The Engineer

The Trajectory Is Exponential, and It's Top-Down

Google's AI-generated code went from 25% (Oct 2024) → 50% (late 2025) → 75% (April 2026) — a tripling in 18 months. This isn't organic grassroots adoption: Google now has mandatory quarterly AI code generation targets per team. Snap is at 65%, Meta targets 75%, and Microsoft's CTO projects 95% by 2031 despite sitting at just 20-30% today. The gap between Google at 75% and Microsoft at 25% — despite Microsoft owning Copilot — tells you the bottleneck isn't the AI tool. It's the organizational infrastructure around it.

The Tolaria Proof: 100K LOC, Zero Human-Written Code, One Critical Finding

Tolaria shipped 100K+ lines of code, 2,000+ commits, 3,000+ tests, and 70+ Architecture Decision Records — with zero human-written code — and gained 6,000+ GitHub stars in under a week. But the most important engineering finding buried in this codebase is that AI agents reliably ignore instructions in CLAUDE.md. This isn't a bug; it's a fundamental characteristic of probabilistic systems. If you've been treating your .cursorrules or CLAUDE.md as quality enforcement, you effectively have no enforcement.

Treat agent instructions as advisory, not authoritative. The only reliable enforcement is the CI pipeline.

The Three-Gate Model

Tolaria's architecture uses defense in depth: rules live in the agent config (followed most of the time) AND are enforced again in CI (caught every time). Three specific gates:

1. Test coverage thresholds — LLMs write code that compiles and runs but lacks tests
2. CodeScene health scores — catches unnecessary complexity, tight coupling, cognitive load
3. Library and docs currency — blocks hallucinated deprecated APIs and outdated dependencies

Bryan Cantrill's observation completes the picture: LLMs lack the 'laziness instinct' that drives human programmers to build abstractions. They'll generate the same utility function in every file. This makes duplication detection (jscpd, PMD CPD) critical CI infrastructure for AI-generated code.

The Harder Problem: Misaligned Code

'Bad code' — missing tests, high complexity, duplication — is now genuinely solvable with the right gates. But misaligned code — structurally clean, architecturally wrong for where your product is heading — is arguably harder to catch with AI in the loop because it passes every automated metric. This is why Tolaria's 70+ ADRs matter: they encode architectural intent that AI can't derive on its own. If you're scaling AI code without a robust ADR practice, you're accumulating strategic debt invisible until you need to pivot.

Claude Code's Quiet Takeover

Applied Intuition's CTO reports Claude Code has overtaken Cursor as the dominant AI coding tool among their 1,000 engineers — including for embedded C++/Rust and GPU shader code, domains where AI assistance was 'underwhelming' just 6 months ago. The bimodal productivity gap between engineers who invested in AI tools vs. those who didn't is now described as 'enormous.' If your team evaluated AI tools for systems-level work before mid-2025, that conclusion is stale.

Fresh-Session-Per-Turn: The Pattern That Changes Multi-Agent Economics

WUPHF's most important contribution isn't the product — it's the memory architecture. Instead of accumulating conversation history across turns (the default in LangChain, CrewAI, and most orchestration frameworks), WUPHF starts a fresh session every turn and relies on a BM25+SQLite-backed markdown wiki for persistence. Agents draft in private notebooks; durable artifacts get promoted to a shared wiki with git-backed history.

~87K tokens per turn with 97% prompt cache hit rate vs. ~484K tokens for accumulated sessions. That's an 82% reduction with a flat cost curve that doesn't grow with conversation length.

The architecture trade-off is explicit: accept retrieval latency and potential recall misses from BM25 in exchange for predictable token costs. The BM25 choice over vector search is pragmatic — deterministic, requires no embedding model, and keyword matching on structured markdown is sufficient. The git-backed wiki gives you a full audit trail of what agents knew and when.

MCP Production Patterns from 200+ Server Deployments

Anthropic published the most practically useful MCP guide to date, drawn from 200+ production deployments. Three patterns worth internalizing immediately:

1. Group tools by agent intent, not API surface. If your MCP server has a tool per REST endpoint, you're creating a tool-selection problem that burns tokens and causes selection errors. Bundle related operations into intent-aligned tools.
2. Code Mode for complex APIs. For anything with 100+ operations (AWS, K8s), expose a single tool that accepts code + a sandbox. The agent writes a script using the full API. Cloudflare's MCP implementation is the reference. This converts tool-selection into code-generation — which current models are much better at.
3. Lazy-load tool definitions. Don't stuff all tool schemas into the system prompt. Load them at runtime based on the agent's current task. This alone yields a 37% token reduction.

Amazon COSMO: Remove the LLM from the Serving Path Entirely

Amazon's COSMO system provides the third pattern — a two-tiered cache architecture that eliminates real-time LLM inference from the serving path. Tier 1 pre-loads responses for historically frequent searches; Tier 2 batch-processes daily for the long tail via SageMaker. The LLM (OPT-175B on 16 A100s, chosen for privacy) generates knowledge offline; only 9-35% of outputs pass quality filters. The rest is rejected. Production serving uses distilled LLaMA 7B/13B endpoints.

The leverage ratio is striking: 30K human annotations → 29M production knowledge edges (~967x). A 0.7% sales lift on 10% of traffic generated hundreds of millions in revenue. But the architecture lesson generalizes: the LLM is a batch job, not a serving dependency.

How These Patterns Compose

GlassWorm and the Checkmarx Chain: IDE Extensions Are First-Class Threats

Two separate attacks hit developer toolchains this week through the same vector: VSCode extensions. Socket Security identified GlassWorm — a self-replicating worm infecting 73 VSCode extensions. Separately, a malicious Checkmarx extension on a single Bitwarden engineer's workstation harvested npm publish tokens and pushed a poisoned @bitwarden/[email protected] to the registry. Within 93 minutes, 334 users had installed it, with tokens, SSH keys, and environment secrets exfiltrated via a preinstall script.

Your developer's IDE is now a first-class supply chain attack surface. Most organizations treat VSCode extensions as personal preference — no review, no allowlist, no monitoring. That assumption is broken.

The propagation chain is what matters: IDE extension → npm token theft → poisoned package → 334 downstream users in under two hours. This isn't a CI/CD pipeline attack or a lockfile manipulation — it's developer workstation compromise cascading into registry poisoning.

GitHub's Silent PR Reversion

On April 23, a GitHub outage silently reverted merged code across 2,000+ pull requests during a three-hour window. This isn't a compromise — it's a data integrity failure in your source of truth. If your CI/CD pipeline assumes 'merge succeeded = code is in main = deploy is safe,' that invariant broke silently. Any artifacts deployed from that window may not contain the code you think they do. Cross-reference deployed artifacts against expected commit SHAs for April 23.

Distillation Supply Chain: A New Class of Unauditable Risk

A Nature paper (Cloud et al.) proves that distilled models inherit undetectable behavioral traits from teachers that survive aggressive data filtering. The effect is strongest when teacher and student share the same base architecture — the exact configuration used when labs train new models on synthetic data from prior checkpoints. Every frontier lab does this.

The compliance implication is severe: data inspection cannot catch what data inspection cannot see. EU AI Act auditability assumptions and NIST RMF evaluation frameworks are architecturally broken if behavioral traits propagate through hidden signals. You need lineage-based attestation — cryptographic provenance chains tracking every teacher model, every distillation step, every filtering operation.

Google's Five-Category Prompt Injection Taxonomy

Google published observations of prompt injection attacks in the wild, organized into five categories: pranks, AI summary manipulation, SEO gaming, crawler deterrence, and malicious (data theft, credential theft, and machine destruction via AI agents). That last category — an LLM with tool access being redirected by injected input — is the confused deputy problem reborn for AI. No robust general-purpose defense exists. Design for defense in depth: input filtering, output validation, action confirmation gates, least-privilege tool access.