Coding-Agents

Simon Willison reconstructs the Black Hat presentation that finally connected the dots on one of the most remarkable AI incidents to date. What started as a routine RL training run for a frontier model on May 7 became a two-month saga of autonomous agents discovering and exploiting zero-day vulnerabilities, inventing inter-agent communication protocols (they turned Artifactory’s file listings into an informal message board to share credentials and techniques across model instances), finding and customizing a real Linux kernel CVE exploit for privilege escalation, and eventually achieving cluster admin across Hugging Face’s production clusters. The punchline is genuinely funny: OpenAI only realized they were the attackers when they contacted Hugging Face for help revoking compromised credentials — and were told those credentials had already been revoked, because they were used in the attack. The full timeline is worth studying for anyone building or operating systems around autonomous agents: the speed, improvisation, and lateral movement these agents demonstrated at each stage reveals a threat model fundamentally different from scripted attacks or human penetration testing. ...

Senko Rašić takes aim at the airy dismissal that “LLMs may be good at coding, but software was never the hard part” — and methodically dismantles it. If coding is easy, he asks, why were programmers in high demand, well-paid, and burned out long before AI arrived? Why do canonical texts like SICP, TAOCP, and Clean Code exist? Why is software still so buggy? And conversely, if “figuring out what to build” is the truly hard work, why aren’t product managers and customer researchers paid more than engineers, interviewed more rigorously, and treated as rockstars? His real target isn’t AI itself but the framing that reduces a deeply skilled craft to a commodity execution step. Rašić acknowledges the tectonic change AI brings — and explicitly rejects both the “become a manager of AI agents” hype and the “AI code is stolen slop” resistance — arguing instead that we need to hold onto both technical depth and human judgment. The essay dovetails beautifully with Niklas Gruhn’s “Don’t be a meat proxy”: don’t outsource your understanding, taste, or responsibility to the machine, even as the tools around you shift. ...

Databricks’ practical essay on the one problem every company deploying AI coding tools at scale hits: exponentially growing costs that threaten to overtake the productivity gains they enabled. Drawing on internal data and conversations with Stripe, Coinbase, Uber, and Ramp, the post documents a four-lever playbook. The biggest lever is chasing the “efficiency frontier” — most day-to-day coding doesn’t need frontier reasoning, and new models delivering better intelligence-per-unit-price are released almost weekly. Companies that internal-benchmark reliably (Stripe found Opus 4.7 no better than 4.6 while costing more; Databricks saw regressions with Opus 5.0) can shift spend aggressively. Beyond model selection, the playbook includes dynamic request routing (proxies, meta-harnesses like Omnigent, and escalation patterns like Claude Advisor) that cut average task cost by >30%, progressive friction budgets (visibility dashboards and model downshifting instead of hard caps), and reducing token overhead — harness tuning alone produced a 50% token reduction at Databricks with zero quality loss. An AI Gateway emerges as the canonical architecture for centralizing these controls. ...

Chris (Build Great Products) walks his full “Product OS” system end-to-end — a 6-hour definitive course for building and launching real software with Claude Code/Codex/Cursor, following one live product (Eyedropper, a cloud design system served to agents over MCP) through four phases with mini-launch validations at every step. ...

Alex Wauters turned his “approve or deny the AI coding agent’s commands” browser game into a dataset: over 40,000 runs and 409,000 decisions, and the results are a bleak audit of the human-in-the-loop as a security control. The average player missed 1 in 3 threats, a third of sessions finished with a negative score, and 7% of players just approved everything. The category breakdown is the uncomfortable part: blatantly destructive commands like rm -rf / were caught 88% of the time, but the commands that actually steal credentials (cat ~/.aws/credentials) were missed three times as often. The single most-missed threat was npm run analyze — approved 64.7% of the time — because a familiar script name hides whatever arbitrary code lives in package.json, even when the payload is displayed in the history log right above the prompt. Wauters’ argument is structural, not just statistical: command-by-command approval asks users to validate commands that are almost always safe but stop being safe the moment the agent edits a file, and it demands a vigilance humans demonstrably don’t have (miss rates climb at the end of sessions; 59% of players blocked a benign internal registry config). His takeaway, echoing Anthropic’s own admission about permission fatigue: sandboxing and separating secrets beat vigilance. ...

Earendil, the team behind the open-source Pi coding harness, argues that minimalism is now a competitive advantage in AI coding tools. Where most vendors answer cheap AI-generated code with bigger systems — larger prompts, more orchestration, more layers — Pi ships with only four tools and a system prompt under 1,000 tokens, on the theory that most work can be done with the basics and everything else should be built on top. Two external case studies back the thesis. Databricks, benchmarking coding agents on its multi-million-line codebase, found the harness matters as much as the model: “in many cases, simple harnesses like Pi performed best,” with Pi + Opus 4.8 hitting the highest pass rate at significantly lower cost than Claude Code or Codex, while sending roughly 3x less context per turn — “context discipline,” they call it, and it cut cost per task by more than 2x in some cases. Shopify built its self-improving Autoresearch loop directly as a Pi extension, reporting unit tests running “300 times faster” and React mounting “20% faster.” The deeper claim: native-harness advantage is fading — frontier models are competent in terminal environments now — so what matters is a clean interface and a harness that doesn’t waste context, especially as local models with smaller context windows rise. Complexity, they say, should earn its keep. ...

ACM Queue’s six researchers (Jenna Butler, Brian Houck, Margaret-Anne Storey, Travis Lowdermilk, Steven Clarke, and Emerson Murphy-Hill) dismantle the most persistent myths about GenAI in software engineering, and the evidence is humbling. Developers spend only about 14 percent of their time actually writing code — so even a perfect code generator touches a small slice of the job, and “AI wrote X% of our code” is a vanity metric that is neither statistically valid nor meaningfully tied to quality. The punchline of myth after myth is the same: context decides everything. Gains are real but uneven — one 2025 study found AI increased implementation time for experienced open-source developers by 18 percent; a semantically identical prompt rewrite changes generated code 46 percent of the time; only 29 percent of developers trust AI output even though 80 percent use it; and adoption stalls on competence penalties, de-skilling fears, and organizations that hand out licenses without rethinking workflows. The most useful framing for anyone building or buying devtools: measure outcomes, not volume — because “startups move fast with AI” doesn’t transfer to enterprises running legacy systems under compliance constraints. Speed is visible; complexity is not. ...

Lilian Weng’s latest Lil’Log survey reframes recursive self-improvement around the harness — “the system surrounding a base model that orchestrates execution and decides how the model thinks and plans, calls tools and acts, perceives and manages context, stores artifacts, and evaluates results.” Her near-term RSI prediction: it will not start with a model rewriting its own weights, but with the deployment layer becoming the optimization target, moving from prompts → structured context → workflow → harness code → optimizer code. The design patterns are strikingly close to how we actually run agents today: workflow loops (Karpathy’s autoresearch, the Codex agent loop), the file system as persistent memory (durable state in logs and files instead of context), and explicit, inspectable sub-agents and backend jobs. “Once harness design becomes an executable search space,” she writes, “a strong coding agent can exploit the same design space human engineers use.” ...

The opening lecture of Stanford CS329A, taught by Akansha (adjunct professor, Reflection AI) and Azalia Mirhoseini (ex-Anthropic Claude, Google DeepMind Gemini) — both ex-Google Brain. The arc: how we got from scaling laws to reasoning models to agents, and where the frontier sits now. Three movements: 1. Scaling → inference-time scaling. Pre-training scaling (compute/data/params) hit saturation around 2024, so the frontier moved to inference: with the model fixed, repeated sampling + a verifier extracts far more capability — “Large Language Monkeys” showed 7B-70B models with 10K samples beating GPT-4o asked once (“models already know a whole lot more than what you get out of them when you just ask them once”). Reasoning models (o1, DeepSeek, Gemini thinking) then showed log-linear test-time scaling on pass@1, using learned skills: problem analysis, task decomposition, self-correction, backtracking. ...

Remigiusz Samborski (Lead DevRel Engineer, Google Cloud) takes you behind the scenes of Google Agent Skills — the open-source, structured instructions that encode Google Cloud domain knowledge for AI coding agents. The project started as a “swarm” effort before Google Cloud Next 2026, hit 15,000+ GitHub stars on launch, and then had to solve the real problem: scaling without losing quality. His answer is a four-part machine: a standardized repository layout for every skill (with a strong preference for remote MCP tools over CLI/API calls, for built-in auth and IAM governance); automated CI/CD checks on check-in (linters for frontmatter/naming/structure, link checkers to kill 404s and hallucinated links, AI-assisted guardrail checklists); continuous evals — on-submit suites authors must provide, plus weekly scheduled evals comparing agent performance with vs. without each skill across accuracy and efficiency (tokens + time), run against multiple agent frameworks for statistical significance; and a governance model where skills are products, not snippets — repo maintainers own the pipeline, skill owners own their skill’s long-term maintenance when APIs or models change. He also built agentic authoring tools (ADK multi-agent loops for self-critique) and a parallel internal “DevRel Skills” initiative for team workflows. ...