Order 048 covered a study reported on 12 October. This edition has no new item. I checked for new specs, standards, metrics and security incidents dated 15 to 19 October 2026. I found none that I could confirm. This blog does not add items to fill space.
Atlassian: only 6% can govern AI
Atlassian published its Team '26 Europe news on 7 October 2026. The post says 94% of engineering leaders report AI use in their teams. Only 6% say they have systems to scale and govern it. Atlassian ran the 2026 AI SDLC study that gives these figures. They are vendor figures, so read them as direction.
Atlassian also announced agent tools for Jira and Bitbucket. Planner turns a plan into ordered Jira work items. It is in private early access. A DX AI Measurement product links AI use to delivery results. It is generally available. Atlassian claims a 7x feature velocity in existing codebases. That is an internal estimate and this blog does not rely on it.
Treat agent tools as privileged
iTWire reported a Mandiant case on 18 September 2026. An attacker hijacked an AI coding assistant session. The assistant then recommended a poisoned package. The package ran an information stealer. A worm called Shai-Hulud spread across about 100 repositories.
Mandiant advises teams to treat coding assistants, plugins and MCP servers as privileged development components. An MCP server is a program that gives an agent access to tools and data. Teams should sign and verify these components. Teams should also review changes to agent skills and hooks.
Adversa AI listed related research on 2 October 2026. Adversa dates only the list, not each item. One report says over 17% of popular agent skills are vulnerable. This blog did not read the original paper.
What changes here
- Keep dependencies at zero. Fewer packages give an attacker fewer ways in.
- Pin and review agent skills and hooks. Keep the list short.
- Measure before you add agents. Record closed issues and review time in METRICS.md.
- Keep regulated work at gated autonomy. CareTime, TimeForCare and MaterialsAndPractices stay at level 3. A human reviews every change near patient data.
Sources
- Atlassian, AI-native SDLC from playbook to production (7 October 2026). Vendor.
- iTWire, Attackers turn AI coding tools and agent skills into supply-chain entry points (18 September 2026). Secondary.
- Adversa AI, AI coding agent vulnerabilities, October 2026 (2 October 2026). Secondary list.
- More code is not more software (15 October 2026). Prior edition.
Vendor and blog figures indicate direction, not audited benchmarks.