Welcome to the 319th edition of Coding Jag brought to you by TestMu AI!👐
Agents are writing a lot more of the code we review. By September, more than 40% of pull requests on GitHub started as an agent's first draft, up from 17% in March. Someone still has to review and test that code before it ships. In Atlassian's latest developer survey, 65% of developers said they regularly spend time correcting AI output.
This week's edition is about how teams are keeping up with all that new code. Find out why Google's Project Zero runs its AI bug hunter and its fuzzer side by side. See how Netflix taught an AI to point straight at the error in a failed job's logs, and why Anthropic wants security checks done at PR time. On our side, Apple's first foldable is now live on TestMu AI real devices, and Agent Assurance is generally available. Grab a coffee. This one's worth it.
📬 Come across something useful or interesting? Just reply and let's exchange ideas.
News
15 min
github.blog
📈 GitHub's Octoverse numbers are out, and agents are all over them. By September, more than 40% of pull requests on GitHub started with an agent's first draft, up from 17% in March. Merged pull requests more than tripled in two years, to 1.3 billion. GitHub says review is now how developers shape what comes back.
08 minanthropic.com
🛡️ Anthropic's Frontier Red Team pointed an unreleased internal model at Chrome, Safari, Android, Windows, and Linux, and it found and exploited vulnerabilities with little human involvement. Chrome got 62 CVEs, all patched as of Chrome 156. For defenders, the advice is to scan your own code, and do it at PR time so fewer new bugs get in.
15 minresearch.jfrog.com
🪱 Guy Korolevski and Yair Benamou of JFrog traced an npm campaign that armed 42 GitHub repositories from 11 legitimate owners. Its payload hid in 12.9 to 13.7 MB blobs GitHub code search never indexed, with hooks for Claude, Gemini, Cursor, and VS Code. Remove persistence before revoking the stolen GitHub token, because the npm worm carries a wiper.
10 mintestmuai.com
📱 Apple's first foldable went on sale on 23 October, and iPhone Duo is already on TestMu AI real devices for live sessions on iOS 27. On the simulator, Safari's outer display gives pages a 382 x 580 viewport, so a min-width: 390px rule never fires, and the user agent won't tell you it's a Duo.
AI
15 minprojectzero.google
🐛 Samuel Groß of Google Project Zero compared six months of bug reports from Fuzzilli, a JavaScript engine fuzzer, and BigSleep, an LLM agent that reviews new V8 commits daily. BigSleep found 45 actionable vulnerabilities to Fuzzilli's 37, which he calls roughly a tie. About 25% overlapped, or around 60% in a dedicated experiment. He recommends running both.
03 minleaddev.com
⏳ Michael Hill, LeadDev's Managing Editor, looks at Atlassian's developer experience survey. In 2025, 68% of developers said AI saved them at least 10 hours a week. This year, only 25% say the same, and 65% regularly spend time reviewing, debugging, and correcting AI-generated code. For most teams, he argues, coding was never the slowest part of delivery.
15 minnetflixtechblog.com
🔎 On peak days, roughly 100,000 data and ML workloads fail at Netflix. Over three months, the old rule-based Pensive put about half of roughly seven million failure classifications in the "unknown" bucket. AI error extraction covers every failure, and the model returns only start and end line numbers, so the error you read comes straight from the log.
10 mincognition.com
🧩 Cognition's FrontierCode 2.0 scores AI coding models on whether a maintainer would merge their work. More than 20 open-source developers built the tasks from repositories they maintain, and a change that fails any blocking criterion scores zero. The top model, Opus 5.5, scores only 45%, and higher reasoning effort can lower the score.
Automation
14 mindocs.pytest.org
🐍 pytest 9.2.0 has changes that can bite on upgrade. Passing indirect, ids, or scope to parametrize positionally now raises a TypeError, and tests parametrized above function scope may run in a different order. A plugin that fails to import now exits with code 4 or 3 instead of 1. Restored assertion-rewrite caches now survive CI checkouts, too.
06 minblog.postman.com
📊 Giridhar, a product manager at Postman, walks through API load tests with the Postman CLI, including a CI gate. Without --pass-if, the command always exits 0. Even with it, the gate ignores pm.test() assertion failures. It's HTTP only, with no gRPC or WebSocket load, and cloud runs of up to 1 million virtual users need a paid plan.
03 mindeveloper.mozilla.org
🦊 Firefox 159 shipped on 27 October with changes for anyone driving it over WebDriver BiDi. A new command overrides CSS media features, though only prefers-color-scheme works so far, which is handy for dark-mode checks. If your setup enables system access, the --remote-allow-system-access flag is gone; set MOZ_REMOTE_ALLOW_SYSTEM_ACCESS=1 instead. A polling memory leak is fixed too.
Tools
15 mincode.visualstudio.com
🧰 VS Code 1.144 runs Copilot tasks in the cloud while your machine is offline, on paid Copilot plans. Cloud sessions use a separate workspace, so local uncommitted changes aren't copied automatically. Extension authors can publish from GitHub Actions via OIDC, with Marketplace credentials lasting up to 15 minutes, ahead of Azure DevOps retiring global PATs on 1 December.
05 minwebkit.org
🧭 Jen Simmons covers Safari 27.1 for iPhone Duo. Depending on the screen and layout, the viewport ranges from 382 to 951 CSS pixels wide and 368 to 902 tall. The Device Posture and Viewport Segments APIs are a preview behind feature flags. Hold the phone partially folded like a book, and Safari shows PDFs as two side-by-side pages.
02 mindocs.docker.com
🐳 Docker Desktop 4.97.0 fixes CVE-2026-114409: earlier versions could write third-party API keys and OAuth access tokens in cleartext to local logs and diagnostics bundles. The update cleans existing host logs and crash dumps. If you generated or shared a diagnostics bundle from 4.96.x or earlier, or kept log copies elsewhere, Docker says to delete or sanitize them.
Video & Podcast
12 mininfoq.com
🎤 Suhail Patel, one of Monzo's principal engineers, spends 50 minutes at QCon London on how Monzo ships hundreds of times a day across 3,000+ microservices. Each engineer gets a staging tenancy running only the services they changed, and acceptance tests now run as part of a pull request. He wants every code-bug incident turned into a CI check.
12 minrichard-seidl.com
🎧 On the German-language Software Testing podcast, Richard Seidl talks with Max Stahlschmidt about Balder, an open-source Python test framework where you swap the device implementation and keep the tests. When Max and his colleagues moved from chest-strap heart rate sensors to an optical sports watch, they reimplemented two features and carried around 100 end-to-end tests over unchanged.
02 minyoutube.com
🤖 Agent Assurance is now generally available, and this two-minute video shows what it does. You point its CLI, Rook, at your repo, PRD, or policy docs; it generates functional and adversarial scenarios, and it checks what your agent changed, sent, and touched. Every verdict comes back as Pass, Fail, or Unable to Verify. There's a 14-day free trial.
Events
05 minautomation.eurostarsoftwaretesting.com
🎟️ AutomationSTAR, the EuroSTAR conference for test automation, brings two days of talks and half-day tutorials to Antwerp on 4 and 5 November. One keynote asks, "If Coding Is Solved, How Do We Fix Specification and Testing?" Tickets cost €1,400 plus 21% Belgian VAT, with up to 25% off for teams. TestMu AI is an event sponsor.
05 mindotnet.microsoft.com
💻 .NET Conf is the free online launch event for .NET 11, running 10 to 13 November, with Microsoft's product teams on the first two days and community days after. Testers should catch the session on bringing dotnet run, test, and watch to .NET MAUI, since in .NET 11 those commands work with apps on devices, emulators, and simulators.