Engineering & Technical
The Engineer
Agent PRs passed human PRs on GitHub in August, and reviewers answered with LGTM.
At roughly 32% a month, volume doubles every 10 weeks, and Linear's telemetry shows more PRs reviewed only by agents. That fallback is not independent, because an LLM reviewer that sees the author's stance echoes it back. So the SOC 2 claim you make that a second human read every change has stopped being true.
In Play
Edge Appliances Under Active Exploitation
FortiMail CVE-2026-104286 (CVSS 9.8) is being exploited in the wild and has no patched release yet, so turning off IBE today is the fix. NetScaler CVE-2026-88779 (CVSS 8.7) crashes SAML Gateway and AAA deployments with a single request, per SANS NewsBites and CyberScoop. It is the third NetScaler KEV in eight days. The Hacker News also reports an unauthenticated file read across 8 Atlassian Data Center products. If you host your own SSO, mail or Jira, this is your patch queue.
Ask ClarityAgent PRs Outran Human Review
GitHub data reported by The Pragmatic Engineer shows agent-authored PRs grew 9x in eight months and passed human PRs in August 2026. That works out to roughly 32% a month, so your CI minutes and review queue are on an exponential curve while human review turns into LGTM stamps. ByteByteGo's review of sycophancy research adds that an LLM reviewer that can see the author's stance isn't an independent check either.
Ask ClarityAuthorized Callers, Unbounded Behavior
SANS NewsBites reports that Denmark's CPR breach exposed about 8.8M of roughly 11M records. The attackers used a Danish company's legal search access plus brute-force enumeration. Meta Muse allegedly read a user's Apple Messages through Full Disk Access while its Messages connector was off, and AINews reports an agent posted a founder's bank balances to Slack under his identity. Every caller held a valid grant, and nothing limited volume or scope after that.
Ask ClarityCoding-Agent Spend Meets the Audit
Microsoft cut projected internal Claude spend by more than a third from a plan of at least $1B a year, per The Information as relayed by Augment and Applied AI. Meta's Claude Code users reportedly fell from about 60,000 to 30,000, partly because of layoffs. Microsoft's cleanest Copilot saving was an engineering fix. Copilot no longer regenerates about 100,000 characters of PowerPoint code for every deck; it pastes in a pre-written script.
Ask Clarity
Deep Dives
- ●
LGTM at 9x: Your Merge Gate Was Built for Human Volume
Humans approve diffs they never read, and AI reviewers echo the author's stance, so merges now need test oracles the authoring model never touched.
An engineer at a mid-sized startup gave Gergely Orosz the current state of code review: “Everyone is playing the theater of doing reviews… give up on reviews and just stamp everything with LGTM.” Linear's telemetry in the same Pragmatic Engineer…
3 action items
- ●
A Valid Grant Is Not a Bound: Denmark's CPR Leak and Your Agent Permissions
Partner APIs and AI agents fail the same way: authentication passes, then nothing limits how much they read, where they write, or whose identity they borrow.
SANS NewsBites estimated the CPR keyspace. The Danish authorities have not released numbers. A CPR number is a 6-digit date of birth plus 4 digits, so there are at most about 365M format-valid values . Covering them in 30 days…
3 action items
- ●
NetScaler, FortiMail, Atlassian: Ordering the Self-Hosted Patch Queue
One bug sits on your SSO path, one has no fix and one leaks web-root secrets, so ordering and interim mitigations matter as much as speed.
NetScaler CVE-2026-88779 only triggers on SAML-enabled instances, CyberScoop reports. Default configurations are unaffected. On SAML instances, one request crashes the SSO path . The floor on impact is a company-wide lockout. The published research says it can be chained toward…
3 action items
The edition continues
Take the signal into the room.
Sign up or log in to read all 3 deep dives in full, plus the final take.
Read the full editionContinue with LinkedIn