{"slug": "googles-elephant-goldfish-model-spec-before-code", "title": "Google’s Elephant-Goldfish Model: Spec Before Code", "summary": "Google released the Elephant-Goldfish Model (EGM), a free Apache 2.0 open-source plugin that forces AI coding agents to write a specification and have it attacked by separate zero-context reviewer agents before any code is written, and Google says it is already running inside thousands of its engineers' daily workflows. The plugin is available for Claude Code, Codex CLI, ChatGPT Desktop and Antigravity, and installs via a marketplace command in under a minute. Google's move responds to findings from Georgia Tech, which scanned over 43,000 security advisories and found that 182 of 200 publicly deployed vibe-coded apps had at least one vulnerability.", "body_md": "AI coding agents have a well-documented flaw: they implement exactly what you describe, including every unstated assumption you didn’t know you were making. Google’s answer is a free, open-source plugin called the **Elephant-Goldfish Model (EGM)** — Apache 2.0, already running inside thousands of Google engineers’ daily workflows, and now available for Claude Code, Codex CLI, and ChatGPT Desktop. The idea is straightforward: before your agent writes a single line of code, it writes a spec. Then a completely separate, context-free agent attacks that spec cold. Only after that review can coding begin.\n\nThis isn’t Google solving a hypothetical problem. It’s a response to something developers are hitting in production. Georgia Tech [scanned over 43,000 security advisories](https://news.research.gatech.edu/2026/04/13/bad-vibes-ai-generated-code-vulnerable-researchers-warn) and found that 182 of 200 publicly deployed vibe-coded apps had at least one vulnerability. The issue isn’t code quality per se — it’s that agents implement without asking. Add CSV export and an agent will build it without asking who can export whose records. Those missing decisions get made eventually. You just find out about them in a pull request, a security audit, or worse.\n\n## Elephant Remembers, Goldfish Forgets — On Purpose\n\nEGM uses a three-role system. The **Elephant** is a long-context agent that holds your full project history and drafts the specification — it never writes implementation code. The **Goldfish** reviewers are stateless subagents: they see only the spec document and any referenced files, never the conversation that produced it. The **Engineer** (you) reviews the findings, resolves trade-offs, and approves before coding starts.\n\nThe Goldfish isolation is the actual innovation here. If a spec requires knowing the conversation context to make sense, it isn’t ready. By having fresh subagents review the document cold, EGM surfaces assumptions the Elephant baked in without realizing it. As one Google engineer put it on release day: “Goldfish = zero-context reviewers that attack the spec cold. Thousands of Googlers ship production code this way.”\n\nOne real limitation worth calling out: if your Elephant and all your Goldfish run on the same underlying language model, they share the same training-derived blind spots. EGM forces independent context, but it can’t force independent cognition when the model is the same. It’s still better than nothing — but don’t expect it to catch failures the model is universally bad at.\n\n## The Five Review Stages\n\nThe Goldfish reviewers run through five stages in sequence. First, an initial zoom-out: does the proposed solution actually address the stated problem? Second, a comprehension test: can a fresh reader explain both the proposal and the current system behavior without asking clarifying questions? Third, adversarial critique: where do assumptions fail, what dependencies are missing, what edge cases aren’t handled? Fourth, a second zoom-out after fixes: have the corrections introduced unnecessary architectural complexity? Fifth, implementation readiness: can a developer begin work without having to invent any decisions the spec left open?\n\nThe dual zoom-outs matter. It’s easy to fix problems in a spec and introduce new ones in the process. The intermediate review catches that before it reaches implementation.\n\n## Installing EGM\n\nEGM is a plugin, not a model — it runs on your existing agent and your existing quota. Installation takes under a minute:\n\n```\n# Claude Code\nclaude plugin marketplace add google/elephant-goldfish-model\nclaude plugin install egm@egm\n\n# Codex CLI\ncodex plugin marketplace add google/elephant-goldfish-model\ncodex plugin add egm@egm\n\n# Antigravity\nagy plugin install https://github.com/google/elephant-goldfish-model\n```\n\nOnce installed, the basic workflow is three commands:\n\n```\n/egm-brainstorm Add webhook delivery to this project.\n/egm-draft\n/egm-review design_draft.md\n```\n\nThe plugin includes seven skills: Brainstorm, Draft, Resolve, Bootstrap (generates docs for existing codebases), Review, Review Loop, and Drift Report. The **Drift Report** is underrated — it compares stored design documents against your current code to catch cases where implementation quietly diverged from the agreed spec. In practice, it identified a production bug where deleted products remained accessible.\n\n## When to Use It (and When Not To)\n\nEGM adds token cost and time. Each review spawns 15+ subagent runs. That overhead is worth it for features with permission boundaries, multi-module changes, or any decision that would be expensive to discover in a PR. It is not worth it for isolated bug fixes with a clear failing test, or for validating product ideas that haven’t been confirmed as worth building. If there are no real design questions on the table, you’re generating process overhead for no gain.\n\nThe cost math is reasonable. Rough estimate: 20 minutes of review plus agent usage costs around €36. If it prevents 45 minutes of downstream rework, you’re ahead. The [EGM repo](https://github.com/google/elephant-goldfish-model) explicitly recommends measuring actual findings and rework rates to validate whether it’s earning its keep on your projects.\n\n## The Bigger Picture\n\nEGM is the first production-tested, open-source formalization of something experienced developers have been doing manually for years: write the spec, then have someone else poke holes in it before anyone writes code. The difference is that EGM automates the adversarial review and enforces context isolation in a way that manual review rarely achieves. It hit 14,600 GitHub stars in its first week, which suggests the developer community recognizes the problem it’s solving.\n\nSpec-driven development won’t replace judgment. As analyst Charlie Holland noted in his [thorough breakdown of EGM](https://dev.to/piekwerk/googles-elephant-goldfish-plugin-5-stages-of-fresh-context-review-before-your-agent-writes-code-20e0): the model “quietly assumes the one thing it can’t supply — someone in the chair who knows when the elephant is wrong.” EGM gives you better-reviewed specs. It doesn’t give you better instincts. Those are still yours to bring. But if your team is shipping features with AI agents and skipping the design step entirely, EGM is probably the most useful thing you can add to your workflow right now.", "url": "https://wpnews.pro/news/googles-elephant-goldfish-model-spec-before-code", "canonical_source": "https://byteiota.com/googles-elephant-goldfish-model-spec-before-code/", "published_at": "2026-11-09 16:07:52+00:00", "updated_at": "2026-11-09 16:25:47.132932+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety", "artificial-intelligence"], "entities": ["Google", "Elephant-Goldfish Model", "Claude Code", "Codex CLI", "ChatGPT Desktop", "Antigravity", "Georgia Tech"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/googles-elephant-goldfish-model-spec-before-code", "markdown": "https://wpnews.pro/news/googles-elephant-goldfish-model-spec-before-code.md", "text": "https://wpnews.pro/news/googles-elephant-goldfish-model-spec-before-code.txt", "jsonld": "https://wpnews.pro/news/googles-elephant-goldfish-model-spec-before-code.jsonld"}}