Latest stories

Frederick P. Brooks Jr.’s Brooks’s Law holds that adding manpower to a late software project makes it later. Brooks formulated the idea in his 1975 book, The Mythical Man-Month, drawing on his experience managing IBM’s OS/360 project. The principle reflects coordination and onboarding costs, as well as tasks that cannot be parallelized. AI agents and large language models can eliminate some traditional delays because they can begin work immediately and do not require human meetings or workplace management. However, sequential work remains sequential: multiple agents cannot compress a task with unavoidable dependencies into less time. Human oversight is still required to define completion criteria, review generated code, detect hallucinations, integrate separate outputs, and coordinate work across a shared codebase. Uncoordinated autonomous agents can overwrite or duplicate one another’s work when assigned to the same codebase. Jan van den Berg argues that a modern version of Brooks’s Law is that adding agents to a project with unclear requirements produces the wrong answer faster.

Dan Luu argues that increasingly capable coding models let individuals build software projects that were previously too costly in time or expertise, while warning that fast generation does not ensure correctness, performance, or maintainability. He says he built a customizable regex engine, a faster ripgrep fork for his workloads, and a Rust-related build-speed tool in a low single-digit number of hours with AI assistance; he estimates these projects would previously have taken a year or more to reach “works for me” quality. He says newer models have also made it easier to implement techniques from papers and codebases in specialized areas such as board-game AI. Luu reports that GPT-6 Astra passed registered zstd implementation tests more than 99% of the time in his evaluations and cost about $1 per implementation, though he says more ambitious tasks such as IMAP and Pandoc remained useful tests. He advocates building systems with self-checking properties, including fuzzing, property-based testing, consistency checks, and formal verification, rather than relying on one-shot AI output. Yossi Kreining cautions that most users should moderate their ambitions because many problems lack clear pass/fail criteria and AI-generated systems can become opaque, brittle, and hard to maintain. Luu also says pgrust is not yet suitable as a primary production database, citing founder Michael Malis’s September 17, 2026 statement that its query engine still has regressions and unsupported complex queries.

A cluster of critical security disclosures in October 2026 highlighted how quickly vulnerabilities can move from discovery to attempted exploitation, particularly when AI models help researchers and attackers analyze code and develop proofs of concept. PHP2Shell, comprising CVE-2026-109618 and CVE-2026-109619, involved remote-code-execution flaws in PHP reportedly found by Calif and Wiz using GPT-5.6 Sol and Gemini 4 Argon. A leak accelerated public awareness before patches were available, and AWS reported observing attempts to exploit the flaws from October 17. Wiz estimated that affected PHP deployments could cover more than 70% of the internet. Other incidents included Mozilla’s October 20 blocking of eight eMudhra intermediate certificates after weak private keys were reported; eMudhra later said it would exit the global SSL/TLS certificate business. Railway disclosed possible access to and decryption of customer environment variables, while GitLab issued critical patches for multiple CVSS 10.0 code-execution flaws in October. LiteLLM said its compromised version 1.107.0 PyPI release and Docker images contained credential-stealing malware after an attacker used GitHub CLI credentials to run CI jobs. PingCAP disclosed unauthorized access to cloud resources as FulcrumSec claimed to have exfiltrated 10.6 TB of data. The incidents do not all have confirmed AI involvement, but they underscore shrinking response windows and the importance of patching, secret management, and coordinated vulnerability disclosure.

Anthropic and formal-verification company Theorem used Claude to generate machine-checkable proofs for security properties in open-source software at the RISC-V assembly level. Over several weeks, Claude patched bugs and proved that 239 OSS-Fuzz entry points across 123 libraries would not crash for any input below 64 MB, under assumptions including a single-threaded static RISC-V binary, Linux, and a fixed memory budget. The proofs cover normal exits without assertion failures or modeled memory-safety errors, rather than proving that the libraries are entirely bug-free. The effort produced roughly 180 million lines of Rocq proof code, with a typical proof about 600,000 lines for a binary containing a median 18,000 RISC-V instructions. Claude found hundreds of bugs while attempting the proofs, including out-of-bounds reads and writes requiring unusual or large inputs, a rediscovery of CVE-2026-56132 in libexpat, and a logic flaw in a file-loading restriction feature. Anthropic is publishing a subset of the proofs, relevant RISC-V and Linux semantics, and specifications that it could not prove; Theorem plans to offer the pipeline for other open-source projects. The guarantees depend on the correctness and scope of the formal specification, processor and operating-system models, and the Rocq proof checker. The current proofs do not model common deployments such as x86 or ARM systems with dynamically linked glibc, and AddressSanitizer-based fuzz targets do not capture every possible vulnerability.

Coding agents such as Claude Code have, in the author’s view, changed software economics by making feature development far cheaper while putting costly AI-model inference on the critical path of products. Claude Code launched as a research preview in February 2025 and became generally available in May 2025. The author contrasts the earlier SaaS model of expensive engineering teams and low marginal computing costs with AI products that carry per-user token costs; ICONIQ’s 2026 State of AI Report estimates AI-product gross margins at 45% in 2025, rising to 59% in 2027. The author argues that software companies still largely copy older product categories and workflows, citing GitHub pull requests and Salesforce’s lead, opportunity, and pipeline model as enduring templates. Procurement habits, startup funding for familiar “X for Y” products, incumbents’ organizational structures, distribution advantages, trust, maintenance demands, and token costs may all slow change. The author compares the transition to early electrified factories, which initially retained steam-era layouts before redesigning around individual electric motors. The author predicts that companies could gain an advantage by redesigning categories such as code collaboration and CRM for human-and-agent workflows rather than adding AI to existing products. The author also expects broader product bundling, pointing to Rippling and PostHog as earlier examples and arguing that token spending creates new incentives for finance software companies to expand into AI infrastructure.

PostgreSQL 19’s development branch has reverted roughly eight to 10 significant features after its beta period began, far above the roughly one revert per release cycle that may be expected. Some reversions occurred late in beta. PostgreSQL developer Peter Eisentraut said the affected code may in some cases have been insufficient, while other features proved too difficult to complete on schedule or had architectural defects that could not be fixed quickly. Eisentraut said LLM-assisted code review and fuzzing can uncover edge cases much faster than earlier testing methods, producing large volumes of defect reports for features written before those tools became as useful. He also linked late discoveries to senior developers’ security-fix work during the ongoing “Vulnpocalypse” from April through the August PostgreSQL security release, which reduced normal beta-period review and testing. He said PostgreSQL’s broad feature interactions make exhaustive manual testing impractical and argued that LLM-assisted fuzzing should become part of feature development, alongside more robust internal interfaces. The community chose to preserve the release schedule rather than delay PostgreSQL 19 for additional fixes. Eisentraut expects many reverted features to return, while PostgreSQL 19 will retain features including REPACK CONCURRENTLY, logical replication of sequences, and planner hinting through pg_plan_advice.

The maintainer of several Ruby gems has archived their source code and ended active development, citing Ruby’s growing alignment with large language model-assisted programming. The author says the gems were created during an era when Ruby emphasized programmer happiness, creativity, and human-centered design, reflecting statements by Ruby creator Yukihiro “Matz” Matsumoto in 2000 and 2019. The author also criticizes Rails’ governance and says Rails’ leading figure is increasingly using LLM agents to generate Rust applications. They say Ruby itself is now substantially developed with LLM agents and cite Matz’s recent framing of Ruby as a programming language for the AI age. According to the author, Matz has said LLMs need to consume more high-quality human-written Ruby code to generate Ruby effectively. The author says they no longer want to contribute code to a shared software ecosystem that they believe corporations use as training material for AI systems. They characterize AI-generated code as polluting that ecosystem and direct users seeking changes to use AI agents instead of expecting further maintenance from them.