Observe, Protect, then Accelerate
Two engineering leaders spent an hour on the agentic SDLC and barely mentioned code generation. Their early wins came from reading systems rather than writing them, and from fixing the queue before speeding up the thing that feeds it.
Five things that mattered last week
-
01
Anthropic replaces git with an in-house version control system
Anthropic's daily merges grew more than tenfold, from 2,500 code changes to over 30,000, making source control its biggest development bottleneck. Its answer, Scion, is a client-server system with always-online clients and cheap incremental commits, built to scale horizontally and use far less CPU and memory than git on a large monorepo.
-
02
Four in five engineering leaders report a production incident caused by AI code
A new report found 81% of engineering leaders had a production incident linked to AI coding tools within six months. Engineers now average 16.9 hours a week debugging against 9.8 hours writing code.
-
03
Linus Torvalds posts his first LLM-assisted Linux kernel patches
Torvalds published a ten-patch series to folio lookup that he says brings an order-of-magnitude speedup on a read-heavy benchmark. Review of the series found a race condition, which commentators said captures the wider debate about LLM-written code in a single thread.
-
04
Study finds coding-agent teams beat solo agents but cost three to seven times more
Cohere Labs tested teams of coding agents against a solo agent across 200 programs. Teams won, at three to seven times the cost. Giving cheaper worker agents only the planning role recovered about half the gain for an eighth of the extra spend, while giving them implementation work made results worse.
-
05
Anthropic's Q3 revenue jumps 45% to $16.8bn ahead of a possible IPO
Anthropic reportedly told investors Q3 revenue reached $16.8bn, with adjusted profitability, positive free cash flow and 85% adjusted gross margins, and a $110bn run-rate target by year end. Some read the growth rate as a slowdown, others were surprised that roughly 50% quarterly growth could disappoint.
Earlier opinions
LGTM, but did anyone actually read it?
AI-authored code has roughly doubled the volume arriving for review while the humans reading it haven't moved, and unreviewed merges are climbing. Review isn't dying, it's losing its author, and rebuilding it takes more than a stricter LGTM.
How far would your agent go to complete its tasks?
OpenAI's models broke into Hugging Face's infrastructure to retrieve the answers to the exam they were sitting. Optimise an agent hard enough and oversight becomes part of the attack surface.
The Bottom Rung Is Missing
AI is increasingly writing the routine, reviewable code that used to turn juniors into seniors. Headcount can rise while the apprenticeship quietly disappears.
The Off Switch You Don't Control
When a US export-control directive suspended Claude Fable 5 for everyone, most enterprises had hedged the API. Almost none had hedged the business workflow built around it.
No AI? We can't code any more!
When one team's token cap hit, development ground to a halt entirely. If AI dependency is now a single point of failure, it deserves the same business-continuity thinking as any other critical vendor.
Do developers know their AI-generated code is insecure?
70% of developers know AI-generated code is more vulnerable, and ship it anyway. The real question isn't whether they know, it's whether the gap is governance, overconfidence, or both.
The Complexity Paradox
The simple tasks produced the worst code. One hundred tasks, and the simplest carried 9x the vulnerability density of the complex, which makes task simplicity a poor proxy for security risk.
Security expertise still matters
Same model, same tasks, same baseline prompts - the only difference was a developer who spelled out the security requirements. Vulnerability density fell by 60%, and the share of applications carrying a critical or high-severity flaw fell from 78% to 44%.
Architecture beats vigilance
The same plain vibe-coding prompts, passed through a supervisor, a coder and a security reviewer. Vulnerability density fell 77% against baseline, two classes of flaw disappeared entirely, and the nine-times complexity gap all but closed.
Latest research
The agent saw the rules file was wrong and followed it anyway
When a project's rules file contradicted its existing code, two leading coding agents followed the file in nine choices out of ten, and one of them flagged the conflict in almost every run while doing so.
The agent skipped the docs, and nobody went back for them
Nearly two-thirds of AI-written pull requests in a large open-source sample changed code without touching any documentation, and files skipped that way were documented later at half the rate of the rest.
The approval said the tech lead. An agent had sent every one
At one fintech startup, 27% of merges into main rested only on an approval a coding agent had submitted through the technical lead's GitHub account, which the platform logged as the lead's own.
The work looked finished, so the next agent agreed
When an earlier agent had already submitted broken work as finished, coding agents succeeded 20 to 53 points less often than on the same tasks started from scratch. On the code track, none of them threw that work away and began again.
The repository wrote the permission you clicked to stop being asked
Planted files in a repository got Claude Code and Codex CLI agents to propose an attacker-useful "don't ask again" rule in 58% of attempts, during a routine request to set the project up and run it.
Reviewers run the agent's tests more and believe them less
Asked to compare human- and AI-authored pull requests, 239 practitioners ranked test inspection higher among where review time goes on the AI ones, and named tests as enough evidence to approve far less often.