentic infrastructure, Pulumi has introduced several technical capabilities specifically engineered for AI workflows. These tools ensure that agents can operate without the constant intervention of a human in the loop.

The infrastructure for these agents includes:

Free, ephemeral Pulumi Cloud accounts. These accounts are designed for agentic workflows, allowing an agent to spin up a session without undergoing a traditional human sign-up process. These accounts expire after 72 hours, though they can be claimed by a human later to be converted into permanent accounts.
A specialized npm package. This allows for one-shot invocation of the Pulumi CLI via npx pulumi <anything>, which removes the need for the binary installation steps typically required by humans.
The pulumi do command. This is a new imperative verb in the CLI that allows an agent to provision a single cloud resource without the need for scaffolding. For example, running pulumi do create eks:Cluster will create an Amazon EKS cluster. This method skips the project structure, meaning the agent does not have to infer directories, files, or tooling versions, although the operation remains stateful and subject to the standard policy framework.

CLI Expansion and Machine-Readable Output

Pulumi is aggressively expanding its CLI to mirror the capabilities of the Pulumi Cloud web console. By bringing over 30 features to the CLI, Pulumi ensures that agents have the same visibility and control as a human using a GUI. These features include:

Change history.
Drift detection.
Audit logs.
Secrets management.
Policy enforcement.

Joe Duffy compares this evolution to the GitHub gh CLI, noting that agents naturally gravitate toward CLI tools. To further this, the Pulumi CLI now emits JSON output and structured errors. This is critical for agentic workflows because it allows the AI to parse responses programmatically and iterate on failures without human guidance.

Integration and Surface Area Expansion

Pulumi is moving Neo out of the isolated cloud console and integrating it into the primary environments where developers and operations teams already operate. This expansion increases the surface area where AI can provide value.

The integration points include:

Local Terminal. A new pulumi neo command allows the agent to run directly from the developer's terminal. This provides Neo with direct access to local tools and the developer's source tree, maintaining the same agentic loop found in the cloud version.
GitHub. A Neo GitHub App allows teams to invoke the agent via @neo on pull requests. In this capacity, Neo can investigate failed deployments, propose specific fixes, and review changes alongside human collaborators.
Slack. A Neo Slack App brings the @neo invocation into communication channels, allowing the agent to participate in incident threads and infrastructure conversations in real-time.
Read-only Sessions. To mitigate risk, Pulumi provides read-only Neo sessions. These are used for lower-stakes reporting and compliance checks where the agent is confined to inspection and cannot modify the infrastructure.

Day 2 Operations and the Neo Integration Catalog

Beyond the initial provisioning of resources, Pulumi is positioning Neo to handle "Day 2" operations—the ongoing maintenance, monitoring, and optimization of infrastructure. This is facilitated through the Neo Integration Catalog, which connects the agent to a wide array of industry-standard tools via remote MCP servers.

The Neo Integration Catalog includes connections to:

Atlassian.
Datagogy.
Honeycomb.
Linear.
PagerDuty.
Supabase.

Furthermore, the catalog includes a kubectl CLI integration, enabling Neo to act directly on running Kubernetes clusters. This allows for scheduled Neo tasks that can run on a specific cadence to perform:

Drift detection.
Dependency updates.
Compliance audits.

The results of these automated tasks are shipped as pull requests, allowing humans to review the agent's work before it is merged into production. Joe Duffy notes that the most valuable agentic work is often the "boring" kind, such as global updates to IAM policies or version upgrades. He cites a financial institution requiring the replacement of hundreds of thousands, or possibly millions, of IAM policies across multiple AWS accounts as a prime example of the long-horizon, high-blast-radius work that defines the next frontier of infrastructure.

Expanding Infrastructure Providers

Pulumi continues to expand its reach into specialized hardware and high-performance computing environments. The company has shipped its first infrastructure-as-code providers for:

NVIDIA’s AI Cluster Runtime.
CoreWeave’s GPU platform.

These providers are specifically targeted at AI labs and organizations running massive training and inference workloads, ensuring that the underlying GPU infrastructure can be managed with the same agentic efficiency as standard cloud resources.

Organizational Structure and Governance

The execution of this agentic vision is supported by a robust leadership and governance structure. The executive team is led by Joe Duffy and Eric Rudder, with operational oversight provided by:

Casie Snyder (Head of People).
Tim Riefke (Head of Finance).
Kathy Lalama (Head of Customer Engineering).
Craig Symonds (Head of Engineering).
Isaac Harris (Head of Revenue Strategy and Operations).

The strategic direction is further guided by a Board of Directors comprising experienced venture capital leaders:

S. Somasegar (Managing Director, Madrona Venture Group).
Sheila Gulati (Managing Director, Tola Capital).
Stacey Giard (Principal and COO, Tola Capital).
Sabrina Albert (Partner, Madrona Venture Group).
Aaron Jacobson (Partner, NEA).
Scott Sandell (Managing General Partner, NEA).

Analysis of the Agentic Shift

The transition toward agentic infrastructure represents a fundamental change in how cloud resources are managed. By prioritizing general-purpose languages, Pulumi has created an environment where AI agents can leverage their training on production-grade code to execute complex tasks. The introduction of pulumi do and ephemeral accounts removes the "human" overhead of account creation and project scaffolding, which were previously bottlenecks for AI.

The impact for the user is a shift from "writing code to build infrastructure" to "directing an agent to maintain infrastructure." The ability to handle 400,000 compliance violations or migrate 500 workspaces in an hour suggests that the scale of AI-driven infrastructure is orders of magnitude greater than human capacity. The primary risk—the "high-blast-radius" nature of these changes—is mitigated by Pulumi's insistence on maintaining a stateful policy framework and integrating the agent into existing human review cycles, such as GitHub pull requests.

The "boring" work of Day 2 operations, which previously led to technical debt and security vulnerabilities due to human neglect, is now programmable. By automating drift detection and dependency updates through the Neo Integration Catalog, Pulumi is effectively turning infrastructure maintenance into a background process. This allows engineers to focus on architecture and strategy rather than the repetitive toil of IAM policy updates or version migrations.