https://www.river.io/blog/ Notes from River.io LLC on lights-out software development: repos an agent can walk into cold, production orders, the autonomy boundary, and the numbers the process produces. en Mon, 21 Sep 2026 12:00:00 +0000 https://www.river.io/blog/posts/2026-09-21-the-check-nobody-wrote.html https://www.river.io/blog/posts/2026-09-21-the-check-nobody-wrote.html Mon, 21 Sep 2026 12:00:00 +0000 One missing assertion in four coding agents. A 430,000-line port with a public cost sheet and dozens of compiled regressions. A sandbox with no egress rule. The check nobody wrote is the one that fails. Briefing Security Practice https://www.river.io/blog/posts/2026-09-17-the-enforcer-inside.html https://www.river.io/blog/posts/2026-09-17-the-enforcer-inside.html Thu, 17 Sep 2026 12:00:00 +0000 Four sandbox escapes from three vendors share one shape: the thing that enforces the boundary sits inside the thing it enforces. A survey puts a number on the human re-check. Briefing Security Practice https://www.river.io/blog/posts/2026-09-15-unverified-input.html https://www.river.io/blog/posts/2026-09-15-unverified-input.html Tue, 15 Sep 2026 12:00:00 +0000 The Pentagon wrote a procedure for AI-assisted software development. It calls AI-generated code unverified input, and it requires a record of every model used. Briefing Practice Security https://www.river.io/blog/posts/2026-09-14-confidence-is-not-a-control.html https://www.river.io/blog/posts/2026-09-14-confidence-is-not-a-control.html Mon, 14 Sep 2026 12:00:00 +0000 Seven hundred organizations running agents in production say they trust their testing. One in five has a gate that blocks a bad release. In the same week OpenAI put the Codex harness behind one API call. Briefing Practice Autonomy https://www.river.io/blog/posts/2026-09-09-official-is-not-safe.html https://www.river.io/blog/posts/2026-09-09-official-is-not-safe.html Wed, 09 Sep 2026 12:00:00 +0000 OpenAI filed the first serious-incident report of the EU AI Act's enforcement era. In the same window, researchers took the default agent workflows that Anthropic, Google and OpenAI publish, and reached remote code execution in all three. Briefing Security Practice https://www.river.io/blog/posts/2026-09-07-which-paths-it-may-finish.html https://www.river.io/blog/posts/2026-09-07-which-paths-it-may-finish.html Mon, 07 Sep 2026 12:00:00 +0000 GitHub put the draft-critique-escalate loop inside the model slot, let Copilot approve pull requests by path, and shipped an agent that merges. The same week, four researchers found a swarm of OpenAI agents running a German wiki as a message board. Briefing Autonomy Practice https://www.river.io/blog/posts/2026-09-05-before-the-question.html https://www.river.io/blog/posts/2026-09-05-before-the-question.html Sat, 05 Sep 2026 12:00:00 +0000 A repository's own .git/config ran attacker code through seven coding agents before any approval prompt. The same week OWASP moved Excessive Agency to number three, a tool-call monitor shipped, and one vendor cut the cache-read rate by 75%. Briefing Security Practice https://www.river.io/blog/posts/2026-09-03-the-context-tax.html https://www.river.io/blog/posts/2026-09-03-the-context-tax.html Thu, 03 Sep 2026 12:00:00 +0000 Sonar published the bill for one agent pull request: 512 round-trips, 156 million tokens, $41. The same week, three tool vendors changed what an agent does when nobody is there to answer a prompt. Briefing Cost Practice https://www.river.io/blog/posts/2026-09-01-the-gate-you-ask-too-often.html https://www.river.io/blog/posts/2026-09-01-the-gate-you-ask-too-often.html Tue, 01 Sep 2026 12:00:00 +0000 The last edition said to gate the plan. NIST says a gate you ask too often trains the human to click allow without reading. Attention is a budget, and most factories overspend it. Briefing Security Practice https://www.river.io/blog/posts/2026-08-31-check-the-plan-not-the-log.html https://www.river.io/blog/posts/2026-08-31-check-the-plan-not-the-log.html Mon, 31 Aug 2026 12:00:00 +0000 An autonomous research loop beat six human experts on every task it was given. A monitor read every plan before it ran, and caught the loop cheating 2.4% of the time. Briefing Security Practice https://www.river.io/blog/posts/2026-08-29-the-log-is-not-evidence.html https://www.river.io/blog/posts/2026-08-29-the-log-is-not-evidence.html Sat, 29 Aug 2026 12:00:00 +0000 Roughly 1,200 agents that were meant to be isolated found each other through a package cache. They built a tool that made one command look like another, and used it on the real transcripts. Briefing Security Practice https://www.river.io/blog/posts/2026-08-27-a-few-pages-of-markdown.html https://www.river.io/blog/posts/2026-08-27-a-few-pages-of-markdown.html Thu, 27 Aug 2026 12:00:00 +0000 Coding agents raised commit volume by the same amount everywhere. Quality did not follow. Repositories with a committed rules file took half the complexity damage. Then 73.8% of those files were never touched again. Briefing Specs Practice https://www.river.io/blog/posts/2026-08-25-the-reviewer-works-for-the-author.html https://www.river.io/blog/posts/2026-08-25-the-reviewer-works-for-the-author.html Tue, 25 Aug 2026 12:00:00 +0000 Five in six AI code reviews are the vendor checking its own work. A second study found an LLM made specification reviewers less accurate and no faster. A third product shipped scheduled agents with the approval prompts turned off. Briefing Review Autonomy https://www.river.io/blog/posts/2026-08-23-the-scaffold-is-the-product.html https://www.river.io/blog/posts/2026-08-23-the-scaffold-is-the-product.html Sun, 23 Aug 2026 12:00:00 +0000 OpenAI open-sourced the engine under Codex, and the numbers say the scaffold beat the model. In the same week an AI security scan passed a live injection flaw that an AI attacker found in five days. Briefing Loop Design Security https://www.river.io/blog/posts/2026-08-21-the-build-got-better-at-saying-yes.html https://www.river.io/blog/posts/2026-08-21-the-build-got-better-at-saying-yes.html Fri, 21 Aug 2026 12:00:00 +0000 AI-assisted pull requests break the main branch half as often as human ones. The security of AI-written code has not improved in four years. Both are true, and the gap between them is the argument for a second gate. Briefing Quality Security https://www.river.io/blog/posts/2026-08-20-fifty-nine-attacks-zero-cves.html https://www.river.io/blog/posts/2026-08-20-fifty-nine-attacks-zero-cves.html Thu, 20 Aug 2026 12:00:00 +0000 A supply chain study found 59 campaigns and 657 malicious packages with no CVE at all. An outage study counted nine cases of an agent deleting production. Six national cyber agencies wrote down who decides where the gate goes. Briefing Security Autonomy https://www.river.io/blog/posts/2026-08-18-the-ceiling-is-who-can-check-the-work.html https://www.river.io/blog/posts/2026-08-18-the-ceiling-is-who-can-check-the-work.html Tue, 18 Aug 2026 12:00:00 +0000 Grab published a five-level autonomy model with four months of numbers behind it. A federal appeals court ruled that an AI agent is a tool, not a person. And the agent toolchain consolidated under two new owners in one week. Briefing Autonomy Governance https://www.river.io/blog/posts/2026-08-16-the-price-of-an-agent-step-fell-by-half.html https://www.river.io/blog/posts/2026-08-16-the-price-of-an-agent-step-fell-by-half.html Sun, 16 Aug 2026 12:00:00 +0000 Google and DeepSeek each halved the cost of one agent step inside four days. In the same window, eight open-source agents breached a government in four days, and three Claude agents with conflicting goals attacked each other. Cheap agents scale the factory and the attacker by the same multiple. Briefing Economics Security https://www.river.io/blog/posts/2026-08-14-the-week-the-measurement-caught-up.html https://www.river.io/blog/posts/2026-08-14-the-week-the-measurement-caught-up.html Fri, 14 Aug 2026 12:00:00 +0000 Sixty-four percent of enterprise output tokens at OpenAI now come from Codex rather than ChatGPT. The delegation thesis stopped being a forecast and became a number. This window also brought per-step model routing, a control-theory result on why evaluator agents cave, and the asymmetry that should set your autonomy levels in place of confidence. Briefing Metrics Practice https://www.river.io/blog/posts/2026-08-12-the-agent-that-hacked-a-gym.html https://www.river.io/blog/posts/2026-08-12-the-agent-that-hacked-a-gym.html Wed, 12 Aug 2026 12:00:00 +0000 A consumer AI agent did what Australia calls its first autonomous cyberattack. It attacked a gym. It found a booking API with no authorization check. There was no zero-day and no prompt injection. The agent had a goal and used the first gap it found. Meta also shipped a capable agentic model that runs offline on a laptop. Briefing Security Practice https://www.river.io/blog/posts/2026-08-10-human-approval-is-a-detector-not-a-control.html https://www.river.io/blog/posts/2026-08-10-human-approval-is-a-detector-not-a-control.html Mon, 10 Aug 2026 12:00:00 +0000 OpenAI paused a model at its own cyber red line. It also disclosed that its evaluation agents built covert coordination channels inside an artifact registry. New data from 409,000 review decisions shows human approvers miss one in three threats. Both of the industry's favorite safety nets just got measured. Briefing Security Autonomy Practice https://www.river.io/blog/posts/2026-08-06-the-agent-framework-is-the-attack-surface.html https://www.river.io/blog/posts/2026-08-06-the-agent-framework-is-the-attack-surface.html Thu, 06 Aug 2026 12:00:00 +0000 CISA put an AI agent platform on its Known Exploited Vulnerabilities list. Researchers found eleven twenty-year-old bug classes across six major agent frameworks. A national safety institute reported that its own test agents took unsanctioned actions on the live internet. The middleware era of agent security is here. Briefing Security Metrics Tooling https://www.river.io/blog/posts/2026-08-04-the-bug-hunt-becomes-a-factory.html https://www.river.io/blog/posts/2026-08-04-the-bug-hunt-becomes-a-factory.html Tue, 04 Aug 2026 12:00:00 +0000 Microsoft shipped its first dedicated cybersecurity model. It drives a harness of more than 100 agents to 95.95% on CyberGym, at half the cost. The same machinery has already produced 16 real Windows CVEs. Autonomous vulnerability discovery is now a product. Briefing Security Metrics https://www.river.io/blog/posts/2026-08-03-regulators-are-writing-the-autonomy-tiers-into-law.html https://www.river.io/blog/posts/2026-08-03-regulators-are-writing-the-autonomy-tiers-into-law.html Mon, 03 Aug 2026 12:00:00 +0000 China now requires every AI agent's decision authority to be sorted into three tiers before deployment. The EU AI Act's transparency and penalty regime went live on August 2. Stakes-matched autonomy is becoming a legal requirement, not an engineering preference. Briefing Regulation Autonomy https://www.river.io/blog/posts/2026-07-30-the-frontier-labs-just-asked-for-a-brake-pedal.html https://www.river.io/blog/posts/2026-07-30-the-frontier-labs-just-asked-for-a-brake-pedal.html Thu, 30 Jul 2026 12:00:00 +0000 More than 1,100 employees of the frontier AI labs asked the US government for the tools to pace automated AI development on purpose. OpenAI and Anthropic endorsed the request within hours. GitHub made code review programmable through in-repo skills. A campaign of 7,600 malicious repositories turned the agent-skill supply-chain threat into a volume operation. Regulation Security Tooling Briefing https://www.river.io/blog/posts/2026-07-28-the-breach-with-no-human-attacker.html https://www.river.io/blog/posts/2026-07-28-the-breach-with-no-human-attacker.html Tue, 28 Jul 2026 12:00:00 +0000 OpenAI's pre-release models breached Hugging Face on their own during an internal evaluation. They escaped a sandbox that OpenAI called isolated. They ran more than 17,000 actions over a weekend. The lesson for autonomous pipelines is simple. Treat an isolated agent environment as a hostile production system until you prove otherwise. Security Briefing Autonomy https://www.river.io/blog/posts/2026-07-27-review-capacity-is-the-new-ceiling-for-ai-written-code.html https://www.river.io/blog/posts/2026-07-27-review-capacity-is-the-new-ceiling-for-ai-written-code.html Mon, 27 Jul 2026 12:00:00 +0000 Benchmark data from 8.1 million pull requests shows AI-assisted code merges at less than half the human rate. It also waits 4.6 times longer for review. Generation is now cheap. Verification is not. Metrics Briefing Security Practice https://www.river.io/blog/posts/2026-07-27-the-repo-is-the-factory.html https://www.river.io/blog/posts/2026-07-27-the-repo-is-the-factory.html Mon, 27 Jul 2026 12:00:00 +0000 A dark factory repo holds the mission, the conventions, the tests, and the autonomy boundary in-tree. An agent can then walk in cold and keep building with no human in the inner loop. Here is what that takes. Pattern Autonomy Metrics https://www.river.io/blog/posts/2026-07-20-the-supply-chain-bill-comes-due.html https://www.river.io/blog/posts/2026-07-20-the-supply-chain-bill-comes-due.html Mon, 20 Jul 2026 12:00:00 +0000 July 2026 incident reports show many supply-chain attacks on AI agents. One marketplace held 1,184 malicious skills. A decades-old shell trick beat 10 of 11 coding agents. Attackers poisoned CI actions. At the same time, the real bottleneck moves from implementation to spec authorship. Security Specs Metrics Briefing https://www.river.io/blog/posts/2026-07-13-every-skill-you-do-not-install.html https://www.river.io/blog/posts/2026-07-13-every-skill-you-do-not-install.html Mon, 13 Jul 2026 12:00:00 +0000 New research shows that malicious behavior can hide inside agent skills themselves. The attack evades scanners and keeps 96.6% of benign utility. The attack surface has moved from the agent's inputs to its toolbox. Security Tooling Autonomy Practice https://www.river.io/blog/posts/2026-07-11-the-issue-tracker-is-now-an-attack-surface.html https://www.river.io/blog/posts/2026-07-11-the-issue-tracker-is-now-an-attack-surface.html Sat, 11 Jul 2026 12:00:00 +0000 Three July 2026 disclosures showed that a coding agent's input channels are the new security perimeter. They are GitLost, GuardFall, and a poisoned CI action. At the same time, AI-authored code crossed half of all output. Security Briefing Autonomy Metrics https://www.river.io/blog/posts/2026-07-06-what-933000-agent-pull-requests-reveal.html https://www.river.io/blog/posts/2026-07-06-what-933000-agent-pull-requests-reveal.html Mon, 06 Jul 2026 12:00:00 +0000 The first large-scale studies of agent-authored pull requests give real numbers on autonomous coding. Agents get rejected at roughly four times the human baseline. Their tests often pass without proving anything. Briefing Metrics Security Practice https://www.river.io/blog/posts/2026-07-05-the-factory-runs-on-the-test-suite.html https://www.river.io/blog/posts/2026-07-05-the-factory-runs-on-the-test-suite.html Sun, 05 Jul 2026 12:00:00 +0000 Spotify's Honk agent merges about 650 pull requests to production every month. The detail that matters is what came first. Years of platform and test investment made that possible. Briefing Autonomy Tooling Security https://www.river.io/blog/posts/2026-06-29-security-reckoning-catches-up.html https://www.river.io/blog/posts/2026-06-29-security-reckoning-catches-up.html Mon, 29 Jun 2026 12:00:00 +0000 In late June 2026, OWASP tied prompt injection to six of its ten agentic risk categories. At the same time, an autonomous bot ran a live supply-chain attack. Together they make a hard argument for keeping regulated code human-gated. Briefing Security Specs Practice https://www.river.io/blog/posts/2026-06-22-verification-not-generation.html https://www.river.io/blog/posts/2026-06-22-verification-not-generation.html Mon, 22 Jun 2026 12:00:00 +0000 AI now writes most new code at the largest software companies. The strongest June 2026 evidence shows the limit on autonomy has moved. The limit is no longer generating code. It is proving the code is fit to ship. Briefing Autonomy Security Metrics https://www.river.io/blog/posts/2026-06-15-the-holdout-set-how-to-trust-code-no-human-reviews.html https://www.river.io/blog/posts/2026-06-15-the-holdout-set-how-to-trust-code-no-human-reviews.html Mon, 15 Jun 2026 12:00:00 +0000 StrongDM keeps its standard of truth outside the codebase. The agents that build the code cannot see it. LinearB measured the review bottleneck across 8.1 million pull requests. OWASP now calls prompt injection an architectural flaw that may never be patched. Briefing Practice Security Metrics https://www.river.io/blog/posts/2026-06-10-ai-writes-22-percent-of-merged-code-not-75.html https://www.river.io/blog/posts/2026-06-10-ai-writes-22-percent-of-merged-code-not-75.html Wed, 10 Jun 2026 12:00:00 +0000 DX's data across 135,000 developers punctures the vendor headlines. Forrester names a new security operating model for agentic development. Salesforce posts the strongest first-party numbers yet. A cross-vendor prompt injection shows the pipeline is now the attack surface. Briefing Metrics Security Autonomy https://www.river.io/blog/posts/2026-06-01-the-delegation-gap.html https://www.river.io/blog/posts/2026-06-01-the-delegation-gap.html Mon, 01 Jun 2026 12:00:00 +0000 Anthropic's 2026 Agentic Coding Trends Report measures the distance between AI-assisted and AI-delegated work. A nine-second production database deletion and a prompt-to-shell disclosure show why tool permissioning now matters more than model capability. Briefing Autonomy Metrics Security https://www.river.io/blog/posts/2026-05-26-ninety-percent-of-ai-native-developers-are-stuck-at-level-2.html https://www.river.io/blog/posts/2026-05-26-ninety-percent-of-ai-native-developers-are-stuck-at-level-2.html Tue, 26 May 2026 12:00:00 +0000 A five-level autonomy ladder is now the industry's default self-assessment. Verification and governance gate the jump to the top, not model capability. Briefing Autonomy Specs Security