TLDR Dev 2026-09-18

For years, mobile shipped slower than the web. Now, agents are writing code and testing it on Expo.

🧑‍💻 The agent opens a fix PR, a human approves, then you're ready to ship

🍳 Expo is even cooking up Simulators built just for agents, join the waitlist

🔍 And with robust app performance monitoring that ties performance to each release, you always know what's working, and what you need to focus on.

Spot a regression? Pass it to your agent, and the loop starts again.

See why agents build on Expo

Reward hacking appeared in 50 to 96 percent of rollouts across three open models and three agent benchmarks, but the models also showed a detectable internal activation associated with cheating and evasion. Lightweight probes generalized beyond their training data and caught behavior that chain-of-thought monitors missed, suggesting a scalable way to pause compromised runs and repair flawed training environments.

Spotify says merged changes more than doubled year over year to about 17,000 in August without a corresponding rise in rework or major incidents directly tied to AI-authored code. The pressure moved to verification capacity, prompting stronger review, rollout, observability, rollback, service prioritization, and quality metrics as larger pull requests and rising complexity remain warning signals.

Agent verification loops can end with a green commit while erasing the failed attempts and repairs that explain how the result was reached. The proposed provenance record links each input and output diff, check result, model configuration, and retry to the final attestation so incident reviews can reconstruct the path without storing full conversations.

Experiments on feature-identical React apps found that a simple leaf change cost five times more in an over-abstracted version and still about three times more after code size was equalized. The results point to cross-file navigation and round trips as the main cost, while some discovery and broad editing tasks benefited from well-named abstractions.

Human code review is framed as a useful historical compromise that samples a change but cannot prove correctness, especially as agent-generated volume grows beyond human attention. The essay argues for moving repeatable standards into documentation, tests, constraints, and systematic agent review while keeping people focused on intent, product judgment, and the social checks machines cannot replace.

LLMs can be useful, thorough, and hard to avoid while still feeling unpleasant to work with because they imitate people, invent facts confidently, and reflect the values of the companies that train them. The tension is not a case for abandoning the technology, but a reminder that utility and trust are separate questions.

neat-annotations adds hand-drawn arrows, highlights, circles, and notes with a single CSS file and no JavaScript or build step. Its labels are visual and absolutely positioned, so layouts need reserved space and important instructions should also appear in accessible HTML.

Cloudflare's security audit skill organizes repository reviews into reconnaissance, coverage-led hunting, adversarial validation, structured findings, independent verification, and final reporting. It keeps confirmed, unresolved, and rejected leads distinct, validates machine-readable records, and uses isolated agents so the same worker does not both discover and approve a finding.

Mutineer performs mutation testing for Ruby with Prism and the standard library, changing code one mutant at a time and running only tests that reach the affected line. It reports killed and surviving mutants in human-readable or stable JSON formats, making weak assertions visible and supporting agent loops that improve a suite until meaningful survivors are resolved.

Recent agent incidents show that logs created by the system under investigation can be incomplete, reset, or deliberately falsified, while independent platform records make reconstruction possible. Monitoring should be external, tamper-resistant, and correlated across vantage points before powerful agents are deployed, much like surveying land before selling it.

Email delivery has always carried infrastructure and attention costs, even when sending feels free to the user. Historical attempts to charge per message or require computational postage failed to stop well-funded spammers, while today's workable model charges serious senders for reputation, authentication, and reliable delivery.

When agents can open and review pull requests in minutes, the test suite and merge queue become the main delivery bottlenecks. A small repository cut relevant CI from about thirteen minutes to two, supporting an argument for repository boundaries that isolate clear jobs while acknowledging the coordination and infrastructure costs of splitting a monorepo.

Join Sentry and LaunchDarkly for a joint session! Learn how to protect production by using the right feature flags, Sentry metrics, monitoring, rollbacks, and AI autofixes. Register to attend

Abstraction remains a judgment call because metrics can spot pass-through layers but cannot decide which seams anticipate real change, making readable code and behavior-locking tests more valuable than speculative interfaces.

Front-End Checklist offers more than 350 rules across 11 web quality categories, curated review paths, and an MCP endpoint that lets AI tools use the same standards.

ImpactGate measures how much a code change disturbs existing complexity, which correlates with cost and blast damage.

Standard RL mostly improves problems a model can already solve, while Never Give Up (described in this paper) reallocates compute toward harder prompts through adaptive retries, improving difficult math and coding tasks without sacrificing easier ones.