Welcome to the 308th edition of Coding Jag brought to you by TestMu AI!👐
Ten times more generated code does not mean ten times more testing. It means roughly 100 times more, because testing costs scale quadratically. That claim comes out of the TestGuild Automation Podcast's 600th episode this week, and it sounds oversized right up until you look at what else shipped.
That is already happening. Vercel's agents write up to a third of its merged pull requests into the AI SDK. And the checking lags: users approve 97% of Claude Code's prompts, while reviewers caught 13.6% of planted dangerous commands against the model's 89%.
The rest of the week lands harder for it. Cypress was breached through its internal analytics dashboard. Gradle fixed JVM suites reporting green while running nothing. Vitest 5 will finally fail an assertion nobody awaited. A green check that was never checked.
Kane CLI is live on Product Hunt today. It turns a plain-English description into a real Chrome run from your terminal, then returns a pass/fail with the evidence attached. If that is a problem you have been fighting, we would value your thoughts on it.
📬 Come across something useful or interesting? Just reply and let's exchange ideas.
News
07 min
cypress.io
🔓 The Cypress team has published its incident timeline. An attacker exploited an unknown flaw in Metabase, the analytics tool Cypress ran internally, on July 31. Repository and build metadata were leaked, along with some tokens and test data. Test runs, record keys, and passwords were untouched. Rotate anything hardcoded.
09 minwiz.io
🔍 Rami McCarthy of Wiz reverse-engineered the Metabase flaw behind that breach. It reaches arbitrary blind SQL injection through the password reset endpoint. Wiz reckons that 13% of cloud environments run self-hosted Metabase, and a quarter of those are exposed to the internet. Public exploits landed on August 10.
07 mininfoworld.com
🤖 Anirban Ghoshal reports that auto mode becomes the Claude Code default from August 14 for Pro, Max, and Team. Anthropic's reasoning is blunt: users approve 97% of permission prompts. In its own study, reviewers caught 13.6% of deliberately dangerous commands, while auto mode caught 89%. Rubber-stamping, measured.
07 minproducthunt.com
⌨️ Kane CLI is live on Product Hunt today. Describe a test in plain English, and it drives real Chrome from your terminal, returning pass or fail with screenshots, DOM snapshots, and network calls attached. Version 0.8.1 shipped yesterday, the 47th release. Install with npm, run locally for free.
AI
09 minvercel.com
🏭 Lars Grammel and Eric Dodds show what a working agent factory does to a real backlog. Agents now write 25% to 35% of every pull request Vercel merges into the AI SDK and close 70% to 80% of issues. Open issues fell from 1,022 to 844.
08 minllamaindex.ai
📄 LlamaIndex ran 14 extraction systems against 370 enterprise documents totaling 4,869 pages. The finding is worth carrying into your own suite: past fifty pages, every commercial vision model falls below 35% recall, while precision still looks healthy. Short samples had made them all look fine. Test the long ones.
10 mintenetsecurity.ai
👻 Barak Sternberg, Nevo Poran, and Ron Bobrov showed at DEFCON 34 how ordinary telemetry becomes instructions an agent obeys. Blocked firewall requests and error reports are read as commands. Their technique worked 90% of the time against Claude Code on Cloudflare's own recommended setup. Check what your agent trusts.
08 minpinecone.io
🔌 Joerg Schad asks whether your API is usable by an agent, then measures it. Three cold runs of one model against Pinecone's own API took a median of six turns to the first successful call. A useful search took eleven, at roughly 90 seconds and 30 cents per run.
10 minsurveys.lambdatest.com
📋 The TestMu AI State of AI in Testing Survey 2026 is still open. It takes about ten minutes, responses stay confidential, and the findings get published back to the community. Tell us how AI is really landing in your testing, then pass it to a colleague.
Automation
07 mingithub.com
🧪 Vitest 5 reaches release candidate with nine breaking changes, and one of them matters more than the rest. A test that forgets to await an async assertion now fails instead of printing a warning. Inline projects also inherit the root config by default, and the -t separator changes.
07 minthegreenreport.blog
🔤 Irfan Mujagic of The Green Report explains a failure that looks exactly like a flake. An accented letter can arrive as one code point or two code points, so the same test passes on your laptop and fails on CI. Normalize where text enters the system, not inside the assertion.
08 minjenkins.io
⚠️ Jenkins shipped 23 fixes at once, and the critical one inverts the trust model. A compromised build agent, which is to say the machine running your tests, can execute code on the controller holding every credential. Weekly builds up to 2.575, and long-term support up to 2.568.1 are affected.
Tools
09 mindocs.gradle.org
🐘 Gradle builds most Java, Kotlin, and Android projects, and until now, it could hide the worst kind of failure. When TestNG, JUnit 4, or JUnit Platform failed to start, the default log level filtered out the error, and the build failed with no explanation.
07 minnodejs.org
📊 Node 26.7.0 adds --test-coverage-include-all, which pulls every file into the built-in test runner's coverage report rather than only the ones a test happened to reach. Coverage stops flattering suites that never imported half the codebase. Perfetto tracing lands in the same release, giving Node a mainstream profiling format.
Video & Podcast
08 mintestguild.com
🎤 Joe Colantonio talks with Jason Arbon on episode 600. Arbon argues that testing cost scales quadratically, so ten times the generated code creates roughly 100 times the testing demand. His bar for seriousness: run the same suite five times against the same build and read the actual results.
10 minyoutube.com
🎥 freeCodeCamp published an 81-minute Claude Code course developed by Eric, a former senior software engineer. Fourteen chapters walk through permission modes, autonomous goals, Skills, context and token budgets, slash commands, GitHub, and deploying through MCP. It is the operational detail most agent rollouts skip.
Events
07 mintestmuai.com
🎤 Six days to go. TestMu Conf runs August 19 to 21, virtual and completely free, with 80 sessions and 100+ speakers on agentic engineering and QA, and 75K registrations from 120+ countries. Keynotes come from Microsoft's Dona Sarkar, Replit's Luis Hector Chavez, and Entire's Thomas Dohmke.
07 mintestcon.lt
🎤 TestCon Europe returns to Vilnius for its 11th edition, with workshops on October 20 and the conference from October 21 to 23, onsite and online. Late Bird pricing holds until September 10, and code SCHEDULEOUT10 takes an extra 10% off every ticket until August 14. Keynotes include Inflectra's Adam Sandman.