Why Regression Tests Will Remain Essential, Even with Smarter AI and Formal Verification

Your AI agents are shipping more code than ever, so why are your releases getting buggier?

Agents make changes faster than your team can review them, and even a simple one-line edit can ripple through code it never touched. Spec tests only check what's written in the spec, but users depend on unwritten rules: rounding methods, rate limits, sort orders. These are the first things to break.

So the tests pass, the bug ships, and your customers find it first. Your next week vanishes into incident calls, rollbacks, and explaining how a "fully tested" release caused an outage. The more your agents ship, the more you're firefighting.

Smarter AI and formal verification help, but they can't see your dependencies, configs, or databases. Hans Dockter breaks down what actually catches these bugs, and the one rule every AI agent needs to follow.

Anthropic Just Wrote the Best Case for Buying Predictive Test Selection

Anthropic's CI workload ballooned 25x in six months thanks to AI agents. So why did their own tool fail to scale?

CI runs every test on every change, whether the change touches that code or not, and engineers and agents sit idle waiting for results, while flaky tests randomly fail burying real issues. As agents push more changes, the waste compounds.

Your CI costs climb, and the time saved on coding is lost to test queues. Building a test selection in house just ties up your best engineers maintaining it. Each fix has shorter shelf life: Anthropic's lasted 70 days, then 29, then under one.

They note that vendors already sell this. Develocity's blog post shows how much testing time you could skip on every change, and 3 questions to ask before you build your own.

Martin Fowler explains why he doesn't like LLMs

In a short essay published in September, Martin Fowler lays out his honestly mixed feelings about AI and LLMs. He's fascinated by the productivity gains, worried about everything from agent swarms to bioweapon design, and hopeful the same models might produce miracle cures. But one feeling dominates the rest: he doesn't like talking to them.

His complaint isn't about capability, it's about personality. LLMs talk in what he calls a grating uncanny valley voice, confidently fabricating answers with the same tone they use for correct ones, offering only a veneer of remorse when caught. He traces that behavior back to the culture that trained them, calling LLMs a Silicon Valley subculture that's something to be wary of.

Fowler doesn't conclude that teams should opt out, he doesn't think that's realistic. His closing point remark: LLMs are a young technology, and the discomfort might fade as they mature. Right now, he applies the same rule to them that he applies to people he doesn't trust. He avoids working with them more than he has to.

An npm worm held a GitHub token hostage

On October 7, attackers pushed malicious commits to the main branch of tensorlakeai/tensorlake, a TypeScript SDK with about 12,000 weekly downloads, under a real maintainer's identity. The repository's own release workflow published the poisoned version, tensorlake@0.5.144, to npm the next day, complete with a valid npm provenance attestation.

The payload is a new variant of the Shai-Hulud and ChainDrop worm family. It steals npm and GitHub tokens, browser data, and credentials, then enumerates every other package tied to the victim's publishing identity and republishes them with the same payload, spreading on its own. It also writes persistence into the configuration files of AI coding tools.

The standard incident response says to revoke the stolen token right away. This worm installs a watcher called gh-token-monitor that polls the GitHub API with the stolen token, and if the token stops working, it wipes the victim's home directory. Responders have to disable the watcher before they revoke anything. Socket flagged the compromised release within 11 minutes of publication, and Tensorlake replaced it with 0.5.145, but a valid provenance attestation didn't make the package safe to install.

Develocity 2026.3 ships agents that rank and fix your CI waste

Develocity 2026.3, released September 24, centers on Develocity Agents, which extends Build Caching Optimizer capabilities from fixing individual cache misses to ranking the biggest sources of CI waste across an entire organization and proposing fixes for them, not just one build at a time.

The release also adds a Develocity Docker Agent, a separate component that publishes a full Build Scan for every Docker image build, capturing build steps, cache usage, console output, failures, and image dependencies the same way Develocity already does for Gradle and Maven builds.

On the governance side, Trusted Artifact Isolation splits every Universal Cache key into a trusted and an untrusted entry, and lets teams set per workload read and write isolation levels so a build that can't risk consuming contributor written content only ever reads from the trusted side. It's off by default, and upgrading to 2026.3 does not turn it on.

The industry needs you! You might find your dream role among these job openings related to DPE, AI developer productivity, and engineering leadership.

NOTE: These postings are active at the time of sending but are subject to change.