Story Points Measure the Part Agents Made Cheap
Coding agents raised code output by about 30% without moving finished work, because review absorbed the gain. Sprint planning still prices the writing. Price the review instead.
8 min read
Writing
Core Web Vitals Worked Because of the Thresholds. Your Mobile App Doesn't Have Any
Web developers moving to React Native tend to port the metrics and leave the useful part behind. What made Core Web Vitals work was a contract of field data, a fixed percentile and a pass mark set outside the diff. Agents writing your app's code make that contract more important.
8 min readThe Claude Code Backdoor Didn't Need the Agent. It Needed Auto-Update.
Last week's trojanized Claude Code extension never touched a prompt, a permission or Anthropic's build. It came through a mirror marketplace on auto-update. The agent's install channel is now the softest part of your AI tooling, and nobody on most teams owns it.
8 min readThe Pager, Not the Reviewer, Decides Who Owns Agent-Written Code
An approved pull request proves someone read the diff. It doesn't prove anyone can debug it when it breaks in production. For code on a paged path, that second test should decide whether it merges.
8 min readThe Riskiest Line an Agent Writes in Your Expo App Is in app.json
In a React Native app, risk depends on which side of the native line a change lands, not on how big the diff is. When agents write the diff, that line has to be checked by a machine before a reviewer ever opens the PR.
7 min readYour Coding Agent Takes Orders From Every Folder Above It
The AGENTS.md hijack found in a Downloads folder last week isn't a Downloads problem. Instruction files are code that runs with whatever permissions you've already granted, and a pull request can plant one as easily as a browser can.
8 min readYour Leveling Matrix Still Grades the Work Agents Took Over
When commits per engineer can rise fivefold in six months, a career ladder built on delivery scope stops telling you who is senior. Promote on the judgment you can audit instead.
8 min readReact Compiler Removed Half My Re-render Bugs. The Other Half Aren't in Component Code
I measured eight common re-render causes with and without React Compiler, then gave the survivors to an agent. The compiler handles what's in the component. What's left is a data-identity bug in another file, and the Profiler's job is to tell you which one.
8 min readNext.js 15 Is Out of Support. Here's a Patch Policy for What Comes Next
Two critical advisories landed a week before Next.js 15's support window closed. A written patch policy turns the next one into a routine upgrade instead of a scramble.
7 min readOpenAI's Agents Didn't Go Rogue. They Did a Migration.
The headlines say AI agents disabled their own monitoring. The real lesson is duller and closer to home. Any agent cleaning up your code will delete a safeguard if nothing tells it the safeguard is load-bearing.
8 min read