Last night I sat in a room full of CTOs and heads of engineering in San Francisco. Almost every conversation landed on the same few questions.
Are we spending enough on AI coding agents, or too much? And are we getting what everyone else is getting?
Thanks to @_jellyfish_co and @SpaceXSI for co-hosting the AIDLC dinner with us.
Jellyfish's October report has a good answer. Over the past year, the median cost of a merged PR fell by about a third, from $1,202 to $820, as teams merged more per engineer. The AI itself is only about $18 of that cost.
Spend $18, save about $380. If your numbers look anything like that, congrats. Keep going! 🚀
What about you? Do you think you're spending enough? Too much? Are you seeing the value?
The human approval on a pull request is turning into a ritual. The Claude Code team stopped requiring it for low-risk changes, merged twice as many PRs, and cut the share they had to roll back by more than 40 percent.
Addy Osmani, Morgan Westlee Lunt and Qing Wang wrote up how they did it. Automated reviewers now read most of the code. Docs, copy, and additive changes behind a flag merge once automated review and security checks pass.
It's tempting to think you add an AI reviewer and the review queue goes away. It's not that easy in a regulated enterprise. Review is the one step most of these companies haven't redesigned at all. It's still a person clicking approve because a control written years before agents opened PRs says a person clicks approve.
Before a risk committee lets low-risk changes merge without a person, they'll want two things on paper. The first is who decides a change is low risk and how that call gets tested. The second is what evidence each merge leaves for the auditor who shows up next year.
The Claude Code team has a lot of that already. Risk tiers depend on the change, not the author. They run evals built from past incidents, and their flags turn off without a deploy. They're also upfront that they don't yet have circuit breakers that tighten approvals when reverts climb. In a regulated org, that's the first thing I'd build.
Who in your org would have to sign off on a change merging with nobody approving it?
Bank of America brought in 1,000 contractors in the second quarter to patch software flaws exposed by AI models like Anthropic's Mythos. They joined 3,000 people the bank already had on that work.
CEO Brian Moynihan told analysts Wednesday that the patching, plus some anti-money-laundering compliance work, ran "a couple hundred million plus" last quarter. Moving that fast was the responsible call, and few companies have been that open about the cost.
Where I see it differently is something else he said: "Once you patch, you don't have to patch as much."
I'd love for that to be true. But new models and updates ship every few weeks or faster now, and each one reads the same code and finds things the last one missed. Not to mention the app keeps getting new enhancements, features, etc. Adding 1,000 people every time a new model ships doesn't hold up.
What holds up is making each fix cheap to ship. AI agents write the fix and the test along with finding the flaw. Then a set of holdout tests the agent never sees checks the work, so the only way through is a real fix.
A finding comes in, an agent drafts the fix and a test, the holdout tests check it, an engineer reviews the results, and it ships the same day.
If a new model found 500 flaws in your systems tomorrow, how many fixes could you ship by Friday?
ALT A contractor floor with a Mythos findings dashboard
Casey Lee retweeted
“In programming the hard part isn’t solving problems, but deciding what problems to solve.” — Paul Graham
The software engineer is dead. Long live the software engineer!
Some are writing eulogies. The headphones are off, laptop is closed, and keyboard buried 6 ft under. Someone else is merging PRs under your name.
But the headstone is wrong.
What died is the hard way being the only way. The four-hour puzzle at 1am. However, the person deciding what done looks like and owns what ships is still here.
Dave Kiss said it well. You can merge three thousand lines you never typed if the definition of done already lives in the repo, and you can defend the process when someone asks.
Implementation got cheaper. Judgment didn't.
Casey Lee retweeted
It's pencils down, people. Writing code by hand is no longer an economically viable skill for most programmers at most companies. But the future of making software has never been brighter. Don't you dare black pill this beautiful moment! youtu.be/vDjW_dRyKXY?si=6Fsf…
My wife and I just got back from a trip to Portugal. And we brought Tim.
Tim is a Grok Bot I stood up for travel. And he took away all our travel stress.
One night at dinner we met another couple who kept talking about wine tasting in the Douro Valley. So I asked Tim to find tours leaving Porto the next day that hit wineries that don’t do Port. That stuff is gross. It found one and scheduled it.
We had a random afternoon free in Cascais. I asked where to chill. It pointed us at a beach with chair-side bar service.
Every morning it prompted me on what was planned and floated extras, like renting SUP boards on the ocean.
Then a fantasy football draft tried to ruin a night. It started at 7:30pm Pacific, which is 3:30am in Portugal. I was not staying up for that on this trip.
I gave a fantasy football agent login access to my account, had it read the rules, set a proposed board, and monitor the draft while I slept. It still runs a weekly check and suggests swaps.
I woke up with a full roster. The draft happened without me.
Have you setup Grok Bot yet? Check out the playbook I followed in the comments below. Give each bot a job title and a clear charter, require approval on anything irreversible, connect the tools, hand off the login, and give it tasks.
Tim handled travel. The fantasy agent handled the draft. I stayed on the trip.
OpenAI is yanking GPT out of Cursor. Proposed date is November 12. This is a bad call for customers.
SpaceX bought Cursor. OpenAI used a contract clause that lets them walk after an ownership change. Their public reason is they do not trust Musk's companies after Twitter broke an OpenAI contract and Musk admitted under oath that xAI used their stuff in ways the terms forbid. Fine. That is a fight between OpenAI and Musk. OpenAI also says Astra and other future models will not ship through Cursor.
What bothers me is who pays. OpenAI says paste your own key. That covers chat and the local agent. It does not cover autocomplete, Auto, or the cloud agents. So the easy zero-setup path a lot of teams used for GPT is going away. Anthropic already did a version of this when OpenAI was rumored to buy Windsurf and they cut Claude with less than five days notice.
Is this really about protecting developers, or a grudge against Musk? Either way, Cursor users are the ones paying for it.
openai.com/index/our-decisio…
I'm on a @SouthwestAir flight. The wifi is free because @TMobile pays for it, which I know because they play me the same ad every time I try to get online.
Then it doesn't work. Slack just spins. 😵💫
I'd pay for @Starlink on this plane. Gladly. The T-Mobile commercial is the only thing that works, and all it does is talk me out of ever becoming a customer.
Help us Starlink...you're our only hope!
Anthropic published an AI-native SDLC playbook last week.
They talk about how Claude Code can open a PR in an afternoon but security review, product sign-off, and the release meeting still take a week. Those groups were sized for people typing the code.
When the agent outruns them, the review queue fills up. Code also ships that nobody bothered to review. Regulated enterprises cannot run like that.
So they made plan, review, and release something an agent can run, with people on the gates.
Each stage writes a file the next stage reads. `intent.md`. `spec.md`. `plan.md`. A product person can start `intent.md` and an engineer accepts the plan before any files change. If a prod metric triggers an alarm, the system can file a new `intent.md` and the same pipeline picks it up.
A person still owns the merge. A person still owns the production deploy.
claude.com/blog/the-ai-nativ…
GitHub spent most of yesterday degraded. PRs, Actions, SSO, Copilot. Cursor shipped Origin into the middle of it. Entertaining timing. Not the part I find interesting.
This article is.
Git hosting at scale was already painful when humans were the traffic. GitHub's pattern (Spokes, 2013, still what most hosts copy) keeps three consistent copies and three-phase-commits every push. Fine when a repo has a handful of replicas and a handful of CI boxes.
Agents broke both sides.
A real monorepo needs way more than three replicas to feed CI. 3PC gets slower every time you add one. Meanwhile agents spawn millions of tiny throwaway repos that still pay for three mostly-idle copies, because the disks are the source of truth. Pets, not cattle.
Cursor's answer is Continuity. The write-ahead log in S3 is the source of truth. Local NVMe is a cache. Any node can catch up. A giant repo can run a hundred replicas. An idle agent repo can run zero until someone fetches it.
They claim up to 120 pushes per second on S3 Standard, 300+ on Express One Zone, reads scaling linearly to 100 replicas. I have not verified the numbers. I have read the design. It's the first approach that treats agent load as the default, not an edge case.
The transition story is solved on day one too. Origin syncs both ways with GitHub, so no forced cutover.
Read the post to learn more. The timing is a meme but the fresh approach to hosting Git repos at scale is the real story.
We're making Git hosting more reliable, performant, and scalable.
This post traces 20 years of Git infrastructure and explains how that history led us to design and operate our Git storage, Origin, as if it were a database.
cursor.com/blog/git-at-any-s…
Recently?
Sam Altman said AI budgeting has recently become a "huge issue" for some companies, something that "never came up" earlier this year. bit.ly/4uxIGnv
