Agent-authored change outran the tools built for human pace, and the controls that held up this week are the ones a machine enforces.
Anthropic rebuilt source control for agents (strategy).
Anthropic published its reasoning for replacing Git internally: agents now author most of its code, and Git assumes human-paced change. A few long-lived branches, commits arriving at reading speed, review as the cheap step. Fleets of agents produce many small concurrent change sets, and the expensive step becomes merging and reasoning about what happened. The useful part for anyone buying agent coding tools is the diagnosis, not the replacement they built. A team that doubles its change volume without touching its review process feels it at the main branch first, as a queue. The number worth having before that point is simple: how many of this month's pull requests were written by a person. Most teams running coding agents at any scale cannot answer it.
Agent rules drift unless something fails (governance).
Geoffrey Huntley, in a writeup Simon Willison picked up this week, describes a problem anyone managing agent coding tools will recognize. He kept adding instructions to AGENTS.md, the plain-text file where a team writes down house rules for its coding agent, and the agent kept quietly skipping them. His fix moved the rule out of prose and into a pre-commit hook, a small automatic check that runs before code is accepted and rejects the change when the rule was broken. The rule stopped being advice and became a gate. The procurement read on that: a vendor whose customization story is a markdown file of instructions is selling a suggestion box. The ones worth paying for expose somewhere a violation can fail loudly.
Tencent open-sourced local agent memory (procurement).
Tencent released an agent memory system that keeps everything locally in SQLite, the small file-based database already sitting inside phones, browsers, and most laptops. Agent memory, the piece that lets an assistant recall prior conversations and documents, is a line item a cluster of startups currently sells as a hosted service priced per seat or per query. A credible free local version does not make those vendors wrong, and plenty of teams want somebody else operating the storage. It does change the renewal conversation, because the alternative is now specific and nameable instead of theoretical. Anyone holding a hosted memory contract this quarter has a fresh reference point for what the hosted part is actually worth.
Editing secrets the model never reads (security).
Simon Willison shipped a small tool called web-edit after hitting a problem worth naming. Working from his phone through a remote coding agent, he needed to change a credentials file, and he did not want those credentials passing through the model's context on the way. The tool is early and single-purpose. The hole it exposes applies to every remote agent product now being sold to teams: when the agent opens a config file, does the file's contents enter the prompt? Most vendors do not say in writing, and the answer decides whether a key sitting in a repository has already been handed to a third party. One question, one vendor call, and the honest answers vary more than the marketing does.
Three of these four share a shape. Change volume went up, and the controls that survived the increase are the ones a machine enforces: a hook that fails, a check that blocks, a file the model never sees. The written-down versions of those same rules still exist, and the agents route around them. Ten minutes this week gets you the useful finding: locate the house rules a team wrote for its coding agents, and see whether breaking any of them would break a build.