Justin McCarthy

Justin McCarthy is the founder and CEO of Diffusion. As CTO of StrongDM, he and the company’s internal AI team built a Software Factory where coding agents could rewrite a program from its specification. The team judged each version against the same question: could a user still get the expected result?

Before StrongDM, Justin managed engineering teams at Preact, Rafter, and CafePress. He co-founded StrongDM with Elizabeth Zalman and Schuyler Brown to help administrators manage access to sensitive databases. StrongDM gave them one place to see who still had access and to grant or revoke it. Justin spent about a decade there building security infrastructure for enterprises.

Testing what an agent builds

In 2025, Justin founded StrongDM’s internal AI team with Jay Taylor and Navan Chauhan. To evaluate agent-written code without reviewing every line, the team needed an independent check on user-facing behavior and a way to run that check repeatedly.

• Held-out scenarios. Each scenario described an outcome a user should expect. The team often stored scenarios outside the codebase, much like a holdout set in machine learning. This let the team use the same expectations to evaluate successive implementations, even when the code changed substantially.
• Behavioral replicas. The team’s Digital Twin Universe reproduced the behavior of external services such as Okta and Slack, including ways they could fail. The team could test how its software handled those failures repeatedly without hitting a live service’s rate limits or changing data in a customer’s account.

A passing test suite told the team about one run. Repeated trials let it estimate scenario satisfaction, the share of observed paths through a scenario likely to give the user an acceptable outcome.

From a written specification to a C11 implementation

StrongDM published Attractor, a set of natural-language specifications other teams can implement. They describe an engine for coordinating agents, the loop a coding agent follows as it works, and a common interface for calling different models.

Justin published Attractor-C, a C11 implementation of the orchestration engine. Each workflow is a directed graph written in DOT. Its nodes can prompt a model, run a tool, or wait for a person’s approval. Its edges show where work can branch, retry a step, or follow parallel paths. An engineer reading the workflow can see which steps an agent can take on its own and which require someone’s decision.

Using an existing application to judge its replacement

In Brownfield Factories, his planned AI Engineer CODE 2026 talk, Justin proposes using an application already in use to design checks for its replacement. The specification describes what the software should do. Telemetry shows how it behaves in practice. A team rewriting the application in Rust or Elixir can use both to test whether the new version preserves behavior its users rely on.

At Diffusion, Justin’s work on Demand Factories takes up the question that comes before a team writes a specification. As implementation gets cheaper, how does the team identify software worth building?