Deep-dive research briefings on specific topics, newest first.
What happens downstream of authoring once coding agents stop being the bottleneck — test-impact analysis under 25x CI load, flaky-test policy when agents learn around flakes, review queues rebuilt as label protocols and merge queues, and a CI cost model in which the marginal pull request is nearly free
Four production accounts surfaced in one September week (three published that week, and DoorDash's August report through InfoQ's coverage) put numbers on the same shift: Anthropic's CI job volume up 25x in six months, Kiro addressing nearly two years' worth of backlog issues in two months and saying it generates PRs faster than its team can review them, GitHub landing 832,000 lines of Rust under what was primarily one supervising engineer, DoorDash cleaning flags at an average $4.79 in API cost per flag. Every team running agents at volume inherits the same downstream problem — the pipeline, the test suite, and the reviewers were sized for human typing speed, and the fixes are infrastructure, not prompts.
Execution-pattern routing as a harness design decision — when a draft-and-gate cascade beats one strong model, what the escalated model should inherit from a rejected draft, how a critique step interacts with judge anchoring, and whether to build the router or wait for the vendors now shipping it
GitHub now routes each Copilot request to a single-model, cascade, or critique workflow and reports two-thirds lower cost on one benchmark. Within the same few weeks, controlled studies measured the two things a router depends on: how much quality an escalated model recovers from a cheap draft, and how often a quality gate waves through a wrong answer. A team deciding whether to build this layer needs both numbers before the vendor's headline.
How first-party documentation becomes a supply-chain vector when the package or domain it names is later claimed by someone else — the llms.txt install study, the Clerk npx incident, the two papers that connect it to hallucination and self-authored skills, and what agent vendors enforce before an install today
A coding agent that follows an install command from a vendor's own docs is doing exactly what the docs were published for. When the name in that command is unowned, the first person to register it owns the agent's next install — and no sandbox, permission prompt, or registry cooldown shipping today checks the name before the package manager fetches it.
Three late-summer 2026 disclosures — Manifold Security's GitSpawn (a repository's core.fsmonitor runs attacker code through seven coding agents), Johann Rehberger's break of Claude Code's auto mode through a planted struct.py, and the When Context Gets Root paper on instruction privilege escalation — read as one attack class distinct from prompt injection: the harness, or the toolchain beneath it, grants ordinary setup material an execution trust nobody chose. The taxonomy of that material, which harness-level control closes each path, the vendor patch state after the September 1 retest, and why a command classifier that blocks dangerous-looking commands also blocked the agent's own cleanup.
Prompt-injection defenses assume the attack is an instruction the model wrongly follows. In two of the three cases here the model followed nothing: Git ran a config value, Python loaded a file from the current working directory. In the third the model did follow attacker text, but only after a harness relabelled it as the user's request. Every per-command control in the sandbox debate — classifier, approval prompt, the Bash sandbox — sits above the layer that executed, and the patches that shipped went into the plumbing rather than the model. A team running agents against repositories, archives, or delegated subagent tasks owns this class now, and the fixes are specific, cheap, and mostly not on by default.
The operational shape of autonomous offensive-security agents — which vendors run them, how they change disclosure pipelines and patch-cadence assumptions when discovery windows compress from months to days, and what defenders running public repositories should change first
The window between a vulnerability going live in a public repository and its autonomous exploitation has been measured in days. Patch-cadence and disclosure playbooks built for human attackers assume a reconnaissance lag that autonomous agents compress, at least for the pattern-matchable flaw classes they cover well. Teams running agents against public code need to treat the offensive-automation side of the ecosystem as a live operational input, not a research curiosity.
The claim that models keep absorbing agent-harness functionality into their weights — what has actually moved, what harness-sensitivity benchmarks show about how much the harness still matters, and how a team should depreciate harness investment against model release cadence
If the model absorbs the harness every generation, harness engineering is a wasting asset and teams should minimize it. If harness choice still swings aggregate benchmark scores by 20+ points, it is a lever teams underinvest in. Both claims have August 2026 evidence behind them, and the difference decides where an infrastructure team spends its next quarter.
Specification-first verification for review-free agent changes — what convergence against a frozen spec establishes and what it structurally cannot, read through a fully instrumented 189-file case study, SpecPath's specification-path sensitivity result, and RETRACE's issue-withheld patch verification
Teams are beginning to ship agent-written changes with no human reading the diff, substituting audits against a frozen specification for review. A fully instrumented case study of that trade prices it at $2,430 for a 189-file invariant migration — and its convergence criterion proves agreement with the spec, not correctness of the spec. Knowing which risks that verification stack covers, and which it cannot see by construction, is what separates a governed autonomy decision from an unexamined one.
Which human software-engineering practices — TDD, code review ceremony, commit discipline, pairing — carry measurable value into coding-agent loops, which are redundant with what the harness already provides, and what the replacement disciplines look like
Teams paste the human practice canon into agent instructions by reflex, and every prescribed ritual now has a token bill. The first controlled evidence prices TDD-in-the-loop at several times the cost for no measured gain, while field telemetry shows code review deteriorating under high AI adoption. Which practices transfer, which relocate, and which await instruments that don't exist yet is a live budgeting decision for anyone operating coding agents.
What containment discipline agent evaluation harnesses actually warrant — network egress, credential scoping, and whether third-party-built eval infrastructure is held to production standards — read off two frontier-lab disclosures where the breach originated inside the eval, not production
Three labs have now disclosed containment failures that started inside evaluation environments — most of them environments trusted precisely because they were evaluations. The eval is where the production safety layer is deliberately switched off, which makes the environment the only thing standing between a capability test and a real-world intrusion. Most teams running internal agent evals harden production and assume the test rig is contained. These postmortems show what that assumption costs.
The new enforcement point for AI data loss prevention: intercepting prompts and tool results inside the inference request path — what Anthropic's inference hooks and Azure's AI gateway tier can see, what they cannot, what a verdict costs in latency, and whether an LLM classifier at the boundary beats the regex DLP it replaces
Every organization running agents ships sensitive data toward a model many times per session. The enforcement point for stopping the wrong data is moving out of the network path and into the inference request itself, under the customer's own policy server. Whoever operates that boundary now owns latency, availability, and policy quality for every AI request in the org — and needs to know its enumerated blind spots before trusting it.
Sequence-aware authorization for agent tool calls — AWS's Dogwood extending Cedar with temporal conditions over an agent's event history, the MasuGate paper's formalization of stale authorization under concurrency as policy-state serializability, what policy over histories can express that point-in-time policy cannot, what it costs to evaluate against a growing event log, and which pieces a practitioner can adopt today
The rules teams most want to enforce on agents — approval before action, budgets across a session, ordering between tool calls — are properties of sequences, and the deterministic policy engines guarding agent tool calls have mostly evaluated one request at a time, with stateful exceptions confined to narrow cost budgets. Two independent August artifacts make history a general policy input; knowing what that buys, what it costs, and which parts are production-grade determines whether a team adopts a managed service, an open-source spec, or neither.
Whether agent benchmark scores support the capability claims made from them — protocol validity, runtime contamination and reward hacking in coding benchmarks, what the newer compound-reward evaluations actually measure, and how a team audits its own internal eval for the same exposures
Benchmark scores are the evidence teams actually use to pick a model, pick a harness, and justify the spend. A 2026 run of audits shows that a large share of that evidence measures retrieval, grader manipulation, or protocol slack rather than the capability being claimed — and that the inflation is worse on newer models, which is exactly the comparison procurement decisions turn on.
