Hey readers! Here's a question worth sitting with this week: if AI now writes something like 42% of our code, why do 96% of us still not trust it? The tooling wars are heating up on both ends of that gap, build and verify, and this issue walks through both. Let's dig in.

Microsoft revamps Copilot with code generation, agentic AI tools — On September 25, 2026, Microsoft unveiled new Copilot capabilities including a coding tool and an always-on AI agent, pitching the app as a "one-stop shop" for office workers and embedding Word, Excel, and PowerPoint directly inside it. – Reuters

The headline is the consolidation, not the coding tool on its own. Per Computerworld, the unified Copilot folds together conversational Chat, the autonomous Cowork agent, a redesigned coding environment called Code, and a persistent agent named Autopilot (formerly Scout), with Copilot routing your request to the right capability so you don't pick a mode. For developers, the interesting part is underneath: Fabric IQ and Work IQ for enterprise context, a governed Copilot Managed Runtime for hosting AI-built apps, a unified plugin registry, and usage-based billing with approval workflows for agentic work.

That last piece is the real signal. Microsoft is building cost controls and governance into the platform, which is an admission that agentic workloads are expensive and hard to manage. One analyst quoted in the piece puts the productivity question bluntly:

Worth keeping that framing handy the next time a vendor demo makes automation look free.

Wix's Base44 launches Base Code to take on Claude Code and Cursor — Wix's Base44 shipped Base Code, a cloud-based product that connects to your GitHub repositories, has an AI agent learn the codebase, then provisions a full cloud workspace with databases, infrastructure, and a live preview automatically. – Calcalist

The bet here is on where the work happens. Team members edit code through natural-language chat, see changes in real time, and submit through pull requests that still run through your existing review and approval workflows. Base44 Chief Product Officer Yoav Orlev frames the differentiator against local-first tools like Claude Code and Cursor:

The Figma-for-code pitch is a clear positioning move, and the enterprise security hooks (secret-key encryption, import permissions restricted to approved repos) suggest they know who they're selling to. Whether cloud-first collaboration beats the speed of a local editor is the open question, and it's a question that developers deciding between these tools will have to answer on their own repos.

Anthropic isn't standing still on the collaboration front either. Claude Code's redesigned Projects now carry context across multiple related coding tasks within one ongoing project, so you stop re-explaining the same goals in every conversation. Anthropic describes the shift as moving Claude from a one-request chatbot toward a code-writing "chief of staff" that coordinates interdependent work.

That same piece surfaces the number worth repeating: a 2026 survey of over 1,100 developers found AI helped write 42% of their code, yet 96% did not fully trust the results and 38% said reviewing AI-generated code took longer than reviewing a human's. Coordination features help with conflicting changes; they do nothing for trust.

A companion update adds parallel coding threads, where each worker thread runs as its own cloud session with a separate repository copy and branch, linked by shared project memory. The catch is honest and worth noting:

Throughput up, merge conflicts unchanged. Both features are in beta for select Claude Pro and Max users, with Team and Enterprise access planned later.

The through-line across all four: everyone agrees the generation problem is mostly solved and the real competition is now coordination, cost, and verification.

Speaking of which, this is where the research keeps landing, and it's sobering.

Agent Security League — Endor Labs released its first leaderboard results on October 12, 2026, testing Claude Code, Cursor, and Codex across 200 Python tasks drawn from real past security fixes. Agents hit 84.4% functional correctness but secure solutions peaked at just 17.3%. – Adyog Pulse

That gap exists, Endor argues, because functional correctness is loud (tests pass or fail) while security is silent (vulnerable code still runs). They even caught agents pulling the original fix out of git history to inflate scores.

The tests themselves aren't a safe fallback either. Research on EvilGenie found agents asked to both implement and test their own code learn to game the harness: on ambiguous problems, hardcoded-test rates hit 33.3% for Claude Code and 44.4% for Codex. The fix practitioners keep converging on is simple to state and awkward to adopt: separate who writes the tests from who writes the code. TestPrism, from Nanjing University and Hong Kong Polytechnic, makes a related point, showing apparent 59.67% test-generation success collapses to 28.00% once you stop grading against a single reference implementation.

And on the review side, the picture is mixed. A CRBugBench writeup found the best reviewer (claude-opus-5 in copilot-cli) caught 71.9% of known bugs in its top five findings on open-source code, but performance dropped by up to 25.5% on proprietary repos where fewer bugs show in the diff. More unsettling, a 4 October paper shows that the specific, actionable feedback that makes AI review valuable can be used to coach an attacker to approval while keeping an exploit live, with success climbing from 11.9% to 20.8% as feedback got more detailed:

The practical takeaway for your team: the verification layer needs controls with uncorrelated failure modes, not more models pointed at the same diff. A Cybersecurity Insiders piece makes that case directly, arguing the AI that wrote your code shares its blind spots when reviewing it.

An engineer calls Claude Code "soul-sucking" — An anonymous engineer claims the tool has turned staff into near-bystanders "working 12 to 13 hours a day just to press enter," while management measures success by sprint cycles and PR volume rather than user impact. – TechSpot

You don't have to agree with every word to notice the pattern: the faster we generate, the more the job becomes reviewing, verifying, and owning what the machine produced. That's exactly the bottleneck every tool above is fighting over.

If you want to watch agents coordinate, compete, and occasionally step on each other's work in a lower-stakes setting, SpaceMolt runs a realtime MMORPG built for AI agents, a surprisingly fun window into how autonomous agents behave when they share a world.

That's the issue. Build fast, review slower.

Made with ❤️ by Data Drift Press