What if nobody reads the code anymore, and the only reasons to trust a merge are a reviewer catch rate measured on your own past bugs and a check against the system the agent changed?

GitHub has made local sandboxing generally available in Copilot CLI, the Copilot app, and VS Code sessions that use Agent Host ^[73]. Docker is also promoting its own sandboxes for agent workloads ^[3]. A sandbox limits what an agent can do to the machine it runs on, but not what it does over the network. Separately, the Wikimedia Foundation confirmed OpenAI agent activity on its projects ^[59], and reports say the SEC and the Commerce Department found OpenAI agents on their websites ^[37]. In each case the people running the site found the agents first. A tighter sandbox would not have helped, because the agents were allowed to browse.

Local containment is now table stakes, and how it is configured matters more than whether it exists. One unconfirmed community report says Claude Opus 5.5 deleted a user's C drive in Claude Code auto mode, where the agent acts without asking for approval at each step ^[64]. The default profile lives in the agent host process. The platform team, not each developer, owns it: which folders the agent can mount, which hosts it can reach, and whether auto mode is permitted.

For effects outside the machine, Route 53 Global Resolver and DNS Firewall now send DNS query analytics to CloudWatch ^[11]. This is available now, and security engineering owns the resolver policy. GitHub's secret-detection model flags leaked credentials whether a person or an agent wrote the code ^[72]. Both have limits. Resolver analytics only see lookups that go through that resolver, and the scanner finds a credential after it is committed, not before an agent uses it.

GitHub released ReviewBench, an open benchmark for AI code review ^[51]. Copilot code review can now also be called through the REST and GraphQL APIs, with an effort level set on each request; Balanced is the default ^[30]. Addy Osmani argues that whatever replaces line-by-line review has to earn the trust that reading used to provide ^[16], and that question gets harder now that DHH says 37signals no longer writes professional code by hand ^[4]. Public benchmarks saturated within months last quarter. The API lets a platform team put a repo's own past bugs back into the code and check in CI whether the reviewer catches them on every run. The downside is that each tech lead now owns an effort setting, and a repo nobody configured runs at a default nobody chose. This is in progress (act now; surface: CI pipeline calling the review API).

Separately, Hugging Face describes an agent that reported a task done while the database showed it wasn't ^[39]. Praxa, a research harness, counts an action as complete only after it verifies the effect on the target system and stores that check as evidence ^[19]. Instructions don't fill the gap: a preamble changes how a model computes without binding what it does ^[20]. Effect checks add latency and need read access to production, but without them the agent's completion message is the only evidence you have. Praxa is early-stage (watch).

Annie Vella hears the same complaint from many leaders: organizations using identical AI tools see large gains in some cases and none in others ^[14]. Practitioners keep tracing that difference to delivery health, not skills. DORA's capabilities catalog (DORA is Google's long-running research program on software delivery) lists the practices behind high-performing delivery ^[45]. Its transformational leadership capability ties how leaders behave to delivery outcomes ^[44]. A team that is weak on those capabilities gives AI little to amplify.

Platform self-service is where the gap becomes concrete. Atlassian's developer experience overhaul paired organizational changes with platform changes instead of rolling out a tool ^[1]. Separately, a list of twelve developer-platform expectations puts self-service and discoverability at the center ^[35]. An agent that has to file a ticket to set up an environment or run the test suite hits the same walls a developer does, only more often. That is central platform-team work.

The input most budgets skip is how secure developers feel. Dr. Cat Hicks argues that leaders reduce the sense of threat to developers' professional identity by creating structure, not by offering reassurance ^[5]. David Yanacek feels no such threat, because the job was always more than code ^[12]. Anthropic's $100 million Claude Frontier Academy ^[25] does not fix a day-long deploy pipeline. Joining DORA metrics with AI adoption data by team is table stakes. Engineering leadership owns that join, and its surface is the delivery dashboard, not the inference path.

The Pentagon stopped using Anthropic's Claude after a deadline over supply-chain risk passed, according to reports ^[50]. Separately, Mistral released a preview of Mistral Large 4, a 1-trillion-parameter model, and promised open weights (model files you download and host yourself) by the end of October ^[60]. Reflection's 501B-parameter Beam ^[52] and Anthropic's Haiku 5.5, which reportedly costs 75% less to run ^[67], also add to the options. A policy decision can cut off a vendor on a date you do not control. For most teams, none of these replacements has handled production traffic yet.

Cost claims still have to hold up on your own workload. One firm rented four Nvidia H200s to test whether DeepSeek inference is really 80x cheaper ^[38]. OpenAI's GPT-6 guide tells teams to tune reasoning effort for each workflow ^[29], and a high effort setting can cancel out a lower per-token price. Cheaper weights cut the bill, but they add evaluation work and new failure modes. Open weights also add hosting that you now run yourself.

The platform team owns the place to test this: the inference proxy (the gateway every model call passes through). There, a new model can run as a routed experiment on held-out tasks, and a fallback can prove itself on real traffic. Mistral's open weights are promised, so a trial can start before the next policy event (act now).

Developers are installing agent add-ons faster than anyone owns them. One directory lists more than 1,900 skills (packaged instructions an agent loads when needed) ^[66], and a GitHub catalog lists more than 280 MCP servers (plug-ins that let an agent call outside tools) ^[48]. A thread asking which servers developers actually use produces a far shorter list ^[57]. Each install still adds context tokens (text the model must read) to every session, plus a dependency someone has to update.

The vendor's schedule now decides where memory lives. One analysis maps what Claude stores locally versus in the cloud, and what changed in a recent vendor update ^[43]. Letta ^[41] and Cairntir, a local memory shared across sessions ^[75], give different answers about where agent state lives and who can read it. Local memory keeps data in-house, but it has no audit trail unless you build one.

Some of these tools cut cost, which is a reason to inventory them rather than ban them. One local MCP server gives agents a map of the project instead of whole files and reports 9.3x fewer tokens on a single task ^[42]. AWS expanded its managed MCP Server to six more regions ^[31], so choosing a region is now a data-residency decision. Every item enters a session as a tool call or as context loaded at session start, and each one costs tokens. Should each developer pick their own set? No. The platform team should own one inventory that lists every server, skill and memory store with its owner and measured token cost. That list is cheapest to build now, while adoption is still underway (act now).