July 2026 Summaries

The text explores the impact of AI coding agents on engineering efficiency, emphasizing that the choice of AI model significantly affects productivity. It highlights a common scenario where engineers choose free or cheaper models to save costs, only to spend more time correcting errors, ultimately making it costly in terms of valuable engineering hours. The narrative describes a spectrum of AI adoption among organizations, from those rejecting AI to those using it fully autonomously, with most teams operating somewhere in the middle. Key anti-patterns identified include the reliance on token-free models, resulting in correction spirals, and the tendency for engineers to bypass restrictions to access better models, leading to inefficiencies and shadow usage. The text argues that model choice should not be a decision left to individual engineers under pressure but should be an organizational-level decision to optimize productivity. It underlines the importance of using mid-tier models for routine tasks and stronger models for critical decisions, suggesting that this approach can enhance speed to market and retain top talent without significantly increasing costs.

In recent years, both defenders and threat actors have gained advanced capabilities to identify vulnerabilities, leading to a significant increase in published Common Vulnerabilities and Exposures (CVEs), with a notable spike post-November 2025. This surge indicates not just an increase in collaboration but a leap in detection technology, which finds vulnerabilities quickly and efficiently. The real challenge now lies in addressing these findings, as traditional security practices struggle to keep pace with the rapid rate of discovery. While automated systems can identify vulnerabilities, the current process of fixing them remains linear and separate from development workflows, leading to backlogs and inefficiencies. The solution proposed involves integrating deterministic testing and verification directly into the development process, ensuring vulnerabilities are addressed in real-time and with oversight, rather than relying on out-of-band, probabilistic methods that create additional queues. This approach promises a more efficient and accountable security posture by embedding security checks into daily workflows, allowing organizations to manage threats at the same rate they are identified.

StackHawk's approach to applying security fixes using an agent emphasizes maintaining the same level of scrutiny and process rigor as human-written code changes, ensuring that the introduction of these fixes does not bypass established protocols such as code reviews and integration tests. The agent identifies vulnerabilities through observed behavior in running applications and applies patches locally, which are then confirmed through a rescan to ensure the specific vulnerability is closed. This rescan addresses a critical gap in test coverage that traditional integration tests may not cover, as they are typically focused on expected behavior rather than unforeseen vulnerabilities. The process is designed to ensure that the security gap is addressed without altering the existing pipeline, allowing teams to test this approach on individual findings to assess its effectiveness. This method highlights the importance of distinguishing between confirming the closure of a vulnerability and ensuring that the overall application functionality remains unaffected, which is verified through the usual code review and testing processes.

GitHub's recent redesign of its pull request dashboard addresses the bottleneck created by AI-generated code, which increases the volume of pull requests but also the time needed for their review. While AI tools like Copilot have significantly increased the number of pull requests and their size, they have also led to slower end-to-end cycle times due to review queues. The proposed solution is a better triage system, but the real issue lies in the generation of separate security queues, which can exacerbate the problem by decoupling fixes from their context, leading to unowned backlogs and potentially introducing new vulnerabilities. The text argues for addressing security issues within the development loop itself, allowing fixes to be made before pull requests open, which would prevent the creation of additional queue items and enable human reviewers to focus on judgment calls rather than cleanup tasks. This approach is exemplified by Wingman, which integrates a scan-fix-verify loop in the coding process to resolve vulnerabilities, thereby enhancing the efficiency and efficacy of the review process by keeping security issues from becoming separate artifacts in the pull request queue.

The text discusses a methodology for evaluating changes to AI agent skills used in security tools, emphasizing the importance of evidence-based improvements rather than relying on subjective feelings of enhancement. The process involves formulating a hypothesis about the expected behavior change, then running controlled experiments across multiple real-world code repositories to isolate the impact of the skill change. By using an unbiased grading system that includes a skill-blind judge and deterministic process-checks, the methodology ensures that any observed improvements are genuine and not influenced by subjective biases. This rigorous approach helps maintain trust in the security tool by ensuring that skill enhancements lead to measurable and reliable outcomes, as demonstrated with a recent skill rewrite that improved the AI's ability to use documentation for application discovery without sacrificing correctness.