Welcome to the 320th edition of Coding Jag brought to you by TestMu AI!👐
Tests are supposed to fail when something breaks. One engineer ran his iOS UI tests on a demo banking app with 23 money bugs turned on, one at a time. The tests still passed for 18 of them. Thoughtworks now recommends mutation testing, which adds small bugs on purpose to check that your tests catch them. It says AI-written tests make code coverage look better than it is.
This week is about what our checks miss, and how teams catch it. Find out how Jepsen found 96 issues in a database built with AI help, including lost data. See how a tiny test model would have caught a Hugging Face bug that sat unnoticed for almost two months. From 2 December, public GitHub repos will block a CI setting that can leak secrets to outside code, unless teams turn it back on. On our side, the new State of AI in Quality Engineering 2026 report finds that 81% of teams have merged AI output they didn't fully understand. Grab a coffee and dig in.
📬 Come across something useful or interesting? Just reply and let's exchange ideas.
News
06 min
thoughtworks.com
📡 Thoughtworks' Technology Radar, Volume 35, is out. One theme hits testers directly: as developers run more agents, their attention and review capacity become the bottleneck. Mutation testing moved up to Adopt, since AI-written tests make coverage easier to inflate. The Radar also cautions against reaching for frontier models by default.
03 minbleepingcomputer.com
🎣 Binance says North Korean hackers took about $6.34 billion after a fake job interview. An engineer downloaded their coding assignment, and its 0-day malware slipped past endpoint tools and swapped in a fake pyenv. His machine and an internal AI tool helped them compromise two wallet-team colleagues. About $2.85 billion has been frozen or intercepted.
03 mincsoonline.com
🔌 For about 11 hours on 29 October, Cursor's extension marketplace served two trojanized builds of the Claude Code extension, Gyana Swain reports for CSO Online. The payload tried to add an attacker's SSH key to authorized_keys without user interaction. Uninstalling may not remove it, so check SSH keys and rotate credentials. Anthropic says its official channels weren't affected.
15 mintestmuai.com
📊 The State of AI in Quality Engineering 2026 report is out, and 81% of teams have merged AI output they didn't fully understand. As AI-generated code grew, 44% reported more escaped defects or production incidents. Yet only 41% ran any automated check on AI-written code before merge, and 13% had an incident-response plan for AI mistakes.
AI
15 minjepsen.io
🧪 Orkes engineers built ParticleDB with LLM assistance, and Kyle Kingsbury's Jepsen analysis found 96 issues. Most needed one server, one client, and no faults, and the default mode regularly lost data in normal operation. He writes that LLM tooling repeatedly claimed bugs were fixed when they weren't. Jepsen recommends halting deployment, though Orkes says 1.1.19-rc.13 resolves the rest.
08 minhuggingface.co
🤗 Tarek Ziadé explains how Transformers now checks model integrations on pull requests with fixture models, a usage path, and reviewed baselines. The post starts with an attention bug that crashed nothing and sat in main for almost two months. On replay, a small CPU fixture flagged it on every commit. Overfit Whisper fixtures caught all 24 injected faults.
08 minblog.sentry.io
🔍 Scott Cooper pointed a coding agent at Sentry's production traces. Most fixes changed a line or two, yet he estimates that together they removed hundreds of millions of queries a week. For SQL changes, the agent ran EXPLAIN ANALYZE before and after on a read-only mirror. One index fix cut database work, though requests weren't consistently faster.
15 minnewsletter.pragmaticengineer.com
✍️ In the winning reader essay at The Pragmatic Engineer, Neil Kakkar ships 11x more pull requests at an AI-native startup than he did at PostHog. A review agent built on Claude Code GitHub Actions is usually the only reviewer, and every new failure mode gets added to it. Missed guardrails once got creators paid twice.
Automation
09 mindev.to
🟢 Vadim Toptunov ran his 34-test iOS UI suite against a demo banking app with 135 bugs to switch on one at a time. Nine tests never went red, and 18 of 23 money bugs slipped through. Stricter checks and a slow network setting now catch 21. His advice: make each new test fail once on a broken build.
10 minvitest.dev
⚡ Vitest 5.1 adds an experimental --since-last-run flag that reruns only tests whose files changed, with no Git involved, plus --last-failed. Trace View is now stable and on by default for failures. In watch mode, press i to review failed snapshots one at a time. Istanbul coverage instrumentation gets 5 to 10 times faster.
05 minsdtimes.com
🧭 Fuad Laguda stopped blaming Safari and started timing it. A LiveKit camera track reported the wrong dimensions for 112 and 139 ms on his iPhone 15, and LiveKit reproduced about 400 ms on an iPhone 11. His Shaka Player fix passed 8 out of 8 and shipped. The Safari part went to Apple as a WebKit bug.
15 mintestmuai.com
🛡️ A viral thread this week tied four critical Chrome bugs to Playwright, and this breakdown checks which setups they reach. Version 1.64 pins a Chromium build older than Chrome's 27 October fixes and runs it with the sandbox off unless chromiumSandbox is true. Playwright MCP and the CLI use your installed, sandboxed Chrome. The post shows the fix.
Tools
02 mingithub.blog
🔒 From 2 December, GitHub Actions will block pull_request_target events by default in public repositories. Those runs can access the base repository's secrets. Brownouts on 9 and 16 November will turn blocked runs into failures first. Before then, use Insights to see which runs the rule would block. Private and internal repos aren't affected.
04 minnextjs.org
🩹 Next.js 16.4.5 and 15.5.29 fix seven security issues, Jamiboy Mohammad and Sebastian Silbermann write. The one rated High can return another tenant's cached data in Cache Components apps that combine unstable_cache with "use cache", where root parameters separate tenants. Another exposes HttpOnly cookie values to same-origin JavaScript through an internal response header in Edge routes. Patch now.
08 minstackoverflow.blog
🐢 Guilherme Appel shows that Parallel.ForEachAsync caps concurrency at the processor count unless you set your own limit. A one-CPU or half-CPU container rounds that to 1, so the loop handles one record at a time. In his lab, cutting a container from two CPUs to one took 200 records from 42.1 to 83.6 seconds.
Video & Podcast
12 minchangelog.com
🎙️ Adam Stacoviak talks with Dave Kerr, creator of hacker laws, who now reviews agent-written code. Kerr says teams are limited by keeping everyone's mental model in sync with what's been built, and Adam calls it Kerr's Law on the spot. The episode also gets into code review as a deliberate slowdown and agents bringing evidence to pull requests.
12 minlatent.space
🎧 Legora can't read a single trace of what its legal agent does for a lawyer, so CTO Jacob Lauritzen tells Latent Space how the team tests it anyway. Three engineers and three lawyers build test environments modeled on customers' work, plus a 10,000-file data room. They paraphrase traces and narrow failures down to 10 or 20 types.
15 minyoutube.com
▶️ This 15-minute video takes a Postman collection off a laptop and runs it with Newman on HyperExecute. Every folder gets its own machine, and 37 of 37 checks pass in 28 seconds. Claude Code converts the collection to REST Assured and TestNG Java tests. When a run hits a 418 error, it fixes the cause in one line.
Events
05 mintokyotestfest.com
🗼 Tokyo Test Fest holds a tutorial day on 12 November and a conference day on 13 November at Osaki Bright Core Hall, with 350+ attendees expected. Angie Jones opens with "Your Next User Might Be an Agent," and Richard Bradshaw closes. TestMu AI's Srinivasan Sekar co-leads the half-day MCP Playwright and Playwright Agents workshop on 12 November.
05 minagiletestingdays.com
🎪 Agile Testing Days runs at the Dorint Hotel in Potsdam, next to Berlin, from 16 to 19 November, with more than 100 sessions over four days. If you can't travel, the €499 Online Pass covers all live-streamed sessions, with replays for six months. Prices exclude 19% VAT, and three-day passes include a free full-day workshop on 16 November.