ZeroNoise Logo zeronoise
Post
Coding Agents Alpha Tracker
Anthropic's agents outgrew Git: 30,000 merges a day pushed it onto a custom source-control system
•
5 min read
• 158 docs
Anthropic says developer infrastructure, not coding, now limits its output, and Modal and Cursor describe their own infrastructure answers. This brief also covers Theo's harness-vs-MCP explainer, the Agent Skills donation, a secrets-handling pattern for agents after the OpenCode key leak, and Ben Tossell's overnight build of a 24-subagent pipeline.

At agent scale, the bottleneck moves to infrastructure

Anthropic says "coding is no longer the bottleneck." What limits it now is "developer infrastructure built for human scale: source control, builds, and CI." It averaged about 2,500 merged changes a day in May 2026 and more than 30,000 a day by September . The Pragmatic Engineer reports that about 3,000 staff typically run 10–15 parallel Claude agents each, which adds up to about 25 million Git checkouts a day just for CI .

Anthropic moved its monorepo off Git onto Scion, a closed-source system with server and client written in Rust. It also built Antique for code review, with a Go backend and React frontend . Claude was "instrumental" in the migration. The team's approach was to get about 99% of use cases covered, force the cutover, and have Claude fix whatever actually broke . Anthropic adds that "most teams don't need to leave git" . The practical lesson for everyone else is to look at whether your CI and checkout costs will hold up once each engineer runs a dozen agents.

Modal's Erik Bernhardsson offered a related infrastructure idea on Latent Space. Treat agents as long-running durable workflows: spin up a sandbox for a few commands, shut it down and snapshot it. Forking those snapshots would let an agent explore hundreds of branches in parallel instead of working sequentially . For CI, he suggests running setup once, snapshotting the container, and cloning it so each test runs in its own sandbox. Today every shard repeats the installs . Other Modal practices:

  • Optional code review. Docs and basic changes don't wait for a human. Bernhardsson says this only works with rate limits everywhere, decoupled systems, no single points of failure and strong test coverage. He adds that agents are now good at writing tests .
  • Sandbox-escape red-teaming. Modal puts an agent in a sandbox and tells it to escape. It has run this for a few months and found nothing so far .
  • Agents copy deprecated syntax from their training data, so Modal now deprecates features more cautiously and updates examples published across the web .

Does the harness still matter?

In a talk, Jediah Katz cites studies (UC Berkeley, Apple/EPFL) that found the choice of harness didn't significantly change coding-benchmark scores on newer models. In his view, models have absorbed the old harness jobs: exploring the codebase, working persistently with /goal, and running tests . The same studies did find significant differences in cost per task. Tuning cache hit rate, token efficiency and model mix cut cost and latency in his team's harness "without any hit to quality" .

Two patterns from the talk you can reuse:

  • Software factory. A bug reported in a channel is auto-triaged. A cloud agent fixes it and records before-and-after videos as proof. After the fix merges, another agent watches the production rollout .
  • One "subscriptions" primitive. Instead of a separate integration for each trigger, agents get one tool to subscribe to events such as Slack posts, CI going red on a watched PR, or a time of day .

Theo published a full explainer on the terms. A harness is the tools, the tool-call syntax, a parser that runs the calls, a way to feed results back, and the list of tool descriptions . Claude Code's TUI and GUI are interfaces sitting on top of that harness . His design point: T3 Code lets Claude Code threads spawn Codex subagents through an MCP server. That way the code lives in T3 Code once and doesn't have to be rebuilt as a plugin for every harness .

Related: Anthropic donated Agent Skills to the Agentic AI Foundation, under the Linux Foundation, which already hosts MCP . It says 70+ platforms have integrated the standard, including ChatGPT, Cursor, GitHub Copilot and VS Code . Geoffrey Huntley agreed with a post arguing that "you don't need hundreds of skills or agents definitions" .

Keeping secrets away from agents

According to Theo, the OpenCode breach exposed provider keys that users had stored on OpenCode's server side. Developers reported $400 to $3,000 in abuse within minutes . His advice is to keep keys "very well separated, and easy to revoke" . He also says agents got him through a day of outages: they triaged incidents and "rolled dozens of api keys across various platforms" .

1Password for Agents launched with this flow: the agent requests a credential, you approve it, and 1Password autofills the credential directly so the agent never sees it . Kent C. Dodds says Kody can connect the same setup to any agent and restrict exactly how each secret is used .

On prompt injection, Simon Willison is "cautiously starting to suspect" it may not be a problem for today's strongest models. He says it remains a real concern for cheaper, weaker models , and the hard part is proving a model or harness has solved it .

Anthropic and Theorem Labs say they used Claude to prove security properties in more than 100 real-world open-source libraries over a few weeks .

How Ben Tossell built his newsletter pipeline

Ben Tossell's pipeline syncs his X bookmarks to Supabase every 15 minutes and produces previews and drafts on a schedule . The build process is reusable:

  • He spelled out edge-case classification rules the agent couldn't infer, such as recognizing a podcast where he was only the guest .
  • He ran a "bake-off" with six subagents, each given different amounts of personal context and link content. The winner was simply giving the model his last two newsletter sends as examples .
  • An OpenAI model in the transcribed "6.1 Sol" line split the build across subagents, with end-to-end verification required. He treats OpenAI models as "workhorse" models and uses Opus 5.5 for design. 24 agents worked overnight .

When he compared its first draft with his own, the picks were "more or less line for line the same" .

Quick tips

  • swyx calls Opus 5.5 the best work-estimation model he has used. Its estimates reflect agent speed, such as 2–3 hours instead of a human's 2–3 days . He says this is extremely important for pipelining, where it estimates ETAs for its own fixes while the pipeline is still running .
  • Huntley: if your code is properly instrumented, agent loops can find O(n) hotspots and fix slow performance automatically .
  • LangSmith LLM Gateway (public beta, Plus and Enterprise) adds spend caps, rate limits, fallbacks and redaction for Claude Code, Codex or Deep Agents Code. You point the agent at the gateway endpoint and change base_url; the rest of your code stays the same .
Anthropic's agents outgrew Git: 30,000 merges a day pushed it onto a custom source-control system
Latent.Space
latent
  • Modal cofounder Erik Bernhardsson advocates moving agent workloads from persistent dev boxes to durable agents that wake short-lived sandboxes for commands, then snapshot or branch them; he imagines roughly 100 ms startup and agents running many branches in parallel. Modal’s median sandbox was about eight seconds at the time, so the 100 ms figure is a target, not current performance. Modal offers full virtual machines alongside GVisor for workloads needing Linux compatibility, and identifies sandbox forking, snapshotting, resuming, and live migration as areas for further differentiation.
  • To parallelize CI, Bernhardsson’s proposed pattern is to install dependencies and set up the environment once, snapshot the container, then clone it to run tests independently; otherwise, each shard repeats setup, and sandbox startup and shutdown add overhead.
  • At Modal, code reviews are optional, including for basic changes that need not wait for human approval; Bernhardsson says this depends on investment in CI/CD, resilience, and test coverage, and that agents have become good at writing tests.
  • Modal reports experimenting across Cursor, Claude, Codex, and open-source models or stacks rather than favoring one; Bernhardsson encourages trying different tools and more internal dogfooding of inference endpoints.
  • Modal also uses agents for defensive security testing: it puts them in a sandbox and asks them to try to escape and escalate access. The team had started this practice a few months earlier and had not found anything so far.
Why AI Compute Comes in Rectangles — Erik Bernhardsson, Modal CEO
Latent Space
youtube
  • Eric Burn Hartson argues that agents should run as durable workflows that wake an ephemeral sandbox for a command, then shut it down and snapshot it; faster wake/sleep cycles would enable forking work across many agents. For CI, he proposes doing setup once, snapshotting the container, then cloning it to run each test in its own sandbox; current shards repeat installs and setup, which can take minutes and add overhead to parallelization.
  • Modal says it has been using agents defensively by placing them in sandboxes and asking them to try to escape; this practice began a few months before the interview, and had not found vulnerabilities so far.
  • At Modal, code reviews are optional, especially for documentation and basic changes, but that approach depends on strong CI/CD and controls such as rate limits, decoupled systems, avoiding single points of failure, and extensive test coverage; Hartson says agents have become good at writing tests.
  • Modal engineers experiment across coding tools and models rather than following one prescribed stack: Hartson cites Cursor, Claude, Codex, and open-source models, and says the team encourages experimentation and use of its own inference endpoints for agentic development.
  • Good documentation, descriptive errors, and fast feedback loops help both developers and agents; despite agents making YAML easier to handle, Hartson says SDKs remain relevant. Because agents often use outdated Modal syntax from training data, the team is cautious about deprecations and updates online examples; it also tests agent-facing content with tasks such as deploying Stable Diffusion or ranking sandbox vendors, and clarifies content when agents misunderstand pricing.
Why AI Compute Comes in Rectangles — Erik Bernhardsson, Modal
Ben Tossell
Profile
  • Ben’s newsletter pipeline syncs Twitter bookmarks to a database every 15 minutes, classifies them into an intro, curated feed, afters, or skips, and generates previews on Mondays and Wednesdays and Substack drafts on Tuesdays and Thursdays at 6 a.m. A Mac timer runs the draft-creation script; Ben still edits and writes the intro himself.
  • He made classification rules explicit for personal edge cases, such as distinguishing a podcast featuring him as a guest from a workflow and skipping bookmarks saved only for personal interest. In a six-subagent bake-off, he varied the personal context and available link evidence (text, transcripts, and images); the best setup used his two latest newsletter sends as examples. He intended corrections to classifications and reasons to improve future results.
  • His build process was to test agents and UI options, choose a direction, then split implementation among subagents and require end-to-end verification; 24 agents worked overnight. He treated an OpenAI model as a fast workhorse for implementation rather than design, and checked the first output against his own draft, finding the picks nearly line-for-line alike.
My newsletter system
Riley Brown
Profile
  • A custom company workspace was built in about three hours by combining selected features from Notion, My Mind, Typefully, and other tools; it links video scripts with editable Excalidraw-style boards, and the creator can ask AI to make diagrams for a script . It also consolidates work such as brand deals, video updates, topic opportunities, and analytics; it checks email every 30 minutes, and video feedback can be sent through a webhook to Claude Code to make edits . The reusable approach is to build only the workflows and features a team actually uses, rather than adopt a larger general-purpose app .
  • A Raycast-like desktop utility was built in a single prompt for image/logo search, background removal, a saved-image library, and image generation; it uses Vercel AI Gateway for model access . The creator reports using it for months and paying the model API costs rather than for another software service .
How Smart People Are Using AI Right Now (7 Insane Use Cases)
Latent.Space
latent
  • OO-Harness reports improving AutomationBench from 61.6% to 77.4% and Workspace-Bench from 25.5% to 39.5% with the same Gemini 3.5 Flash executor, using specialized subclasses, execution-derived design lessons, and routing. Agent S4 instead has a meta-agent build tools from trajectories without success labels; its reported open-27B results include 21.3% on OSWorld V2 (3.8× the same model with hand-built interfaces) and 41.4% to 58.6% on ScienceBoard. These are system-level, not model-only, comparisons.
  • A Claude Code Samsung TV launcher project sped iteration by mocking Samsung TV APIs in a laptop browser; taking over the Home button relied on a CleanFrame-like helper that edits undocumented TV settings, and the project was tested only on a 2022 Samsung Q70B.
  • For a corpus of 11,079,667 news articles, Claude Code queried and exported aggregated cluster metadata rather than reading all the full articles; the underlying pipeline used embeddings, heuristics, and an LLM judging step. Commenters cautioned that source selection and sampling bias could undermine conclusions.
  • Recursive released Flint, an Apache-2.0 coding MoE with roughly 40B total and 2.5B active parameters and a 262K-token context; LM Studio said local use requires about 24GB. Recursive reported 54.9% on Terminal-Bench 2.1, 89.7% on SWE-bench Pro v2, and 74.2% on SWE-bench Verified, identifying these as release claims rather than independent replications. NVIDIA describes Recursive’s Eureka Machine as a loop that proposes ideas, implements them, runs experiments, and selects follow-ups; it reportedly produced specialized kernels that improved Flint generation speed by 55% on RTX Spark without changing the model weights.
[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months
Jediah Katz
Profile
  • Newer models have absorbed several former harness jobs—codebase exploration, long-running /goal work, and checking work with tests—so coding-specific prompts and guardrails can be removed. The speaker says two cited studies found no significant coding-evaluation score difference by harness, though they did find significant differences in cost per task.
  • Cursor’s internal software-factory pattern connects agents across the development lifecycle: a channel bug report triggers automatic triage and a cloud agent fix, which is demonstrated with before-and-after videos; after the fix is merged and begins deploying, another agent monitors production through Rollouts.
  • A reusable harness pattern is one event-subscription primitive for waking agents on Slack posts, CI failures on watched PRs, or scheduled times, rather than separate integrations. Separately, tuning cache hit rate, token efficiency, and model mix substantially reduced harness costs without a reported quality hit.
How SpaceXAI is Redefining the Agent Harness
Latent Space
youtube
  • Modal encourages broad internal experimentation with coding tools: the team has used Cursor, Claude, Codex and open-source models, and is promoting its own inference endpoints for agentic development; token costs may eventually require tighter controls.
  • Modal treats code review as optional for routine or low-risk changes, but pairs that approach with investment in CI/CD, rate limits, decoupled systems, no single points of failure and strong test coverage; the CEO says agents have become good at writing tests. The team also uses a simple security red-team workflow: put an agent in a sandbox and ask it to escape; they had been doing this for a few months and had not found anything so far.
  • For agent execution, Modal’s proposed pattern is to run commands in short-lived sandboxes that can start quickly, then shut down and snapshot; agents could fork environments and run many branches in parallel. For CI, set up the environment once, snapshot it, clone it, and run individual tests in separate sandboxes to avoid repeating expensive installs and setup across shards.
  • Good documentation, descriptive errors and fast feedback loops help agents as well as developers. Modal has also become more cautious about deprecations because agents often reproduce old syntax from training data, requiring updates to examples across the web.
Why AI Compute Comes in Rectangles — Erik Bernhardsson, Modal
Simon Willison
x

Simon Willison cautiously suspects prompt injection may no longer be a problem for today’s strongest models, noting Anthropic’s confidence, but says it remains a real concern with cheaper, weaker models. He identifies the harder challenge as proving that a model or agent harness has addressed the risk well enough that developers can stop worrying about it. This responds to Nate Berkopec saying he had not seen the “lethal trifecta” demonstrated outside research settings and asking whether systems should still be constrained against it.

[@nateberkopec](https://x.com/nateberkopec) I'm cautiously starting to suspect it may not be a problem with today's strongest models - An… [@nateberkopec](https://x.com/nateberkopec) The bigger problem is /proving/ it - I'm not sure how to get to full confidence that a model … I have to say, I've been thinking about [@simonw](https://x.com/simonw)'s lethal trifecta for over a year now. However, AFAICT, it's neve…
Theo - t3․gg
youtube
  • Theo warns that coding agents can scan commits for security fixes and infer exploit paths from unmarked patches; he says models may generate exploit demos on request, while defensive security work may also trigger refusals.
  • In a sponsored segment, he presents CodeRabbit’s workflow as security review on every PR plus a repository deep scan taking about 30–60 minutes, with potential vulnerability findings and one-click fixes; he says the platform uses multiple models to provide security feedback when other models refuse.
  • Theo says OpenCode users’ provider API keys stored through its dashboard/server side may have been exposed; developers reported unauthorized usage of $400–$3,000 within minutes. His takeaway is to keep API keys protected, separated, and easy to revoke.
Even The NSA Got Involved
Latent Space
youtube

AI engineers told Moshi’s founder that management expected them to build systems normally handled by a 10-person team; they were unsure whether they needed a swarm of agents and worried about what would break. Others said they had built requested systems, but users did not click the emailed link despite complaining about the problem—anecdotal evidence that agent-assisted development raises unresolved reliability and adoption challenges, not a proven workflow.

The Recommendation Engine for Commodity Traders — Anekha Sokhal, Moshi
Simon Willison's Weblog
simonwillison

Simon Willison’s October 20 article identifies Battle Drones as a “vibe coded RTS with audio-based multiplayer,” a concrete example of a game project made through vibe coding.

Quoting Armin Ronacher
Simon Willison's Weblog
simonwillison

Anthropic donated the Agent Skills standard to the Agentic AI Foundation (AAIF), under the Linux Foundation, saying it aims to keep Skills open, community-driven, and vendor-neutral; the foundation is also home to the donated Model Context Protocol (MCP).

Donating Agent Skills to the Agentic AI Foundation
geoff
x

A security roundup Geoffrey Huntley linked lists exposed OpenCode AI API keys, malicious LiteLLM PyPI/Docker releases, infected npm packages, and backdoored official binaries; it warns that code developers trust may pose a greater security risk than code they write.

[https://ghuntley.com/libaries](https://ghuntley.com/libaries). timeless. [https://x.com/juampitech/status/2113041641481138358](https://x… October has been an absolute nightmare for software > Railway - customer secrets exposure > LiteLLM - malicious PyPI + Docker releases > …
ThePrimeagen
x

ThePrimeagen’s roundup flagged “OpenCode hacked,” but gave no details about what was compromised or how to respond.

Hey, it is Wednesday OpenCode hacked eMudra had picked a private key value of 4, thus everything is now deemed unsafe. PHP, running 70% o…
swyx
x

Swyx calls Opus 5.5 the best work-estimation model he has used and says estimates for delegated work should reflect agents’ speed and parallelizability rather than human timelines; his example contrasts 2–3 human working days with 2–3 agent hours. For pipelining, he highlights estimating the ETA for pipeline fixes while the pipeline is still running.

Opus 5.5 is the best work estimator model i've ever used. This is calibration that is increasingly important as we delegate more and more… extremely impt for pipelining... estimating ETA for its own pipeline fixes while running the pipeline still ![](https://pbs.twimg.com/med…
ThePrimeTime
youtube

A certificate-generation flaw at E-Mudra produced eight broken P-384 keys with private keys effectively reduced to the number 4; browsers were updated quickly, but the video says the system certificate bundle used by tools including curl, Git, Python, Ruby, and OpenSSL had not yet caught up, and curl accepted a site Chrome blocked. The speaker warns that this gap could expose developers using curl-based install scripts—and, theoretically, npm installs—to man-in-the-middle code, and urges users to update.

This Is Bad
ThePrimeagen
x

ThePrimeagen says his ideal coding-agent interaction is a responsive conversation for thinking through interfaces, changes, ideas, and consequences; he gets derailed when asking a question means returning five minutes later. The linked Fireworks promotion claims DeepSeek V4.1 Flash 1017 runs at 1,521+ tokens per second and can generate Tetris in 11 seconds, seven times faster than Claude Opus 5.5; this is a vendor claim, not a firsthand test reported by ThePrimeagen.

This is my dream situation. I want to be able to talk through interfaces, changes, ideas, consequences and think through things. I get so… DeepSeek V4.1 Flash 1017 runs at 1,521+ tok/s on Fireworks Ultrafast. Fast enough to ship Tetris in 11 seconds, 7x faster than Claude Opu…
swyx
x

When AI surfaces bugs, treat the findings as a cue to focus on fixing them quickly rather than blaming AI for exposing them.

imo this is the right attitude - dont blame AI for finding the bugs, just fucking lock in on clearing all the bugs asap [https://www.late…
Riley Brown
youtube
  • Riley Brown reports building an internal workspace with Opus 5.5 in about three hours, combining selected features from Notion, My Mind, and Typefully. It attaches Excalidraw-style boards to video scripts and previews them; he can ask AI to create boards, while editor comments can trigger a webhook back to Claude Code to make edits.
  • For video editing, he asks Claude Code to analyze a recent video and identify cuts that remove tangents and respect viewers’ time. The review returns sections to cut, repeated points to consolidate, and sections to tighten or fix; he then applies the suggested edits in his editing workflow.
  • He also built a Raycast-like desktop app in a single prompt for image search, background removal, and image generation. He uses it for months and reports paying API costs rather than for a separate service; he says it uses Vercel AI Gateway to access models.
How Smart People Are Using AI Right Now (7 Insane Use Cases)
Kent C. Dodds 🐨
x

Kent C. Dodds says Kody can connect 1Password to agents so they cannot access the secret, users can restrict how it is used, and one setup works across agents. In 1Password’s described flow, the agent requests a vault credential at sign-in; after approval, 1Password autofills it directly into the destination, keeping the credential from the agent, and access requires opting in to a connector. Kody can also work with other password managers—Dodds mentions a Bitwarden user—and supports building a custom secret provider.

You can connect your 1Password to your agents through Kody as well: [https://kody.codes/@kentcdodds/onepassword](https://kody.codes/@kent… Today we announce 1Password for Agents platform, building with companies [@Muse](https://x.com/Muse), SpaceX Super Intelligence Grok [@Bo… Oh, and you can do this with any password manager by the way. We've got one user doing this with bitwarden as well: [https://kody.codes/@… You could literally build your own secret provider if you want [https://kody.codes/docs/secret-providers](https://kody.codes/docs/secret-…