Evidence-Driven Development: Give Your Coding Agent Something to Prove
Write a claim that can lose, break the app on purpose, and keep evidence your agent can't fake.
About Evidence-Driven Development: Give Your Coding Agent Something to Prove
A hands-on tutorial: build a tiny Python and SQLite task list with a coding agent, then prove what it promises. Each claim is written down next to the result that would disprove it, such as 'repeating a create request returns the original task', and an experiment runner checks it across restarts and concurrent retries.
Why it matters: 'the tests pass and the explanation sounds reasonable' is exactly where agent-written code fools you. The habit here is to decide what failure looks like before the agent builds, then keep evidence you can inspect without trusting the agent's summary. Two deliberately broken versions show which promises each one keeps.
About a 9-minute read, with a companion repository holding the full source and recorded evidence. The author credits the name to a chapter in Jan Bosch's 2017 book.
More Guides
The September Cut Took 17% of My Claude Code Week. Subagents Took 48%
A developer read a month of their own Claude Code logs, 455 sessions and 63,000 requests, before changing a single setting. Subagents were 48.1% of all tokens: each one opens with a median of 47,117 tokens of instructions and tool lists, and inherits the main session's model unless its agent file pins a smaller one. Why it matters: it puts a number next to the saving tips everyone repeats. Pin a small model on the subagents you keep, set subagentPromptCacheTtl to 1h if your helpers sit idle, and clear the session before a long break: after more than an hour away, the median message rewrote about 130,000 tokens of cache. About a 5-minute read. The numbers are one workload measured in tokens, not a share of your weekly limit, and the author says so.
Slopsquatting: Your AI Invented a Package, and an Attacker Was Waiting
AI coding tools sometimes recommend packages that do not exist, and attackers register those names with malware inside. This guide walks through the USENIX Security 2025 study behind the "one in five" figure: 576,000 code samples from 16 models, 19.7% of suggested packages hallucinated, 205,474 unique fake names, and 43% of hallucinations repeating when the same prompt ran ten times. Why it matters: repeatable hallucinations are what make the attack work, because an attacker can predict the name. If your agent can run npm install or pip install on its own, it is the one typing the command. The fixes it lists: check a package’s age, downloads and repository before installing; lockfiles with hashes; npm install --ignore-scripts; reject packages younger than about 90 days; and never let an agent self-install unvetted dependencies.
Free the Models: Harness Design at the Frontier
Replit argues that model routers have a built-in ceiling: the router is always less capable than the model it is choosing for. So Replit Agent now lets the frontier model decide how hard to think, when to hand work off, and which specialist subagent (code, UI design, slides, writing) takes each step. Why it matters: on DeepSWE, Replit Agent scored 72% at $2.11 a task against 74% at $4.43 for Astra alone; on Terminal-Bench, 49% at $2.53 against 60% at $5.86. Models also use the same freedom differently: GPT-6 Astra reused briefed workers 42% of the time, while Fable models rarely used general workers. Read it if you are building an agent and are about to hard-code which model or step handles what.
.png)
UpGuard: 16,326 Supabase Databases Exposing Data
UpGuard Research found 16,326 Supabase databases readable without authentication, more than half showing personal information, from apps built all over the world. Published 25 September 2026, it is the largest study of its kind. Why it matters for builders: Supabase is the default backend for vibe-coded apps, and tables created through SQL, migrations or the API do not get row-level security switched on. The agent scaffolds the table; nobody writes the policy. The anon key then reads everything. Read the study, then query every table in your project with the anon key before you share a link. Our companion checklist walks through the fix.
AI Coding Made CI a Bottleneck, So Linear Reworked Theirs
Agents made shipping code faster; validating it did not keep up. Linear’s test suites almost quadrupled in 2026, yet the team brought pull-request wait time down from over six minutes to just over five and cut runner time per test roughly in half. The four moves: upgraded infrastructure and tooling (faster third-party runners instead of GitHub Actions), optimised the jobs that gate other work, reduced repeated setup, and made test execution more efficient. The codebase is TypeScript, but most of it transfers. Read it if your agents now open more PRs than your CI can absorb, which is the new normal for a small team running Claude Code or Codex all day.