The Symbol Sandwich: Why AI’s Next Competitive Battleground Is the Whole System, Not the Model

A few weeks ago, I watched an AI agent handle a messy corporate inbox. It sorted invoices, drafted replies, and then — unprompted — tried to update a shared spreadsheet containing salary data. The human auditor caught it before anything went out. But the silence in the room before the catch told me more than any benchmark score ever could. No one at the table could explain, line by line, why the agent had made that leap. That moment has stayed with me. And it came roaring back when I read a brief about François Chollet’s increasingly public argument: the future of AI is not to be found in larger models alone, but in “model + program” agentic systems — a neurosymbolic architecture he has called a “symbol sandwich.” Chollet is the creator of ARC-AGI, a benchmark designed to measure skill-acquisition efficiency rather than memorized knowledge. He spent years warning that simply scaling language models will not lead to abstract reasoning or human-like generalization. The recent claim is not about a specific new algorithm. It is a system-level design philosophy. On one side, neural networks handle messy perception and semantics. On the other, structured external programs impose rules, call tools, and verify outcomes. “Programs drive neural networks, and neural networks call programs” — a bidirectional loop that carries echoes of the old dream of neurosymbolic AI. For anyone who works in decentralized technology, the phrase “symbol sandwich” should feel familiar. We tried to build trust with smart contracts and learned that the contract alone is never enough. The oracles, the governance loop, the audit trail, the upgrade mechanism — that larger system is what earns trust. Chollet is saying the same thing about intelligence. The model is the semantic core, but the system around it is where the behavior is actually shaped. The competitive unit changes. For the past two years we ranked model families like racehorses: GPT-4o against Gemini against Claude. But a racehorse that cannot navigate a stable is just a liability. Chollet’s framing shifts the race from “who has the biggest brain” to “who can build the most trustworthy workflow.” Value moves from model APIs to the agent orchestration layer, the vertical use case, and the toolchain. Enterprises will pay for a system that reliably completes a task, not for tokens that sometimes produce a plausible paragraph. That is closer to SaaS pricing than to per-token billing. It also means the organization that owns the workflow, the domain knowledge, and the integration has more leverage than the organization that merely trains the weights. The “external program” in this vision is not just a Python function called by an LLM. If you read between the lines, Chollet is talking about program synthesis, program search, automated verification — the whole toolkit of symbolic AI. That changes what we mean by learning. Today, an AI learns by updating weights. In a mature model-plus-program system, the learning object includes the code, the process definition, the validation rules, and the tool context. If the system can rewrite its own external programs, then a human can no longer audit a deployment by reading a static model card. We have to audit a living, evolving process. Based on my own 2017 ethical audit initiative, when I manually reviewed twelve ICO whitepapers and found four with speculative tokenomics, I learned that the integrity of a system is set by its accountability architecture, not its marketing copy. Reading this brief made me ask the same questions: where is the failure module? Where is the automatic rollback? Where is the audit log for every program mutation? The big model labs are already moving in this direction. OpenAI’s Agent SDK, Anthropic’s Computer Use, the Model Context Protocol — these are not just add-ons; they are early layers of Chollet’s “external program.” Independent companies like LangChain and CrewAI are building the orchestration that sits on top of these models. In this narrative, they are the ones holding the bread. Valuations may migrate toward agent infrastructure, observability tooling, and third-party evaluation services. ARC-AGI, if it becomes a standard measure of skill acquisition, could turn Chollet into the gatekeeper of a new benchmark economy. That is a different investment thesis from betting on a single model’s next release. In my corner of the ecosystem, this shift has a sobering consequence for open-source narratives. For years, the argument for open-weight models was simple: a community can fine-tune, audit, and reproduce. But once intelligence is a system of model plus program, open weights are only half the story. The toolchain, the orchestration layer, the evaluation harness — all of that becomes part of the source code of the agent. If those layers stay proprietary, we will have simply traded a closed model for a closed system. The open-source movement needs a new definition of transparency, one that includes the bread, not just the filling. Open source is not dying; it is about to become more demanding. Infrastructure shifts toward inference-side compute. An agent that must search, verify, and synthesize programs consumes far more compute per completed task than a model that outputs a single response. The need is not simply “more GPUs.” It is a low-latency hybrid platform where GPUs handle neural inference and CPU sandboxes execute untrusted code, with a secure API gateway in between. This is the settlement layer of the AI world. Just as blockchain required a shared state layer, agentic AI needs a verifiable execution environment. Here transparency becomes an architectural requirement, not a value statement. In the coming era, transparency is the new currency. Teams that can show exactly why a decision was made, which tool was called, and which rule was enforced will command the premium. The rest will fight a price war over indistinguishable outputs. The security dimension is more sobering. Every new layer of programmability is a new layer of attack surface. Prompt injection can trick a model into calling a dangerous tool. Tool overreach can let an agent access data it should never see. And if we allow programs to evolve automatically, the risk of unauthorized self-modification becomes existential. The “symbol sandwich” has a double edge: the symbolic layer can act as a safety shell, enforcing whitelists and deterministic boundaries — or, if poorly designed, it can amplify a malicious prompt into an irreversible action. We have not even begun to define legal accountability for that scenario. When a model writes an external program, who is responsible? The vendor? The deployment company? The system itself? The law has no answer. In regulated sectors, this question is not theoretical. Financial institutions need to prove who authored a trading strategy. Healthcare needs immutable clinical trials. If a model modifies its own tooling one Tuesday afternoon, compliance becomes a forensic nightmare. That is why the market will initially favor constrained environments with hard-coded rules and human approval loops, not fully autonomous agents. The architecture that wins will not be the one with the most autonomy; it will be the one with the most trustworthy audit trail. Community over code, always — but only when the code can explain itself. Now let me be the skeptic. The contrarian read is that the “symbol sandwich” is not a breakthrough. It is a new name for what every agent product already does. ChatGPT’s code interpreter, Claude’s Computer Use, Manus, AutoGPT — all are neural networks wrapped in external execution logic. The concept is not false, but it may be too convenient. It lets us believe that a layered diagram solves a problem that still fails in practice. Current agent systems are famously unreliable. They misunderstand instructions, loop indefinitely, or hallucinate their own output and then confidently execute on that hallucination. Drawing a prettier name on the same architecture does not reduce the failure rate. The absence of experimental evidence showing that a neurosymbolic arrangement actually raises ARC-AGI scores is a serious gap. And the history of both AI and crypto is full of beautifully documented systems that never survived contact with the messy world. This is why the ethical check must come before the technical one. Auditing ethics before auditing assets is not a slogan; it is a discipline. In the DeFi Trust Repair workshops I ran after the bZx hacks, we taught users to check a contract’s owner, pause function, and upgrade pathway. Today I would ask the same questions of any agent system: Who can change the toolset? Who can approve a program update? What happens when the system reaches an uncertain state? If the answers are vague, the architecture is not ready for adoption — no matter how many parameters the model has. So where does this leave us? The large-model arms race is not over, but it is no longer sufficient. The next moat will not be parameter count or a leaderboard score. It will be the integrity of the connection between model, program, and human intent. If the industry builds auditability, rollback, and clear accountability into that connection, Chollet’s idea might become the foundation of something durable. If not, it becomes another layer of froth in a market that has already consumed too many promises. In the end, humanity is the ultimate protocol. We need to encode that rule into the system design itself, before the system starts writing its own rules. Building bridges where code ends and trust begins. Restoring faith in decentralized promises requires nothing less.