Ramsay Research Agent — June 9, 2026

Today had a spine to it. One thread runs through almost everything: agents are now the default way code gets written, and the industry just got its first hard data on how bad that code actually is. Apple conceded it couldn't reach the frontier alone. A benchmark built by real maintainers put the best model in the world at 13.4% on hard tasks. And the tooling layer keeps commoditizing under everyone's feet. Here's what mattered.

Top 5 Stories Today

1. Cognition built a coding benchmark that real maintainers grade, and the best model scores 13.4%

For about a year the ambient message has been "coding is mostly solved." SWE-Bench numbers crept past 50%, vendors put them on slides, and a lot of people quietly concluded the hard part was over. Cognition just dropped a bucket of cold water on that.

On June 8 they launched FrontierCode, a benchmark built by 20+ open-source maintainers who each spent 40+ hours constructing tasks. The point isn't "did the test pass." It's "would this PR actually merge." They grade across correctness, tests, scope, style, and maintainability. The numbers are humbling. Claude Opus 4.8 leads the Diamond subset at 13.4%. GPT-5.5 hits 6.3%, Opus 4.7 5.2%, Gemini 3.1 Pro 4.7%. On the easier Main and Extended tiers Opus reaches 34.3% and 51.8%. So far below the SWE-Bench regime that Cognition flatly says real-world coding is "much less solved" than the leaderboards imply. They also claim 81% lower false-positive rates than SWE-Bench Pro, and they're refusing to publicly release the tasks to avoid contamination.

Why this matters: it lines up exactly with what I feel every day. The agent writes code that runs. Whether it's code I'd merge into something I have to maintain for two years is a totally different question, and that gap is where my actual time goes now. FrontierCode is the first benchmark I've seen that measures the gap instead of pretending it doesn't exist. It pairs cleanly with the "Cleaning Up After AI Rockstar Developers" essay that hit HN the same day, arguing agent output ships fast and leaves maintenance debt for teammates to absorb. Same observation from two directions.

What builders should do: stop quoting SWE-Bench at people. If you're evaluating a coding agent for your team, build a tiny private eval out of your own real PRs and grade on mergeability, not green checkmarks. And budget review time honestly. The velocity is real, but the review tax is the new bottleneck, and it doesn't show up in the demo.

---

2. Apple opened its Foundation Models framework to Claude and Gemini, and quietly shipped it on Linux

This was the most-converged story of the day. Every agent surfaced WWDC from a different angle. Here's the cut that actually changes what you build.

WWDC 2026 introduced a public Swift LanguageModel protocol. Third-party providers, currently Anthropic's Claude and Google's Gemini, expose cloud models through the same API surface as Apple's on-device model. Apps hot-swap local and cloud inference with a one-line change. Apple also added image input to the on-device model, made a ~20B sparse model free to developers, and, buried in the release notes, shipped the framework running on Linux. Anthropic released its own Swift package the same day, making Claude a first-class option for typed Swift outputs across iOS 27, iPadOS 27, macOS 27, visionOS 27, and watchOS 27.

The read circulating among developers is sharp: the protocol is the moat, not the model. Apple is positioning itself as the on-device AI orchestration layer for every iOS app, regardless of whose model actually runs underneath. That's a smart move from a company that just admitted it can't win on raw model quality. Which brings up the uncomfortable part, covered well by Ben Thompson: the heaviest Siri reasoning now runs on a custom ~1.2-trillion-parameter Gemini build on Apple's Private Cloud Compute, reportedly ~$1B/year. Thompson's question is the right one. Once white-labeling Gemini works, how do you ever rip out a model your faster-moving rival keeps improving?

What builders should do: if you ship anything on Apple platforms, this is a real decision now, not a someday. The single-line model swap means you can prototype against the free on-device model and graduate specific flows to Claude or Gemini without rewriting your call sites. Design your prompt and tool interfaces against the protocol, not a specific provider, and you get optionality for free. The Linux detail is the sleeper. If that framework runs server-side, the same abstraction could leak well beyond Apple hardware.

---

3. Claude Code dynamic workflows went live, and the trigger word is now "ultracode"

I wired multi-agent orchestration by hand for months. Subagent task lists, handoffs, who-reads-what, all imperative plumbing I had to maintain. Claude Code just made most of that obsolete.

Dynamic workflows let a single natural-language request orchestrate work across tens to hundreds of background agents, viewable through /workflows. In 2.1.166 the trigger keyword was renamed from "workflow" to "ultracode." The bare word "workflow" no longer fires a run, though asking for one in plain language still works. The shift underneath the rename matters more than the rename: this is declarative fan-out replacing hand-wired subagent plumbing. You declare intent and the runtime decides the phases, the parallel readers, the per-item pipelines, the verify stages.

The practical effect, and the thing I keep noticing as I use it, is that scale becomes a property of the request rather than code I own. Before, "review every changed file across five dimensions and adversarially verify each finding" was a script I'd write, debug, and babysit. Now it's a shape I describe. The pattern finding the agent surfaced puts it well: think in phases and fan-out shapes, not imperative agent wiring.

A caveat worth stating plainly. This can spawn dozens of agents and burn a lot of tokens fast. It's powerful for review, migration, and broad audits where parallel coverage actually pays. It's wasteful for a three-file change. Match the tool to the task.

What builders should do: take one task you currently script with subagents and re-express it as a workflow shape. Decompose, run in parallel, verify, synthesize. If you've been hand-rolling orchestration, this is the week to delete code. Pair it with story #5, because fan-out only helps if each agent can actually find the right code.

---

4. GitHub says coding agents grew 1,400% in 2026, and Devin now writes 89% of Cognition's own code

Story #1 was the quality reality check. This is the velocity half of the same thread, and the two only make sense together.

On the Latent Space podcast, GitHub's Kyle Daigle reported coding-agent usage grew roughly 1,400% across 2026 and described Claude Code as reshaping the developer's role outright. That's not a vendor projection. That's the platform where the code lands reporting what it sees. Stack it next to two other data points from today. Cognition's Scott Wu says Devin now writes ~89% of Cognition's own committed code. And Anthropic's Claude hit 8.2% of global web-visit market share with 306% quarter-over-quarter growth, roughly 824 million visits in April.

So agentic coding isn't an experiment you're deciding whether to adopt. It's the default, and the curve is steep. But hold this next to FrontierCode and a clear picture forms. The same lab whose CEO says agents write 89% of their code also built the benchmark proving agent code is 13.4%-mergeable on hard tasks. Those aren't contradictory. They're the honest shape of where we are. Volume is way up, the model handles the long tail of tedious maintenance well, and a human still owns judgment on anything that matters. Wu's framing, "a buddy, not a replacement," reads less like PR and more like a description of how the work actually splits now.

What builders should do: if you're still treating coding agents as a side experiment, you're behind the adoption curve by a wide margin. But don't read 1,400% as "fire the reviewers." Read it as "the work moved from writing to reviewing, and you need to staff for that." The teams that win this year are the ones who build review and verification infrastructure as deliberately as they adopted the agents.

---

5. Give your coding agent LSP-backed symbol retrieval with Serena instead of letting it grep whole files

Every story above points at the same bottleneck. Agents are smart enough to reason and blind at retrieval. They grep whole files, string-match, and bloat their own context until they lose the plot. Serena fixes the actual problem.

Serena is an MCP toolkit that wraps a Language Server. Agents explore code at the symbol level. Find references, find callers, find definitions. They edit by symbol instead of reading entire files and pattern-matching their way through. Add it as an MCP server to Claude Code, Codex, Cursor, or Gemini CLI and the agent navigates relational structure, who calls what, without dumping full-file reads into context. It's at ~25k stars and trending this week, and it also showed up in today's trending topics independently, which is a decent convergence signal.

Why this is the keystone of today's Top 5: FrontierCode showed agents produce unmergeable code. A real chunk of that is retrieval failure. The agent doesn't understand the call graph, so it changes the wrong thing, breaks a caller it never saw, or duplicates a helper that already exists three files over. LSP-backed retrieval directly attacks that failure mode. It's also the multiplier for story #3. Fan out a hundred agents with grep-based retrieval and you get a hundred confidently-wrong edits. Fan them out with symbol-level navigation and the parallelism actually compounds.

What builders should do: install it today. It's a five-minute MCP config change with no downside, and it's the single most concrete fix for the "smart but blind" failure that every other story today circles around. This is the rare tool where the upside is obvious and the cost is basically zero.

---

Security

Self-replicating "Miasma" malware hit 70+ Microsoft open-source repos, stealing credentials the instant a repo opens in an AI tool. Microsoft and GitHub disabled the repos, many of them Azure and AI developer tools, after attackers injected malware that harvests credentials the moment a repo is opened in Claude Code, Gemini CLI, or VS Code. Miasma is built on the open-sourced Mini Shai-Hulud codebase from a group called TeamPCP, with a suspected link to a May breach of Microsoft's Durable Task project. This is the supply-chain nightmare for agentic workflows specifically. The whole value of an agent is that it auto-opens repos, runs tooling, and acts without you watching each step. That's also exactly the behavior this attack weaponizes. If your agent clones and opens untrusted repos, treat every one as hostile until proven otherwise, and don't keep long-lived credentials in any environment an agent can touch.

CVE-2026-30615: prompt-injection RCE in Windsurf 1.9544.26. A newly catalogued vulnerability lets remote attackers run arbitrary commands by smuggling instructions into content the agent processes. It landed inside a wider June MCP security wave where nine separate CVEs traced back to broken OAuth flows. If you run Windsurf or Devin Desktop agents, update now and treat all untrusted file and web content as an injection vector, not a convenience.

Akamai found three database-MCP flaw classes, and Alibaba declined to patch one. Akamai disclosed SQL injection in the Apache Doris MCP server, an unauthenticated metadata-exfiltration flaw in Alibaba's RDS MCP, and a potential takeover in Apache Pinot's MCP. The failure modes are boring and that's the point. Unsanitized SQL input, missing authentication, unauthenticated data exposure. Classic web-app bugs shipping in MCP servers because nobody treated the MCP layer as a real network boundary. "One is a fluke, three is a pattern." If you expose a database through MCP, parameterize every query, require auth on every endpoint, and run it through the same review you'd give any public API.

OpenAI shipped Lockdown Mode, killing the lethal trifecta deterministically. OpenAI's new Lockdown Mode restricts an agent's outbound network requests to block data exfiltration from prompt injection, targeting the lethal trifecta of private data plus untrusted content plus an exfiltration channel. Simon Willison's point is the one to copy: the restrictions are deterministic and operate outside model evaluation, which makes them far more robust than asking a model to guardrail itself. This is the right architectural instinct. Don't trust the model to refuse. Cut the network path so it can't exfiltrate even if it's fully compromised.

---

Agents

MetaMask launched Agent Wallet, a self-custodial onchain wallet built for AI agents. Agent Wallet lets agents trade onchain 24/7 across every EVM chain plus Solana through a single CLI. Every transaction runs a three-step pipeline: simulation, Blockaid threat scanning, and MEV protection, with up to $10,000 in transaction-protection coverage. It's framework-agnostic across Claude Code, Codex, and others, opening 200 early-access spots. This is a real agentic-commerce primitive. The mandatory security pipeline is the interesting part. Letting an autonomous agent move money is terrifying without enforced simulation and threat scanning on every call, and MetaMask made that non-optional rather than a setting people forget to enable.

SearchSwarm proposes delegation intelligence for long-horizon deep research. The paper puts a coordinator agent on top that decomposes unbounded research tasks and dispatches subtasks to workers, attacking the core mismatch that context windows stay finite while real task context grows without bound. This is the exact pattern that makes Claude Code's new fan-out useful. If you're building a research pipeline, delegate subtasks to fresh contexts instead of stuffing one window until it rots.

Observability for delegated execution exposes a real auditing gap. A sharp finding: delegation-scoped execution isn't identifiable from standard observables. Audit logs and execution traces can be identical under multiple incompatible delegation assignments, so you can't prove which agent was actually authorized to act. If you're building anything that needs "who did what on whose behalf" to hold up to scrutiny, standard tracing won't get you there. This pairs with the bernstein project staking out tamper-evident, HMAC-chained audit logs for multi-agent orchestration. The governance layer for agents is still being invented.

---

Research

End-to-End Context Compression at Scale goes after the KV-cache wall. The paper argues existing KV-cache compression either degrades quality or fails to scale, and proposes an end-to-end approach that holds up as context grows. For anyone running long-context inference where memory, not compute, is the actual constraint, this is the bottleneck that matters. Worth tracking against the practical kvcached approach in the skills section below, which attacks the same memory problem from the serving side.

The "self-correction illusion" is the most useful empirical result of the day. LLMs barely correct errors in their own reasoning traces but readily correct the identical claim when it's attributed to an external source. Relabeling a claim from the agent's own role to an external one raises the explicit-correction rate by 23 to 93 percentage points across model families. That's a massive, free lift, and it has direct implications for how you wire any review step. More on the practical move in skills.

DeepMind ran an actual RCT on AI tutoring in Sierra Leone. Gemini's Guided Learning feature increased engagement and accelerated learning outcomes in a randomized controlled trial in a low-resource setting. I'm skeptical of most "AI for education" claims because they're demos, not evidence. This is one of the more rigorous field tests I've seen, and it moves AI tutoring from pitch deck toward measured intervention. The methodology matters more than the headline.

The Neutral Mask: RLHF gives shallow alignment while partisan structure stays intact. This paper argues RLHF produces only surface neutrality, with the underlying partisan representations untouched beneath an aligned-looking output layer. A sobering correction for anyone treating RLHF as deep value alignment rather than output-shaping. It's the kind of result that should make you test behavior under adversarial framing, not just default prompts.

---

Infrastructure & Architecture

Microsoft's Foundry catalog crossed 11,000+ models and put Opus 4.8 inside Excel Agent Mode. Foundry now offers unified Azure billing and auth across that catalog, even as Microsoft pushes its own MAI models to cut OpenAI dependence. For builders, the real signal is normalization of multi-model enterprise deployment under one control plane. You no longer pick a model and marry it. You route per task under shared auth.

Microsoft Build 2026 hardened agent governance into a platform layer. Work IQ APIs reach GA June 16, supporting the A2A protocol, a redesigned remote MCP server, and standard REST, letting agents reason and act over M365 org data. Agent 365 becomes the unified control plane with an agent registry, a topology map, and detection of unmanaged "local" agents. Enterprise agent governance is becoming a first-class platform, not a feature. And separately, Mustafa Suleyman used Build to debut seven in-house frontier models and name a top-four-lab goal, a clear decoupling from OpenAI.

The compute-siting problem is getting weird. A Spin co-founder raised $5M for Orbital, a plan to launch 10,000 data centers into space, betting orbital solar and passive cooling sidestep terrestrial power and water limits. It's early and speculative and probably won't work as pitched. I'm including it because the fact that this gets funded at all tells you how acute the power constraint has become. When people are pitching orbital data centers with a straight face, the bottleneck is real.

---

Tools & Developer Experience

Xcode 27 ships a dual-engine agentic coding stack. The developer beta pairs a local Neural Engine model for real-time Swift suggestions with a cloud routing layer that hands heavier analysis to Claude, Gemini, or OpenAI. The agent simulates whole apps, writes and runs tests, inspects visual changes via live previews, and drives the iOS Simulator through a new Device Hub. The local-plus-cloud split is the same pattern as the Foundation Models protocol, applied to the IDE itself. Apple is making the Mac a first-class local-inference target for agentic dev tools.

App Intents replaces SiriKit, and the migration clock just started for every iOS app. SiriKit-only integrations won't be addressable by the new Gemini-backed Siri. Every app that wants to be controllable by the rebuilt assistant has to re-expose its capabilities through App Intents. This is a concrete porting mandate across the whole iOS ecosystem, not an optional new API. If you ship an iOS app, this goes on the roadmap now.

Google permanently removed the legacy Gemini Interactions API schema on June 8. The v1beta Interactions schema is gone, replaced by a structured "steps" timeline and a polymorphic "response_format," enabling future mid-flight steering and async tool calls. Developers who hadn't opted into the new revision header now face hard breakage. A dated, real migration deadline for anyone building agents on Gemini. Two breaking changes from Apple and Google in one day. Tax season for platform dependencies.

---

Models

Gemini 3.5 Flash hit general availability and became the default Gemini model. GA and stable for production across the Gemini API, Enterprise, and Antigravity, and now the default in the Gemini app and AI Mode in Search globally. Google pitches frontier-level intelligence at ~4x the speed of comparable models, priced at $1.50/$9 per 1M tokens, 1M-token context, and 76.2% on Terminal-Bench 2.1, beating the larger Gemini 3.1 Pro on coding and agents. A smaller-faster model outscoring the big one on agentic coding is the trend worth watching. The frontier is getting cheaper to run, not just smarter.

API pricing keeps compressing. Grok 4.3 lands at $0.50/$2 per million tokens, and Claude Opus 4.8's Fast Mode runs roughly 3x cheaper than standard. This matters more than any single benchmark because it changes which models you can afford to run at scale, and it lands right as enterprises like Uber, T-Mobile, and Brex are reportedly capping token budgets. Cheaper inference is what makes the fan-out workflows in story #3 economically sane instead of a budget grenade.

Anthropic's next model is in confirmed preview. Claude Mythos, code-named Project Glasswing, is previewing with 200+ organizations across 15+ countries, while an npm leak points to Claude Sonnet 4.8 arriving mid-June. Expect a near-term refresh on top of the current Opus 4.8 flagship. Meanwhile xAI's Grok V9-Medium, ~1.5T parameters, is finishing fine-tuning ahead of a mid-June release. June is going to be loud.

---

Vibe Coding

Cloudflare open-sourced VibeSDK, a one-click "build your own vibe-coding platform." VibeSDK (MIT, ~5,077 stars) deploys an entire vibe-coding platform on the Cloudflare stack in one click. Sandboxed live previews, React+TypeScript+Tailwind generation, Workers deploy, GitHub export, defaulting to Gemini. Recent releases add a headless TypeScript SDK, a zero-knowledge secrets vault, and pre-deploy AST static analysis. The platform layer of vibe coding is now commoditized and self-hostable. If you were thinking of building a Lovable competitor, the substrate is free now, which tells you where the actual moat isn't.

Lovable signed a multi-year Google Cloud deal, 5x-ing usage. Lovable committed to a fivefold Cloud increase and gained expanded Claude and Gemini access via Vertex AI. The signal: the app-generation layer is consolidating onto frontier-model-plus-hyperscaler supply chains rather than running its own stack. Combined with VibeSDK going open source, the message is consistent. The value isn't the platform code, it's distribution and the model relationship.

Performative-UI was the week's top HN story at 1,054 points, and it's a design critique. Performative-UI is a React library that satirically catalogs AI-generated design clichés. Gradient blobs, bento grids, generic "AI slop." It resonated because practitioners are tired of homogenized agent output. This is the craft angle I care about most. The reason my engineering works is that I evaluate output for taste, not just correctness, and a thousand HN upvotes for a parody library says a lot of builders feel the same fatigue. AI can generate a UI. It can't yet tell that the UI looks like every other AI UI.

---

Hot Projects & OSS

awesome-design-md hit ~89K stars formalizing "design context as a file." The repo curates DESIGN.md files analyzing popular brand systems. Drop one in and let coding agents generate matching UI. It's the design-side parallel to CLAUDE.md and AGENTS.md, and at ~88,700 stars since March it's clearly hitting a nerve. This is the constructive answer to the Performative-UI complaint above. If you don't want AI slop, give the agent real design context as a versioned file instead of hoping.

AionUi reached ~27.9K stars as a local 24/7 cockpit over 20+ CLI agents. AionUi puts one local desktop interface in front of Claude Code, Codex, OpenCode, Gemini CLI, and more. It reflects a convergence I keep seeing: developers want one local control surface over many agent backends, not a hosted dashboard and not five terminals. The value is shifting from any single CLI to the orchestration layer that coordinates them.

system_prompts_leaks sits at ~41.5K stars. The repo aggregates extracted system prompts attributed to Anthropic and OpenAI models. Popular raw material for prompt engineers studying production prompt structure, though provenance on any single entry is unverified. Useful as a study aid, not gospel. Read it to see how serious teams structure system prompts, not to copy claims you can't check.

---

SaaS Disruption

For the first time in history, software trades at a discount to the S&P 500. Software's forward P/E fell below the broad index, a level not reached even during the dot-com bust, as markets reprice seat-based growth against agent-driven seat compression. Thoma Bravo's Orlando Bravo called some AI-disrupted software declines "very warranted." This reads as structural repricing of the seat model, not a sentiment dip. Worth pairing with Ed Zitron's "AI Is Slowing Down" essay, the week's top AI-skeptic argument at 610 HN points, claiming the revenue math behind planned data-center buildout doesn't close. I don't fully buy Zitron's numbers, but the market repricing the seat model in real time isn't a vibe, it's a P/E ratio.

Customer-service vendors all repriced on per-resolution billing in the same quarter. Zendesk bills $1.50 per verified resolution, Agentforce $2.00, Intercom Fin $0.99, HubSpot $0.50. The spread shows nobody's sure what outcome pricing sustains at margin yet, but every major abandoned seat- and deflection-based billing simultaneously. When four competitors reprice on the same axis in one quarter, the unit of value officially changed from access to outcomes. Zendesk's architecture reveals the catch: credible outcome pricing forces an audit layer, a second AI adjudicating the first. You can't bill on resolutions without a model verifying them.

The "SaaS is dead" framing is overstated, per HBR. AI-embedded SaaS is growing roughly 2x faster than legacy SaaS in the same ARR band, without the inference-cost margin compression pure AI-native firms eat. Median NRR drifted only slightly, and mid-market and enterprise accounts still churn 1-2% monthly while expanding 15-25% annually. The disruption is real but concentrated in SMB and seat-heavy categories. A useful corrective if you're sizing the actual threat instead of the headline.

---

Policy & Governance

OpenAI filed a confidential S-1 at a reported ~$852B valuation. OpenAI confirmed the SEC submission on June 8, its first formal IPO step, with Goldman and Morgan Stanley underwriting and ChatGPT cited at ~900M weekly users. It follows Anthropic's own confidential S-1 on June 1. The same week OpenAI also published a "Built to Benefit Everyone" manifesto and launched an Economic Research Exchange. Reading those three together, the framing exercise ahead of a market debut is hard to miss. The mission language always gets loud right before the listing.

Compliance clock: Colorado AI Act hits June 30, EU AI Act penalties start August 2. Colorado's act takes effect in 22 days, requiring risk-management programs and annual impact assessments for AI used in employment, healthcare, finance, education, and housing. The EU AI Act's penalty regime, up to €35M or 7% of global turnover, begins August 2. These are hard near-term deadlines, not future abstractions. If you ship AI into any of those regulated domains, the runway is short.

CDT documented 37 manipulative "dark patterns" across ChatGPT, Claude, and Gemini. The report flags emotional-dependency cultivation and "capability deception," arriving right as the compliance deadlines above land. Expect this to feed regulatory scrutiny of consumer-chatbot UX. It connects to the Bank of England's warning about a deepfake of its governor pushing financial scams on X. Synthetic media as an active fraud vector, not a hypothetical.

---

Skills of the Day

1. Relabel an agent's own draft as an external submission before review. The "self-correction illusion" paper shows models barely fix their own reasoning but readily fix the identical claim when it's attributed to someone else, a 23-93 point swing in correction rate. In any multi-agent pipeline, frame the review step as "Critique this submission from another engineer," never "review your own work." It's a one-line prompt change with one of the biggest documented payoffs I've seen.

2. Order prompts static-first, dynamic-last so prompt caching actually fires. Caching only hits on a byte-identical prefix, so structure every request as system prompt, then tool defs, then few-shot, then document context, all cacheable, with the user query and any changing data dead last. On Anthropic, cached reads cost 10% of normal input, yielding 70-90% savings. One dynamic token near the top silently busts the whole cache, so guard the prefix like it's load-bearing.

3. Make KV cache elastic with kvcached to share one GPU across multiple models. It decouples GPU virtual addressing from physical memory so serving engines reserve virtual KV-cache space but only back it on actual use. Turn it on as a transparent plugin with ENABLE_KVCACHED=true and KVCACHED_AUTOPATCH=1 on vLLM 0.8.4+ or SGLang 0.4.9+. Berkeley measured 2-28x TTFT reduction running three Llama-3.1-8B models on one A100 under bursty load.

4. Use reversible context editing plus a memory tool instead of plain truncation. Anthropic's evals show context editing, reversibly stripping info the agent can re-fetch with a tool, gives a 29% lift alone, 39% with a memory tool, and cut token use 84% in a 100-turn eval that otherwise died of context exhaustion. The distinction that matters: compaction is reversible, summarization is lossy. Prefer reversible editing first and only summarize near a context-rot threshold.

5. Pin and version-lock MCP tool manifests at install. Most MCP clients don't pin manifests, so a trusted server can run clean for weeks then push a description update with a data-harvesting instruction that fires next session. A 2026 disclosure found up to 200,000 vulnerable instances. Pin manifests at install, issue scoped time-limited tokens per operation instead of a repo-wide PAT, and sandbox. Shrink blast radius, don't trust the model to notice.

6. Kill position bias in LLM-as-judge by scoring both orderings and only crediting consistent wins. Evaluate every pair as both (A,B) and (B,A) and count a win only when the verdict holds across both. For self-preference bias, use a different model family as judge than the one being judged. For verbosity bias, switch to a 1-4 scale with an explicit conciseness reward. Cheap, deterministic harness changes that materially improve eval reliability.

7. Watch for style bias, the LLM-judge failure that position fixes won't catch. Style bias, preferring polished confident answers regardless of correctness, dominates at 0.76-0.92 across models, far above position bias at ≤0.04, yet gets almost no mitigation. Normalize formatting before judging, strip confident framing, and validate your judge against human labels on deliberately ugly-but-correct versus pretty-but-wrong pairs. Treat the judge as an instrument with calibration error, not ground truth.

8. Two-stage retrieval with Matryoshka embeddings: truncated vectors for candidates, full vectors to re-rank. Matryoshka Representation Learning packs multiple usable sizes into one vector, so you truncate 1024-d to 64-d for cheap candidate retrieval, then re-rank the shortlist with the full vector. Combined with int8 or binary quantization, that's a documented ~80% vector-DB cost cut. The guidance is "yes, when measured," so benchmark recall before you ship it.

9. Run Claude Code hooks async over HTTP, and put heavy work on Stop, not PostToolUse. The January 2026 hooks update added async: true background hooks and HTTP hooks that POST lifecycle events to a remote server for team-wide policy. Keep PostToolUse with a Write|Edit matcher for cheap per-edit ops like formatting, and move full test suites and builds to the Stop hook so you're not re-running them on every file write. Deterministic automation beats hoping the model remembers.

10. Adopt the four-phase spec-driven loop to stop agent intent-drift. Specify (user stories, acceptance criteria, edge cases), Plan (stack, patterns, constraints), Tasks (atomic, individually testable items with explicit inputs and outputs), Implement (agent works task-by-task with spec plus plan as context). Making a version-controlled spec the source of truth, not the code, directly counters the vibe-coding failure where plausible code drifts from intent. GitHub Spec Kit, AWS Kiro, and OpenSpec all ship a flavor you can run today.

---