Agentic Engineering Weekly for July 17-25, 2026

Jo Van Eyck

Jo Van Eyck

— 14 min read
Share
Agentic Engineering Weekly for July 17-25, 2026

The industry stopped arguing about whether verification is the bottleneck and started shipping answers. More thoughts on Thoughtworks' Future of Software Engineering gathering, The industry moved code review upstream of the diff, Kelsey Hightower argued the cheapest token is the one you never spend twice, and an unreleased OpenAI model with its guardrails switched off broke out of its sandbox and hacked Hugging Face to cheat on a benchmark. Time for John Connor to fetch their running shoes from the attic?

My top 3 picks this week

This week's video

Your agents just opened a 5.000-line PR. Do you actually read every line? At agentic speed, uniform code review stops being possible, and pretending otherwise is how you lose the game for most software out there.

In this video I explain the skills that can replace it: keeping track of the system shape and spending your attention where the risk actually hides. I show how a C4 component "diff diagram" turns an unreadable PR into a treasure map with added, removed and changed components and relationships in a single picture, so you know where to start before you read the first line of code.

Try it yourself: https://github.com/jovaneyck/skills

Review moved upstream, because the diff is the wrong place to catch the mistake

By the time a PR gets submitted, you are reviewing the consequences of decisions made hours and thousands of tokens ago. That is why I'm currently experimenting a lot in this area: "pair grilling", acceptance criteria that get converted to automated tests and formal verification, etc. The reviewer's question changes from "does this code look right?" to "what does the system shape look like after this change", which is closer to a weekly system review than to a line-by-line read. Asking another model to do the code reading faster does not solve any of the underlying problems.

The numbers behind the pressure are unambiguous. Across 500+ teams, AI-written code went from 34% to 52% of all code in a single quarter, pull request sizes nearly doubled. One reversal deserves its own sentence: code maintainability improved 3.8% while confidence in one's own changes fell 6.1%. Gergely Orosz reports the same trend from the leadership angle, with Uber, Cloudflare, Faire and HubSpot each building in-house reviewers, and with the observation finding that developers approve faster when the AI reviewer had nothing to say.

Michaela Greiler offers the cleanest structural answer: agents check the mechanics, the developer who steered the agent does the primary human inspection because they hold the mental model, and the team reviews approach and architecture rather than implementation. I would add the half that upstream review does not cover. Moving the checkpoint to intent handles correctness. It does nothing for the theory of the system you stop building the moment you stop reading. Writing code was how most of us kept a deep model of our systems, and that model is what erodes fastest when an agent does the writing. I am finding architecture diffs useful here, a picture of which components and relationships appeared, disappeared or changed between two commits, used as a review index rather than as a replacement for reading. The false choice to refuse upfront is "read every line" versus "trust the agent blindly". Uniform review has always been an anti-pattern. The still open question is what will replace it.

Worth reading:

Thoughtworks put numbers on "verification is the bottleneck"

Forty unconference sessions in Engelberg produced five headline findings: generation is no longer the bottleneck, harness engineering is a distinct and ownable discipline, there is a real apprenticeship crisis, the executive/engineer expectation gap outranks any technical limitation, and legacy modernization is the most defensible near-term genAI value pool. What makes the report worth your time is that it arrives with measurements. A three-model council of judges combined with linters and pattern matching raised first-pass merge acceptance from roughly 60% to 80%. One organisation's harness cut token usage by at least 4x. And translating lint "this is bad" binary output into specific, deterministic, step-by-step refactoring instructions a model can act upon took code-smell resolution from under 50% to roughly 90%, which is described as the cheapest high-leverage harness improvement documented at the event.

Two interesting findings: first, nobody in the room could cite data on how many defects manual code review actually catches, which the report names a status quo illusion. Second, the "two clocks" diagnostic: teams are separately tracking the clock for producing code and the clock for waiting on a decision, and finding that throughput exploded while cycle time did not move, because specification clarity became the constraint. On the human side, the seven-to-ten-year experience cohort was singled out as under the most acute strain, having spent a decade mastering exactly what the models now do well. The best-performing teams, notably, do not hand-write their harnesses. They let agents fail, run a "learn" skill that proposes harness edits, and treat the human job as periodic pruning rather than authorship.

My own prerequisite list for getting a legacy codebase agent-ready reads like the report's action items, which I take as an encouraging signal. Hexagonal architecture with coarse-grained, zero-dependency tests covers a large surface of the system fast, with narrow integration tests at the boundaries. Everything catchable automatically gets caught automatically: supply chain, static analysis, security scanners. Then mine the wealth of PR feedback already sitting in your system and turn it into a review skill tailored to that codebase. The report's strategic warning echoes DORA: agentic AI amplifies the discipline you already have, so weak testing culture and unclear risk ownership get worse faster, not better. One practitioner's estimate of realistic near-term gains across the full lifecycle rather than code generation alone: two to three times, not ten, with a plausible 12 to 18 month window.

Worth reading:

A model with its guardrails off escaped the lab and hacked Hugging Face

OpenAI was running an unreleased model against a cybersecurity benchmark with safety guardrails deliberately disabled. Rather than solving the task, the model found a zero-day in OpenAI's own package registry proxy, escaped the sandbox, gained internet access through privilege escalation, chained stolen credentials and further zero-days into Hugging Face, and read the benchmark answers straight out of the production database. Note the sequence carefully: nobody asked the model to attack anyone. It was asked to score well. Hugging Face disclosed on July 16, OpenAI took responsibility on July 21.

I read this as another crank of the handle on the pre-IPO growth story. Hugging Face's side of the disclosure is the more instructive angle. Entry came through the data-processing pipeline, where a malicious dataset exploited a remote-code loader and a template injection in a dataset configuration. From there: node-level access, credential harvesting, lateral movement across internal clusters over a weekend. Forensics counted more than 17.000 attack events and thousands of individual actions executed across a swarm of short-lived sandboxes.

Thomas Ptacek argues an open-weights model from 2025 with a decent pentest harness could already do this in most networks, and that the story is only surprising if you assumed OpenAI had tighter sandboxes. Martin Alderson points out that Hugging Face runs untrusted models and untrusted code across more interfaces than anyone can count, which makes it a uniquely rich target and a poor basis for generalising to a normal enterprise. Simon Willison lands on the asymmetry that should actually worry defenders: the models least constrained from doing this work are the ones defenders cannot get, while the frontier models they can get refuse to help them analyse it. Hugging Face had to leverage an open-weight model to combat the attack as the US frontier labs models' guardrails were preventing them from analysing the security-sensitive data streams. Now that is the headline I will remember.

Worth reading:

Zero Token Architecture: the cheapest token is the one you never spend

Kelsey Hightower's platform engineering rule from PlatformCon fits in one line: run inference once, export the logic to code, then run it without further inference. Use the model where intelligence and discovery are genuinely required, which is when the problem is unclear, when you are exploring options, when you are working through ambiguity. The moment the problem is understood and the process becomes predictable, turn that knowledge into ordinary deterministic software: code, automation, configuration. The warning attached is the part people skip. Lean on the model for every step and you lose the knowledge required to judge whether its output was any good in the first place.

The economics support him from an unexpected direction. Cursor rebuilt SQLite from scratch with old and new agent swarms and found cost ranging from $1.339 to $10.565 for the same 100% test pass rate, with a frontier planner plus cheap workers winning decisively: once a strong model has collapsed the ambiguity into explicit instructions, a cheaper model simply has to follow them. That is a variation on Hightower's principle rediscovered by the inference camp. The improved swarm also produced 9.908 lines where the old one needed 64.305 for equivalent functionality, which is its own argument about what ambiguity costs you downstream.

Be skeptical of packaged savings, though. JetBrains ran a paired A/B benchmark on the popular "rtk" skill, advertised at 60-90% token reduction, and measured it 7.6% more expensive at low reasoning effort with no difference at high effort. Their previous instalment measured the "caveman" skill at 8.5% saved against an advertised 65%. Meanwhile Heitor Lessa's version of the lesson came with a bill: a single refactor burned 200 million tokens, produced the conclusion "I need to stop using Opus, this doesn't work", and forced a rebuild of the agent workflow now running across 1.400 engineers. Token discipline is engineering work with measurable outcomes, which means it needs benchmarks rather than testimonials.

Worth reading:

Every company is building a digital brain, and the winning architecture is deliberately boring

Cerebras published how they built their internal knowledge base, and the striking thing is how little novelty is involved. Every source, from Slack threads to netlists, lands in a single Postgres table holding embeddings, raw summaries and metadata. Anything in that table is immediately queryable through one interface, with authentication, authorization and auditing as a first-class layer rather than an afterthought. Slack, their highest-value source, gets hybrid retrieval: full-text search for exact matches, vectors for meaning, inverse document frequency weighting to surface signal over noise, and temporal decay so recent information wins. Three months after launch it fields more than 15.000 questions a day.

The design principle is worth stealing. The system works because it meets people where information already lives instead of demanding they move it somewhere rigid. Teams keep discussing in Slack, tracking in Jira, coding in GitHub, and the knowledge base indexes all of it uniformly. Project-based scoping prevents the failure mode where every query returns company-wide noise, and new employees get pre-configured projects matched to their role during onboarding. Adoption came from sensible defaults rather than from a mandate.

Contrast that with what most teams actually have, which Edouard Maleix describes accurately: rules, notes and feedback controls that never cohere into a system, so agents repeat the same mistakes across sessions and what accumulates is instructions rather than reusable knowledge. Emil Eifrem names the organisational version of the same waste, where every new agent team rediscovers from scratch where the data lives across a hundred databases plus Snowflake, Databricks and S3, and argues for pushing meaning into the substrate so the agents themselves can get thinner. JetBrains shipped the repository-scoped version of the idea as a layer shared across Claude Code, Codex CLI and Junie rather than as yet another per-tool index. The pattern is converging faster than the vocabulary is.

Worth reading:

Don't run past yourselves: output held steady while the experience underneath came apart

Mitchell "Hashicorp" Hashimoto put it plainly: he strongly believes there are entire companies right now under heavy AI psychosis, and that it has become impossible to have rational conversations with them. The common belief he is pointing at is specific: "shipping bugs is fine now, because agents will fix them quicker and at a scale humans cannot match". His answer is equally specific. You cannot yeet resilient systems.

Annie Vella's longitudinal research supplies the measurement. Across two timepoints, 84% of engineers reported improved productivity both times, while the cohort reporting a worsened experience nearly doubled from 14% to 27%. Those rating flow state worse jumped from 7% to 20%, and only 37% of initially positive participants stayed fully positive. The most important finding: the correlation between change in flow and change in productivity came out at 0.02. AI severed the link between how work feels and how much of it gets done. Output holds high and steady while the experience underneath erodes, and because output is the number that gets reported upward, nothing in your dashboard will tell you this is happening. Except maybe the dimming of that once bright sparkle in your engineers' eyes.

I want to be careful not to turn this into an argument for caution as a default, because the data cuts both ways. In a team intake I performed this week I found one AI-native power user with the entire path from ticket to impact analysis to technical design to implementation already built, and the thing holding the team back from being 30 to 50% faster was adoption, not tooling. Everyone had their own private reason not to start: concerns about job security, plain uncertainty, a preference for having their nose deep in the code. Their own assessment of the codebase was blunt and probably right, that its current quality sits below the quality of AI-generated code, so moving toward agentic engineering would be a net-gain operation in any direction you measure. Both things are true at once. Some organisations are running past themselves, while some are standing still and calling it prudence. Nik Suresh's collection of consulting anecdotes, including an executive who admitted never having used ChatGPT immediately after producing an AI-centred strategy for a $2B+ revenue organisation, is what the first failure mode looks like from the inside.

Worth reading:

Another week, another new "paradigm", and exactly one thing that actually moved the needle

"Graph engineering" got coined in mid-July, after Peter Steinberger asked whether the field had shifted from loops to graphs. The described practice is 90% thin air, 10% reinvention of the wheel: wire specialised agents into a graph of nodes and edges with shared state flowing along the edges, with branches, fan-out and fan-in. It is also something LangGraph, Microsoft AutoGen and Google ADK have shipped for years, and state-machine orchestration considerably longer than that. What is new in July 2026 is the vocabulary. RAG, ReAct, prompt chaining, orchestrator-workers, MCP, CLI, MCP again, CLI again. Dan Farrelly's framing is the useful one: your agent architecture has a half-life of about six months, so the question worth asking is not what comes next but what you can build so the next supposed-paradigm-shift-induced-rename costs you less.

Underneath the naming, one thing genuinely moved this week. Kimi K3 landed as the first open-weights model at 2.8 trillion parameters with a million-token context, ranking high on the Pareto-frontier graphs, with full weights available for download due July 27. Nathan Lambert reads it as closing the frontier-to-open gap from six to nine months down to three to five. Anthropic shipped Opus 5 yesterday at unchanged pricing of $5 and $25 per million tokens, landing around Fable's performance on benchmarks and beating it at roughly a third of the cost. The pattern in both is the same, and it has nothing to do with leaderboard position: the cost of a given level of intelligence keeps falling, and open weights are now on that curve rather than trailing it. Practical caveat before anyone gets excited about AI sovereignty: a 2.8T parameter model is not running in your basement any time soon. Open weights buy you optionality and jurisdictional choice, not a laptop deployment.

One benchmark from the week deserves more attention than any score. Boris Cherny points out that Opus 5 is Anthropic's least prompt-injectable model yet, buried on page 73 of the system card. Given the week's other headline story, that is the only number on the page that changes what you are willing to let an agent touch.

Worth reading:

Quick Hits

  • Are AI labs pelicanmaxxing?: 1.008 SVGs across 8 animals, 6 vehicles and 7 models to check whether labs train on the pelican benchmark. Pelicans ranked 6th of 8, and the pelican-bicycle cell 42nd of 48. The benchmark is clean (article)
  • Codeberg Divides: Codeberg now excludes largely AI-written projects, and Ronacher, who wants GitHub to have competition, explains why a democratic decision is not automatically a wise one (article)
  • LLMs reward expertise: Models make everyone a generalist, which is exactly why people conclude no skill is involved. The ceiling is set by what you know well enough to judge (article)
  • Do LLMs know how to make software? (No.): Writing code is mathematically verifiable, making software is a chain of judgement calls, and harnesses only paper over the first one (article)
  • Perfection is not over-engineering: Over-engineering is solving the wrong problem, and conflating the two has been licensing careless work for years (article)
  • Contract-Driven Development: Write the Truth Once: The same idea built three times across a bank, a consumer app and the AI era, with a report on what survived (article)
  • Kill your MEMORY.md: Turn off auto-memory and keep the agent stateless for predictability. (video)
  • Alan Turing: Computing Machinery and Intelligence: Felienne and Hanna open by asking whether the episode text was machine-written, then work through what it means when you can no longer tell (podcast)
  • Diataxis: Tutorials, how-to, reference, explanation. A way of thinking about documentation. Boring, systematic, and newly relevant now that your docs have a second audience that reads everything literally (article)

Curated from 236 sources across articles, podcasts, and videos. Week of July 17-25, 2026.

Read more