This week at a glance
The week’s theme is capacity. AI now writes code, and finds bugs in it, faster than people can review, fix and ship. PostgreSQL 19 was due this month; it is now expected around 19 November, with 8 to 10 features reverted to next year, after LLM-assisted review turned up long lists of defects late in the cycle. The Linux Foundation’s Akrites team, about 200 engineers seconded by members including Anthropic, OpenAI, Google and Microsoft, is working through a backlog of hundreds of thousands of reports, many of them AI-written duplicates. In the kernel, maintainers dropped the Assisted-by tag (only about 10% of Linux 7.3 commits carried it), while Linus Torvalds shipped a Claude Code-built page-cache fix and reviewers caught a race in it.
The second thread is code at agent scale. Anthropic says it went from about 2,500 merged changes a day in May to more than 30,000 in September, and built its own version-control system, Scion, because git and its CI could not keep up. JetBrains finds 48.8% of organisations using AI around CI/CD but only 8% inside a build or test, and teams report that review is where generated changes pile up. An O’Reilly essay sets out how to review when code is cheap: agree the evidence and blast radius before generating anything.
The third thread is integrity and containment. Trail of Bits tested 25 package managers against a compromised repository; only Go and vcpkg verified every package. The new BUILD Foundation puts release attestations for Bazel on its first funding list. AWS open-sourced Strands Box, a default-deny sandbox for agents, and Anthropic now exports agent traces over OpenTelemetry. On the operations side, Google published the second edition of Site Reliability Engineering, and Grafana proposes SLOs and error budgets for agent behaviour.
On our watch list
- PostgreSQL 19 general availability around 19 November. RC1 set the date “unless issues are found”. Watch whether it ships on time, and whether the reverted features, SQL/PGQ among them, land cleanly in PostgreSQL 20.
- Whether other major projects delay releases for the same reason. Postgres is the first flagship project to slip publicly because AI review outran human fixing. Watch for similar notes from other database, language and kernel maintainers.
- How quickly Akrites cuts its backlog. About 200 seconded engineers face hundreds of thousands of reports. Watch for published throughput, new members, and whether OSS-CRS tooling reaches ordinary maintainers.
- The Assisted-by removal reaching mainline. The documentation change is in docs-next. Watch for it to merge, for checkpatch changes, and for other projects copying the cover-letter approach instead of commit tags.
- Package-manager defaults changing after the Trail of Bits study. Only Go verifies signatures by default. Watch npm, NuGet and Pub for stricter defaults, and for signer identities appearing in lockfiles.
- BUILD Foundation’s first investments. Release attestations in the Bazel Central Registry are on the list. Watch for which ships first and whether more members join beyond the initial six.
- Agent-scale source control beyond Anthropic. Anthropic says others will hit its limits within months. Watch for other large engineering organisations describing monorepo, CI and review changes driven by agent merge volume.
- Strands Box on Linux. Today it runs on Apple-silicon Macs. Watch for the Linux release, the promised starter-policy CLI, and how the policy-bypass for directly granted files is handled.
- OpenTelemetry GenAI conventions stabilising. Claude Platform trace export depends on conventions still marked in development. Watch for a stable release and for other model providers exporting the same spans.
- Agent SLOs moving from proposal to product. Grafana describes an approach, not a release. Watch for error budgets on agent quality and cost appearing in observability platforms and in SRE team charters.
This week’s topic map: maintainer and review capacity at the centre, tied to LLM-assisted code review, PostgreSQL 19, the AI bug-report flood, Akrites and the Linux kernel. Anthropic and CI/CD at agent scale link that cluster to package integrity (Trail of Bits, lockfiles and signatures, BUILD Foundation, the CRA) on one side, and to reliability practice (the SRE book, SLOs for agents, OpenTelemetry traces, AI SRE agents) and agent identity and sandboxing on the other.
View interactive topic map →
Article index
Integrity, isolation and accountability
Most package managers still trust whatever the repository serves. Bazel gets a funded foundation with release attestations on its agenda, the CRA sets the bar for shipping without known vulnerabilities, and agents get kernel-enforced sandboxes and their own identities.
AI finds bugs faster than humans can fix them
Postgres pulls features because AI review found more than committers could fix in time, the Linux Foundation stands up a shared team to triage the AI bug-report flood, and the kernel drops its AI-disclosure tag while Torvalds ships Claude-written patches.
Code at agent scale
Merge volume has outgrown tools built for humans. Anthropic replaced git internally, one developer ported a compiler for $24,000 in tokens, and surveys show review and reliability are where the time goes.
Platforms and harnesses
How platform teams decide what to build, when a test harness pays for itself, and what running agents in production looks like at Uber.
Reliability practice meets agents
The SRE book gets its first rewrite in ten years, SLOs and error budgets move onto agent behaviour, agent traces flow into existing observability stacks, and AI spend becomes something platform teams have to manage.
Detailed write-ups
1. Only two of 25 package managers check every package they install
Trail of Bits · October 14, 2026 · Linux Foundation · October 14, 2026
Trail of Bits researcher Keegan Ryan tested 25 popular package managers against one scenario: a compromised repository that injects malicious code into legitimate packages. The result: “Only two verified the integrity of every package they downloaded.” Those two were Go and vcpkg. Fewer than half used lockfiles that check for tampering by default, and only Go verified signatures by default. Everything else needed extra configuration, lacked the verification code, or did not support signatures at all.
The defaults are the problem. cpanminus fetched packages over plain HTTP. Pub logs a hash mismatch and installs the package anyway unless you pass the non-default --enforce-lockfile. NuGet ships with signatureValidationMode set to accept, which installs packages with invalid signatures. npm does not check repository signatures during npm install; you have to run npm audit signatures separately. pnpm tightened its lockfile-overwrite behaviour only in version 11.4, in May. Ryan’s proposal is to record signer identities or public keys in lockfiles and back them with a transparency log, so that verifying integrity no longer means pinning every update.
On the same day the Linux Foundation launched the BUILD Foundation at BazelCon in Amsterdam to fund the Bazel ecosystem. Its initial members are ASML, Canva, Datadog, EngFlow, Figma and Spotify. Supply-chain security through release attestations in the Bazel Central Registry is on its first list of investment priorities, alongside paying bazel-contrib maintainers, documentation, training and IDE integration. Linux Foundation CEO Jim Zemlin: “Bazel has become critical infrastructure for engineering teams around the world.” The practical point for DevSecOps teams is to treat the repository as untrusted: turn on the strict lockfile and signature modes your ecosystems already offer, and check whether your internal mirrors re-verify what they cache.
Sources: https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/?ref=hexdigest, https://www.linuxfoundation.org/press/linux-foundation-launches-build-foundation-to-sustain-large-scale-multi-language-build-and-test-systems
2. Postgres 19 slips because AI review found more than committers could fix
The Register · October 16, 2026
PostgreSQL 19 was due in late September or early October. It is now expected around 19 November, and roughly 8 to 10 significant features have been reverted to PostgreSQL 20. The most visible casualty is SQL/PGQ, the property-graph query syntax added to the SQL standard in 2023. Committer Peter Eisentraut of EDB says LLM-assisted code review is part of the reason: it raised the effective quality bar after the features had been written and committed.
Some reverted features had architectural defects that could not be fixed quickly during beta. Others collected a long tail of edge-case bugs that, in earlier cycles, would have surfaced over five years of point releases. “With LLM-assisted code review, these kinds of things can get found much faster, and then you’re staring at a list of forty defect reports,” Eisentraut said. Each fix may be three lines, but each carries a fixed cost, and the team ran out of time. He was clear that vibe coding was not the cause, since most of the features predate it.
Not every committer reads it the same way. Other contributors point to a review backlog, made worse by senior developers spending the spring and summer on security fixes, and count only a minority of the reverts as AI-driven. Both readings agree on the mechanics: review came late and found more than could be fixed before release. For any team adding AI review to an existing pipeline, the lesson is to run it early, before features are committed, and to budget engineer time for triage, not just for the tool.
Sources: https://www.theregister.com/databases/2026/10/16/postgres-19-delayed-after-ai-reviewers-find-more-bugs-than-humans-can-fix/5303471
3. Akrites: a shared response team for the AI bug-report flood
The New Stack · October 15, 2026
Akrites is a Linux Foundation initiative, announced in June, that acts as a shared security incident response team for open source. It consolidates incoming vulnerability reports, validates them and coordinates fixes with upstream maintainers. Founding members include Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi and JPMorganChase. Members commit up to ten full-time engineers each, and some financial institutions contribute money instead. About 200 seconded engineers work on it.
CTO Christopher Robinson, also chief security architect at the OpenSSF, describes a backlog of hundreds of thousands of reports. Reviewing one security pull request can take an engineer up to eight hours. AI-generated reports tend to be verbose, inaccurate and to overstate severity, and many duplicate each other because similar models find similar bugs. His summary: “Everybody with a $20 account is now a researcher.”
Triage runs in stages. AI scores incoming reports and flags duplicates, seconded engineers review what survives, and Akrites hands maintainers test cases, proofs of concept and patches rather than raw findings. A related Linux Foundation project, OSS-CRS, gives maintainers AI tools to investigate and fix. If your organisation runs a bug bounty or a vulnerability disclosure programme, expect the same volume problem, and plan for de-duplication and validation before anything reaches an engineer.
Sources: https://thenewstack.io/akrites-ai-vulnerability-reports/
4. The kernel drops its AI-disclosure tag as Torvalds ships Claude-written patches
The New Stack · October 14, 2026 · The Register · October 14, 2026
Linus Torvalds used Claude Code to build a fix for folio reference-count contention in the Linux page cache. He says the tool wrote the implementation, tests and first documentation under his direction, while he ran the benchmarks. His 10-patch series reported a 23-fold throughput gain on a synthetic benchmark; the revised series took a 64-thread Threadripper from 13.3 million to 304 million reads per second. Reviewers then did their job. Kiryl Shutsemau found a race in filemap_read_rcu_batch(): replacing a folio and then extending the file size could expose data that was never written. The fix went into a revised patch, and Matthew Wilcox and David Hildenbrand are still debating the new page flag.
In the same week, the Maintainers Summit in Prague agreed to deprecate the Assisted-by tag that contributors were asked to add when an AI tool helped write a patch. Sasha Levin of Nvidia posted the documentation change: only about 10% of the 18,533 non-merge commits in Linux 7.3 through rc7 carried the tag, so its absence told reviewers nothing. Disclosure moves to the patch cover letter, AI agents still may not add a Signed-off-by line, and the human submitter still answers for every line. Torvalds: “We’re not going to make stupid rules that say ‘you can’t use tools for X’.”
Taken together, the two stories show where the kernel has landed. It does not try to police the tool. It relies on the reviewer, and the review caught the race. Teams writing their own AI-contribution policies can copy that: require a human sign-off and an explanation of how the change was made, and put the effort into review rather than into labels contributors will not apply. (The New Stack’s owner is an investor in Anthropic.)
Sources: https://thenewstack.io/torvalds-claude-code-kernel/, https://www.theregister.com/ai-and-ml/2026/10/14/linux-kernel-devs-drop-obligatory-confession-of-ai-tool-usage/5303140
5. Anthropic replaced git because Claude merges 30,000 changes a day
The Register · October 13, 2026 · The Register · October 15, 2026
Anthropic says it averaged about 2,500 merged code changes a day in May and more than 30,000 a day by September. Its main branch is around 100 GB, and CI alone performs on the order of 25 million checkouts a day. In five months a small team built Scion, a centralised version-control system designed for agents, migrated the monorepo off git, and added a code review surface, code search and a source-control IAM system that can protect individual directories.
Scion assumes clients are always online. The server handles history, blame, merges and rebases, and queries are exposed through an API, so many jobs need no local checkout at all. Anthropic’s explanation for the growth: “the latent demand for merging code is practically infinite, and every bottleneck we remove immediately leads to a further increase in the amount of code we produce.” It will not open-source Scion, but expects other organisations to hit the same limits within months.
A smaller data point from the same week: developer Theo Browne had agents port the TypeScript compiler, type checker and language server to Rust for about $24,000 in API-equivalent tokens, after an earlier attempt spent more than $400,000 and stalled near 84% compatibility. The port passed the conformance suite at close to 100%. It translated Microsoft’s existing Go port rather than the original, bugs included, and Browne says he has not read the code. Both stories point at the same constraint: merge volume and verification capacity, not writing speed. Source control access, review routing and CI capacity are now security and reliability controls, not just developer tooling.
Sources: https://www.theregister.com/devops/2026/10/13/anthropic-reinvents-source-control-as-claude-floods-the-world-with-code/5302943, https://www.theregister.com/devops/2026/10/15/24000-ai-experiment-ports-typescript-compiler-to-rust/5303409
6. Review is the bottleneck, and the evidence has to come before the code
Help Net Security · October 15, 2026 · LeadDev · October 12, 2026 · O'Reilly Radar · October 16, 2026
JetBrains’ State of CI/CD in 2026 finds 48.8% of organisations using AI for at least one CI/CD task, but only 8% running AI-powered steps inside a build or test. 72.8% run their main CI/CD system on their own premises or on self-managed cloud, the highest on-premises share in the five years the question has been asked. Teams using AI report that the volume of generated changes slows review and makes reliability harder to judge. TeamCity’s Olga Bedrina: “Most AI use currently happens around the pipeline.”
LeadDev revisits the Undo survey we covered last week from a different angle: 81% of 300 engineering leaders reported a production incident or outage linked to AI coding tools in the past six months, and 79% say releases are no faster. Undo CTO Mark Williamson: “There’s definitely going to be bugs.” Both are vendor surveys, so read them as direction.
Markus Eisele’s O’Reilly essay is the practical answer. Agree on intended behaviour and expected blast radius before any code is generated, then require evidence for acceptance. Trace each important requirement to implementation and checks, and justify any behaviour nobody asked for. Remember that code and tests can share the same misreading, such as treating “above €100” as “€100 and above”, so check tests against agreed boundary examples and confirm they fail when the protection is removed. Scale review depth to risk: “Require direct inspection of the payment path because a mistake can move money twice.”
Sources: https://www.helpnetsecurity.com/2026/10/15/jetbrains-ai-software-delivery-report/, https://leaddev.com/ai/ai-code-causes-real-world-production-outages, https://www.oreilly.com/radar/code-review-after-code-gets-cheap/
7. The SRE book is rewritten, and SLOs move onto agent behaviour
Google Cloud Blog · October 12, 2026 · InfoQ · October 16, 2026 · DevOps.com · October 2, 2026
Ten years after the original, Google has published a completely rewritten second edition of Site Reliability Engineering. New material covers running AI infrastructure (GPU and TPU cluster reliability, monitoring non-deterministic outputs and latency, continuous training and data pipelines) and using generative AI for reliability work such as incident triage, postmortem drafting and natural-language telemetry queries. It also records how practice has matured since 2016: multi-tier SLOs with burn-rate alerting, OpenTelemetry-based observability, infrastructure as code and internal developer platforms, continuous resilience testing, and FinOps-aligned capacity planning. Organisational models now go beyond a dedicated SRE team to platform-engineering integration and reliability champions embedded in product teams.
Grafana Labs applies the same tools to agents. It proposes SLOs on hallucination, task fulfilment, toxicity and cost, scored by an LLM judge or by deterministic checks where those suffice. One example: 95% of conversations judged fulfilled over 30 days, with the remaining 5% as the error budget. Watching the burn rate catches slow quality drift that failure alerts miss. InfoQ’s Craig Risi adds the caveat: “The SLO provides the governance mechanism, but it does not make the underlying quality measurement inherently correct.”
A contributed DevOps.com guide from a Komodor researcher covers getting AI SRE agents past the demo: run them as shared services that answer alerts at any hour, keep an audit trail from alert to recommendation, track cost per session with budget alerts and circuit breakers, regression-test against past investigations, and never give an agent a human’s credentials. Start read-only and widen autonomy with approvals and policy checks. Microsoft’s new Azure SRE Agent canvas follows the same pattern, putting the agent’s diagnosis next to the developer’s own tools for verification rather than acting on it directly.
Sources: https://cloud.google.com/blog/products/devops-sre/sre-book-second-edition, https://www.infoq.com/news/2026/10/grafana-slo-ai-agent/?+ML+&+Data+Engineering, https://devops.com/how-to-move-ai-sre-agents-from-demo-to-production
8. Containing agents: default-deny sandboxes, agent identities and traces
Help Net Security · October 12, 2026 · InfoWorld · October 15, 2026 · DevOps.com · October 15, 2026
AWS released Strands Box, an open-source sandbox for AI agents, in developer preview for Apple-silicon Macs, with Linux planned. It places the agent in a kernel-enforced sandbox and routes shell commands, Python code, MCP tool calls and network traffic through four checkpoints. Each asks the Dogwood policy engine for a decision, and Dogwood denies anything no rule allows. Because all four share one event history, a rule can block outbound HTTP after a file from a customer-data directory has been read, whichever tool read it. The network gateway swaps placeholder tokens for real API keys on the way out, so the agent never holds the secrets. AWS’s Marc Brooker says the design must guarantee that “the policy layer is the only way out of the box.” One caveat: files granted directly in box.toml bypass the policy engine and its history.
Thoughtworks’ Shayan Mohanty argues in InfoWorld that accountability has to be built into the system: agents need their own identities with named owners, permission grants and expiry; permissions should change with context; and when agents hand work to sub-agents, the chain from the original authority to each action must stay traceable. “Autonomy can branch. Accountability cannot disappear.”
Traceability is getting easier to wire up. Anthropic added native trace export to the Claude Platform in public beta on 14 October, covering the Messages API, Managed Agents and the SDKs. It uses OpenTelemetry’s GenAI semantic conventions, which are still marked in development, and ships setup guides for 12 backends including Datadog, Grafana Cloud, Honeycomb, New Relic, Splunk and Sentry. Prompt and response content is optional; spans inside Managed Agents sessions do not export it. Futurum’s Mitch Ashley: “Agents are production workloads, and they fail the way production workloads fail.”
Sources: https://www.helpnetsecurity.com/2026/10/12/aws-strands-box-open-source-ai-agent-sandbox/, https://www.infoworld.com/article/4232783/when-an-agent-acts-who-is-accountable.html, https://devops.com/claude-platform-now-sends-agent-traces-straight-to-your-observability-stack
Calls to action
- Turn on strict integrity modes in every ecosystem you use. Enforce lockfiles (for example
--enforce-lockfile in Pub), set NuGet signature validation to require, and add npm audit signatures to CI.
- Make internal mirrors re-verify what they cache. A proxy that stores whatever upstream served passes a compromised package straight through. Check hashes and signatures on ingest, not just on install.
- Move AI code review earlier. Run it before features are committed, not in the last weeks of a release, and budget engineer time to triage its findings.
- Set up de-duplication and validation for incoming bug reports. If you run a disclosure programme or bounty, screen AI-generated reports for duplicates and reproducibility before they reach engineers.
- Write an AI-contribution policy that relies on review, not labels. Require a human sign-off and a short note on how the change was made; do not depend on tags contributors will skip.
- Agree evidence and blast radius before agents write code. For high-risk paths such as payments and auth, require boundary-example tests that fail when the protection is removed, and inspect the code directly.
- Give every agent its own identity. No human credentials; a named owner, scoped permissions and an expiry. Start agents read-only and log every action.
- Route agent traces into your existing observability stack. Decide now whether prompt and response content is exported, and who can see it.
|