ClarityBeta

Product & Strategy

The Product Desk

9 min read · 1,717 words · 3 moves to watch
The Signal

Figma pushed its AI code reviewer from 15% to 80% precision without touching the model.

The work in between was eight weeks of labeling false positives from real pull requests, plus a second-pass adjudicator. Any AI-judgment feature on a roadmap, whether it's triage, scoring, or moderation, demos at the low end of that range. The distance to something you'd actually ship is a labeling sprint, not a model release, which means the GA date you're defending should have those weeks written into it before someone else books them as a bug fix.

In Play

  1. Verification Beats Model Choice

    Figma published before-and-after numbers for its agentic code reviewer: 15% precision with a frontier model and a good prompt, 80% after hand-labeling false positives from eight weeks of real pull requests. That is the distance between the AI feature you demo at an all-hands and one users leave switched on. Running Claude Code and Codex in parallel lifted the union catch rate to 75.8% on 66 real bugs, making two-provider ensembling a product decision rather than a procurement hedge.

    Ask Clarity
    Try

  2. Forged Citations, No Forensic Trail

    Researchers at OFFENSAI and TUCN showed that anyone holding the s3vectors:PutVectors permission can write forged chunk text and spoofed citation URLs into an Amazon S3 Vectors index, and that the injected metadata passes downstream filters untouched. In a clinical case study, one planted vector drove a dangerous drug-dose recommendation while citing an authentic, unmodified source PDF. If your product answers hallucination risk with "we show sources," that control has now been falsified in print.

    Ask Clarity
    Try

  3. Supply Grew 40x, Revenue Grew 9x

    Researchers from Stony Brook, Columbia, Michigan and the MIT Initiative on the Digital Economy, summarized by a16z, measured the self-published book catalogue growing about 40x since 2023 while revenue grew only about 9x — revenue per title fell roughly 77%. Titles with detectable AI text now take about 40% of observed sales. Any surface where users can generate supply inherits that arithmetic, which makes ranking and slot scarcity dependencies of the generate button. Caveat: the 40% figure rests on AI-text detection the author himself calls thin.

    Ask Clarity
    Try

  4. Bundling Removes Budget Lines, Not Features

    Qualys conceded on the record that "traditional scanning and detection have indeed become table stakes" and repositioned to exploit validation and remediation, per The Bear Cave's teardown of Tenable. A CISO quoted in the same piece said that with CrowdStrike already on the endpoint you can drop vulnerability management entirely and still check the regulation box. Mandated demand is a volume floor, not a pricing floor — the same logic hits any feature of yours sitting as a standalone line item next to a platform the account already bought.

    Ask Clarity
    Try

  5. Safety Metrics Scoped To One Turn

    Research found multi-turn image generators completed hateful comic-style story prompts up to 99% of the time, while the single-turn filters in front of them caught only 35–67.5% of the resulting image sets. A dedicated conversation-level monitor caught 97.3%. If your content-safety metric is measured per request, it can read 98% safe while most harmful sessions complete. The fix is measurement scope, not a better classifier.

    Ask Clarity
    Try

Deep Dives

The 15%-to-80% Gap Is Labeling Work, Not a Model Upgrade

Three independent teams converged on the same finding: what separates a demo from a feature users never disable is failure data and a second opinion, not a better base model.

What the interventions actually bought

A Figma engineer opens a pull request and gets back a finding that is actually correct. That is the whole product, and the model is not what made it correct. The system runs on one shared threat-model policy of 68 precedents across three surfaces. It guards code at generation time, reviews every pull request, and audits a decade-old monorepo. The precision climb came from failure data rather than prompt cleverness: eight weeks of real pull requests, with false positives hand-labeled into a corpus. An adjudicator second pass, a cheap reviewer stage that re-reads each finding before it reaches a human, added roughly 30% recall on top of that.

Two more results belong in the spec, and they are the two most often skipped. Running Claude Code and Codex in parallel produced a 75.8% union catch rate across 66 real vulnerabilities (46 from HackerOne, 20 from incidents and internal audits), because the two models miss different bug classes. Prevention also outperformed detection: agent hooks enforcing secure-by-default patterns at authoring time produced about 50% fewer logging safety bugs. The backfill sweep of the old monorepo turned up 100+ latent vulnerabilities, two of them critical, that traditional static analysis missed.

Where the evidence agrees, and where it splits

The sources agree on the negative claim. Nobody credits the base model for the improvement. They split on the cheapest first move. Stanford's work, summarized by DeepLearning.AI, found that ten models asked explicitly for secure code still shipped flaws in 20.1% of programs; the free-for-commercial-use SecureForge system prompt cut that to 11.8%, with GPT-5.4 going from 15.8% to 10.1%. Devshot reports auto-tuned instructions cutting cost about 32% while lifting task success by up to 21 percentage points. Read that as sequencing rather than a debate. The system prompt is days of work for a large relative gain. The labeled corpus is the asset that no vendor delivers.

The third component is who owns "done." What teams tell themselves is that a capable model with tools available will use them. What happened in a documented agent session is roughly two and a half hours, three context overflows and a mid-session model swap on a task that a properly specified instruction closed in 13 minutes. That instruction said install it, test end-to-end, name the edge cases, iterate until it passes. Tool availability is not tool invocation. Browser and computer-use tools sat unused until prompted, so the delivered artifact had never actually run.

A frontier model plus a good prompt is a 15% product. The 80% version is built out of labeled failures, a second-pass adjudicator, and two models disagreeing with each other.

The differentiator with the shortest shelf life

"AI suggests the fix" as a roadmap wedge deserves an honestly priced window. Google has shipped DeepMind's CodeMender into OSS-Fuzz, auto-generating compile-and-regression-validated patches, with automatic enrollment for existing projects. Verification is consolidating into a paid category of its own; Signadot's positioning is literally "AI writes code. Signadot makes sure it works." And be disciplined about claims: Anthropic's own Claude Mythos 5 documentation records cases where the model falsely stated it had verified code. The forcing function for the next planning cycle has two axes: does the feature generate the finding or adjudicate it, and does the labeled failure corpus belong to the team or to a vendor. The defensible cell is adjudication plus an owned corpus. "AI-verified" is a liability sentence wearing a feature bullet.

What to do

  1. Add a 50+ case labeled eval set and a second-pass adjudicator to every AI-judgment feature in flight this sprint, with a named precision floor as the GA gate

  2. Add a Verification Criteria block to the PRD and ticket template this sprint — executable done-criteria per task type, plus a plan-review gate before any agent is authorized to build

  3. Ship the free optimized security system prompt plus a static-analysis gate on any surface that generates or executes code this quarter, then delete the word "verified" from product copy

Forged Citations Passed Every Filter You Have

The industry-standard answer to hallucination risk — show the user a source link — just failed a documented test, and the audit trail that would catch it is switched off by default.

The permission, not the product, is the hole

A support engineer opens the answer a customer flagged. The citation resolves. The document is genuine and unmodified. She marks it working as intended and moves on. OFFENSAI and TUCN found Amazon S3 Vectors itself sound; the exposure sits in who may write to it and what gets validated on the way in. Any principal holding s3vectors:PutVectors can inject unvalidated metadata: forged chunk text, spoofed citation URLs, fake data-source identifiers. Separately, a single s3vectors:PutVectorBucketPolicy call from a compromised principal grants a foreign AWS account full cross-account read, write and delete on the data plane, while the control plane still looks owner-only to whoever is auditing it.

Here is what teams tell themselves the failure mode is: a wrong answer that looks wrong. Here is the one they actually get. A wrong answer that looks better sourced than a right one, because the citation resolves to a genuine, unmodified document. That inverts the mitigation most AI features ship, which is retrieval plus visible sources as the trust affordance.

You cannot reconstruct it afterward

CloudTrail data events for S3 Vectors are off by default. Even enabled, the request payload strips vector keys, embeddings and metadata, so a responder learns only that an index was touched. Poisoned retrieval, unvalidated writes and no forensic trail is the combination that turns a support ticket into a compliance conversation. For whoever builds the missing controls, it is also an obvious product gap.

Provenance is being audited from both ends

Elsewhere, a16z's summary of marketplace research carried the inverse warning about provenance asserted rather than validated. The widely quoted share of AI-generated books rests on AI-text detection with an unverified error rate, using tells as thin as em-dashes. The recommendation there is the one a RAG spec needs too: ship auditable provenance (self-declared disclosure, creator verification, edit history) before shipping detector-driven penalties or trust badges nobody can defend.

The shop window gets screened too. The top design item in the developer community reading, at 785 votes and 461 comments, argued that AI-generated hero images discourage people from reading the page at all, alongside a working artist documenting being falsely accused of using AI. The suspicion costs the reader whether or not it is true, and nobody files a churn reason that says the illustration looked generated.

If your answer to hallucination risk is "we show sources," you are shipping a trust affordance, not a control — and the difference is documented.

The pattern

Two axes are worth drawing before the next sprint review. First, whether a buyer can independently reproduce the claim about output quality or only take it on report. Second, whether provenance is validated at write time or asserted after the fact. Self-reported verification, detector-driven labels and citation UI all sit in the cells that are losing value. What holds is a validated write path, a logged mutation history, and a disclosure the user made themselves. Moving out of one cell this quarter beats hedging across all four.

What to do

  1. Schema-validate all retrieval metadata and scope write permissions away from ingestion services, then enable index-mutation logging with payload attribution

  2. Strike "verified," "secure" and citation-as-safety language from product copy and docs this sprint, and replace the claim with a stated validation control

  3. Ship self-declared provenance and edit-history signals before any detector-driven ranking penalty, and audit detector false-positive rates on a labeled holdout this quarter

Production Got Cheap. Discovery, Review and Adoption Did Not.

Four unrelated datasets locate the same bottleneck one layer downstream of shipping — and one marketplace already ran the experiment to completion.

The queue moved, not the delivery

An engineering lead opens a dashboard where merged pull requests are up 98% and review time is up 91%, and reports the first number upward. Both come from the same Faros AI telemetry across 10,000+ developers. Merge count measures how much work arrived at the review queue. It does not measure what shipped, and any delivery date committed on that throughput figure is a date built on a category error. The harder wall sits below review anyway. Anthropic recommends a separate git worktree per parallel coding agent, which isolates the code and leaves four agents' changes queued behind one staging cluster, one seeded database and one message queue. Blocked agents validate against mocks, and the rework shows up later.

The marketplace version of the same story, finished

Self-publishing is the cleanest completed natural experiment available, because the curve already finished running. Here is the arithmetic a16z's summary leaves out: catalogue growth outran revenue growth by about 4.4x, which puts revenue per title at roughly 23% of its 2023 level. The market got materially larger and the median seller got poorer. The pain distributes unevenly in an instructive way. AI-touched titles hold at least 10% of the Top 25 in every genre and about 40% in Sci-Fi, Adventure and Dystopian, because entry cost collapsed while the number of visible slots stayed fixed.

Aaron Stannard's framing, surfaced in the engineering-leadership reading, generalizes it: roughly 30% growth in software supply against 3% growth in utilization. Treat that ratio as directional — he states no denominator or window — but it is enough to invalidate the most common roadmap justification of the last two years, which is that shipping faster is the constraint.

What is still expensive to reproduce

The Bear Cave's teardown put a price on build-cost collapse. An undergraduate with a coding agent reproduced a vulnerability scanner in about a week and, the authors claim, caught issues a multibillion-dollar vendor's tool missed. The authors concede they got "surprisingly close" rather than better, and they never attempted the full enterprise stack. That concession is the finding. The feature was a week of work. The integration depth, audit evidence and workflow lock-in were not.

Arvind Narayanan's "missing middle" supplies the feasibility gate that follows. Coding agents work because the software industry published its intermediate artifacts — specs, pull requests, code reviews — so models learned collaboration rather than imitation. Run that test one feature at a time. Rich intermediate artifacts, meaning revision history, review threads, rejected drafts, justify real autonomy. Finished outputs alone justify assistive drafting with review, and nothing past it. Where those artifacts could exist and nobody captures them, that is the moat, and it is the one AI data asset a competitor cannot license.

Aggregate volume hid a 77% per-unit collapse in one market for three years. It will hide yours too.

What to do

  1. Ship ranking, dedup and slot-scarcity work in the same release train as any user-facing generate button this sprint — or hold the generate button

  2. Replace PR and merge volume with review cycle time and rework rate on the velocity dashboard this sprint, and take environment provisioning to platform planning with the throughput data attached

  3. Tag every current-quarter roadmap item as supply-side or utilization-side and report the ratio to your engineering lead and GM this quarter

The bottom line

These items describe a division of labor nobody chose: machines took over producing the output, and humans still own every step that certifies the output is correct, findable and wanted. That retires the last comfortable planning assumption — that capability shipped equals value delivered — because the scarce inputs are now labeled failure data, review capacity and a claim about provenance you can defend under challenge. Pick the AI surface carrying the most revenue and spend this week building the evidence layer beneath it: a labeled corpus, a named quality floor, and a written record of what the feature promises versus what it actually enforces.