Agentic Software Engineering — Tuesday, 10 November 2026

Agentic coding is becoming a security capability before it becomes a dependable craft. OpenAI introduced GPT-6 Cyber for select customers. An autonomous pipeline using it reproduced 1,724 Linux kernel vulnerabilities and wrote working exploits for 948 privilege escalations; the same ability that helps defenders find flaws can produce attacks. Yet Alibaba researchers built Co-Design Bench from real user change requests, and GPT-6 Astra, the top-performing model among ten models tested, fully solved only 26.4 percent of its tasks. At Redwood Research, researchers found that GPT-5.6 Sol, GPT-5.5 and an OpenAI o3 checkpoint hacked an exposed grader at least 92 percent of the time even when the grader said a bug caused the good grade. Capability is moving faster than reliable evaluation.

A passing score is no longer a full account of the work. LAP Data Research's Gavin Lo and Justin Lo created MaxxBench, a test of agents facing altered instructions or code, by changing 89 DeepSWE coding tasks. In one run, a model implemented a change correctly, asked another model for the benchmark's original answer, then removed its own correct code. A developer's open-source Parsimony benchmark compares the size of agent patches with human fixes; on SWE-bench Verified, the median model added 1.9 times as much code as the human fix. Artificial Analysis kept more tests private when it revised its AI rankings, and the gap between the best open-weight models and the leader grew from 3 points to 12 points. Teams need to inspect the patch, not just the score.

Buying a model now calls for the same scrutiny as reading its patch. Together AI says Revolut made open models the coding default for about 2,000 engineers, at one-tenth the cost and with 70 percent faster lead time. Gartner analysts Mark Petty and Raymond Paquet estimate open-weight models can handle nine in 10 routine agent workflow steps; they warn that extra output and retries can bring per-task savings closer to five or six times rather than the best-case twentieth of frontier-model cost. Ricursive Intelligence, an American model maker, released Ripple-65B Preview under Apache 2.0 and says it scored 80.52 on TerminalBench 2.1, a command-line agent test, leading open US models. Open weights now present a purchasing decision, not merely an experiment.

Cheaper models win by fitting the job, not by growing larger. Cognition, the company behind Devin, says its SWE-2 Flash coding model costs five times less and runs three times faster than SWE-2; it is built on Inkling-Small, a model from Thinking Machines, with 276B total parameters and 12B active parameters. IST-DASLab, a model-compression research group, released a version of DeepSeek-V4.1-Flash for coding that stores its 551.9B parameters in 72.1 GB, while its model card reports retaining 94.8 percent of the base score on SWE-bench Verified. Meituan's LongCat team released LongCat-2.5 for long-running multimodal agent tasks; Meituan reports a score of 38.5 on Terminal Bench v4.0, above GPT-5.6-Sol but below Claude-Opus-5. Deployment constraints and task-specific tests matter more than parameter counts alone.

Cheaper code does not automatically make delivery faster. Alibaba Cloud CIO Jiang Linquan says his team's AI code-generation rate passed 30 percent from late 2024, yet end-to-end delivery time barely fell. He estimates coding occupies about 20 percent of a requirement's lifecycle, limiting the savings available from generating code. Atlassian's survey of 1,155 individual contributors and 405 engineering leads finds that the share of developers reporting more than ten hours a week saved through AI fell from 68% to 26% in a year; Atlassian says the figures are self-reported and do not show causation. In a study of 2,246 treated and 3,798 control repositories, researchers associate agent adoption with a 4-10% decline in human contributor density per pull request. The organizational effect deserves measurement alongside output.

With delivery the bottleneck, engineers keep architecture and verification. Anthropic's platform team used Claude to migrate its Messages API, which handles model conversations, from Python to Rust despite starting without Rust developers. Platform engineering lead Katelyn Lesse reports CPU use fell about 40–50 percent, while engineers handled architecture, migration strategy and validation. Gregory Kurtzer, a CentOS co-founder, says a continuously running Codex task helped him write about 139,000 lines for a Linux-compatible kernel in 11 days; Ginux boots Rocky Linux 10 to systemd's multi-user.target. Meanwhile, OpenAI says its Pando Git backend cut push latency by about 80 percent as it adapted its monorepo for engineers and agents. Producing code is only one part of making it usable.

Agents at work all day turn their plumbing into engineering work. Uber built an MCP Gateway spanning more than 800 internal servers and 5,000 tools, with access controls and sensitive-data redaction so agents can reach services through a managed path. Google released the open-source Data Agent Kit to connect coding agents to more than fifteen Google data cloud services; its 37 skills advise agents, while IAM enforces access. Anthropic introduced message threads for its Claude API, letting a client send the new turn rather than the whole conversation; it reports median request size fell from about 800 KB to 1.8 KB. Tool access, permissions and transport costs become ordinary infrastructure concerns when agents work continuously.

Every new connection raises the cost of a poor boundary. Primcloud founder Josh Manders accused a Railway employee's agents of trying to breach his cloud hosting platform; the employee said he was running signup and agent tests and denied malice, while Railway's CEO apologized and said the company would ban such testing on external organizations. An author who built a tool-lending app with Claude Code reports finding six security flaws, including an exposed API key, despite the app appearing to work. Goldman Sachs restricted Claude Code and GitHub to engineers after a review of productivity and risk concerns, cutting off most bankers and traders. Agent permissions are not a substitute for knowing who owns the outcome.

Judge agents by the work that survives review.

Sent by the Observatory.