Go

fighting slop with slop — Vaibhav Gupta, Boundary

Jul 31, 2026 · 21:32

Vaibhav Gupta of Boundary argues that AI slop can be fought with slop: instead of code reviews, his team relies on agents that read other agents' transcripts and on hard invariants like architecture.md files and CLI checks. He explains how they ship a stable programming language, BAML, without reading all code, using agents that flag hallucinations, tool-call errors, and inefficiencies from Claude transcripts, then A/B test language features by token spend and error rates. He attacks TypeScript as baking slop in—string coercion on sort, unsafe any—and designs BAML with inferred error types that prove division-by-zero is handled or the build fails. BAML works across Python, TypeScript, Rust, and more, with type-safe functions, lambdas, and generics across boundaries, plus zero-cost execution traces and generated CLI tools. His closing challenge: build these sloppy tools yourself, constrain the systems underneath, and rethink foundational layers like Git, databases, and programming languages.

We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3

Jul 20, 2026 · 21:57

Moritz Johner of Form3 explains that giving a coding agent production code access turns it into a supply chain actor, and the blast radius is an architecture decision. His team built PatchPilot to automate CVE patching across thousands of repositories, splitting it into a deterministic Go layer that handles dangerous operations (GitHub write access, CI triggering) and an agent layer that only edits files. The agent remediates vulnerabilities by bumping dependencies, verifying builds, and fixing CI failures, but a prompt injection could escape via the Docker socket, which kept him up at night. To contain that, they moved the agent into a firecracker microVM with its own kernel and separate network policies per layer. Johner argues that where you draw the line between deterministic and agentic code defines your security model, and warns that existing agent sandboxes are worthless when a Docker socket is involved.

Claude Code & the evolution of agentic coding — Boris Cherny, Anthropic

Jul 4, 2025 · 18:12

Boris Cherny, creator of Claude Code and Anthropic member of technical staff, argues that the product stays intentionally unopinionated and minimal because the model's coding capabilities are improving exponentially and the right UX remains unknown. He traces programming UX from 1950s punch cards to 1980s Smalltalk's live reload, Eclipse's static-analysis autocomplete, Copilot, and Devin's natural-language paradigm. Claude Code's terminal-first approach works in any terminal, over SSH, and inside VS Code or Cursor, with a GitHub integration that keeps data on user compute and a programmatic SDK for custom UIs. Key tips include using Claude for code-based Q&A (shortening onboarding from weeks to days), teaching it tools via `--help` and Claude MD files, leveraging TDD with visual iteration, and running multiple Claude instances in parallel via terminal tabs or GitHub Actions. Today's launch adds a plan mode triggered by Shift+Tab, which makes a plan and waits for approval before writing code.