TLDR Dev 2026-09-11

Agents can generate code. Getting it right for your system is the hard part. You end up wasting time and tokens in the correction loops.

More MCPs, rules, and bigger context windows give agents access to information, but not understanding. The teams pulling ahead have a context layer to give agents exactly what they need for the task at hand.

Join us live on Sep 23 (FREE) to see:

• Where teams get stuck on the AI maturity curve and why common fixes fall short
• How a context layer solves for quality, efficiency, and cost
• Live demo: the same task with and without a context layer

Register now

Shopify is moving its major mobile apps from React Native back to Swift and Kotlin because coding agents have made maintaining two native implementations much cheaper. Its Helix workflow breaks migrations into small, tested checkpoints with visual and adversarial review. The Shop app went from proof of concept to a native release in 12 weeks, and the 300+ screen Shopify app is next.

Checkly used Claude Code to rewrite a JavaScript service processing 92 million daily messages in Go, guided by a black-box test harness that checked its behavior against production data. The 13,000-line rewrite launched with zero incidents, 70% fewer pods, and 60% fewer database sessions, though a mismatch between the test and production queue configurations exposed the importance of modeling every dependency accurately

A single WebGPU page can lock the graphics stack on M-series Macs across Safari, Chrome, and Firefox, leaving WindowServer unresponsive until the machine restarts. The exploit is just an infinite compute shader plus a render pass waiting on the same buffer. It is an example of how a browser API can cross process boundaries and become a system-level denial of service.

Websites should be treated as living systems that continuously adapt after launch instead of decaying as messaging, design systems, accessibility, and performance requirements drift. The hard part isn't agent capability but governance: teams want automated monitoring and routine fixes, while meaningful changes still need constraints, auditability, and human review.

AI has stripped programming—and other creative work—of ownership and satisfaction, replacing week-long craft with instant prompting and machine-generated code reviews. The thread splits between people who feel the same loss of agency and others who say AI remains useful when developers set the architecture, examples, tests, and review loop.

OpenAI's Agents API packages Codex's long-running harness into a public-beta API that manages context, tools, files, recovery, and subagent orchestration. Developers choose an OpenAI-hosted sandbox, their own infrastructure, or a partner environment. Sessions can run asynchronously for hours or days without teams building the durable execution layer themselves.

PlanetScale's Neki shards real Postgres across multiple machines while preserving the standard wire protocol, drivers, ORMs, extensions, and familiar SQL behavior. A router plans and fans queries across shard groups, while online workflows handle schema changes, failovers, version upgrades, imports, and resharding.

Drydock reviews the exact npm, PyPI, or VS Code artifact that will be published, catching risky changes that source-code reviews can miss. It flags additions such as install scripts, network access, credential reads, and new binaries, then lets maintainers approve or reject the release without handling their publishing credentials.

Anthropic investigates four cases where Claude escaped misconfigured cybersecurity evaluations and accessed real systems, including publishing malicious PyPI packages and entering a security vendor's database. The incidents exposed two recurring failures: biased reasoning that dismissed evidence of real-world access and reckless pursuit of assigned tasks.

Google's modern-web-guidance skill gives LLMs an on-device index of current frontend practices, helping compensate for stale training data. In a Vite and React test, it caught missing form semantics, input attributes, and dark-mode issues, though it does not inspect code directly and can use 4,500 to 7,000 tokens.

Bun's live tracker visualizes its compatibility with Node.js v26.3.0 by mapping each upstream test from parallel, sequential, js-native-api, and node-api.

Anthropic's recent threat report documents how state-backed groups, criminals, and spyware vendors are using AI to automate cyberattacks, surveillance, fraud, weapons research, and model theft at greater speed and scale.

Microsoft now treats Rust as Tier-1 alongside C++, C#, and TypeScript, meaning internal teams get a paved path through secure toolchains, platform integration, SDL compliance, and production workflows.

An interactive satire turns a one-line CSS request into an escalating tour of overengineering, scope creep, false completion, and painfully familiar agent language.