AI-Assisted Software Development

Following opens with early access — sign up for early access to register your interest; it does not switch following on today. Everything you follow will land on one page, in your account menu.

1. Dev Tooling & Infra

   Vercel ships Agent Runs into its MCP + CLI

   Surfacing agent-run traces through MCP + the CLI is the "agents observable inside your own dev tooling" pattern — directly relevant to AIU agent-orchestration + the observability lens.

   Vercel·2026-07-03
2. Dev Tooling & Infra✓ verified

   GitHub secret scanning adds a Supabase-credential detector that blocks the commit

   One of the most common AI-built-app failures is the database key shipped to the browser; free push protection on a public repo catches a class of that at commit time — but know which tier you're on.

   GitHub·2026-06-17
3. Dev Tooling & Infra✓ verified

   Anthropic Claude Security / codebase scanning (Project Glasswing)

   Security tooling from the platform AI Uni builds on — relevant to the three-skill security-review discipline and to the Anthropic Security Plugin install this session.

   Anthropic·2026-06-02
4. Dev Tooling & Infra✓ verified

   Researcher shows one malicious GitHub issue could hijack repos running Claude Code's GitHub Action

   CI/CD-embedded coding agents inherit the write access of the workflow they run in — treat any agent-triggering input (issue titles, PR bodies, comments) from an untrusted user as untrusted, patched or not.

   GMO Flatt Security (independent research)·2026-06-01
5. Dev Tooling & Infra✓ verified

   GitHub lets you assign a dependency alert straight to an AI agent to fix

   Dependency triage is fatigue-heavy toil an agent can genuinely take off your plate — as long as the merge stays a human decision.

   GitHub·2026-04-07
6. Dev Tooling & Infra✓ verified

   A poisoned npm package quietly rewrote a coding agent's memory — and it reloaded every session

   Treat any automatic edit to an agent's memory or instruction files as a reviewable event, not a silent auto-load — a single poisoned dependency can otherwise steer every future run.

   Cisco·2026-04-01
7. Dev Tooling & Infra✓ verified

   Agent observability field: LangSmith vs Braintrust vs Langfuse vs Arize

   Informs deterministic-vs-LLM-judge layering. Braintrust's merge-blocking eval-action is a pattern to study — but LLM-judge stays post-hoc, never replacing deterministic CI gates.

   Braintrust / Latitude·2026-03-15
8. Dev Tooling & Infra✓ verified

   'ClawHavoc': 900+ malicious agent 'skills' pushed through a third-party marketplace

   Any skill, tool, or config you didn't write deserves the same scrutiny as a code dependency — and 'delete the skill' is not the same as 'undo what it did.'

   Koi Security·2026-02-01