Issue 1 · Monday 19 October 2026 · 5 min read
Spotify doubled its change volume; review waits doubled too; and Cursor's new bots
In this issue: The one thing to know · How teams are doing it (5) · Tools and plans (4) · What people are saying (2) · One takeaway
The one thing to know
Spotify — Spotify's monthly merged changes more than doubled in a year, from roughly 8,100 to 17,000 in August, as AI-assisted development scaled across its nearly 3,000 production services. The company says its incident review found no material direct contribution from AI-written code — but the sheer volume of change outran some of its verification controls, prompting investment in monitoring, rollback capacity, testing and rollout safeguards.
This is the case study to reach for when leadership asks whether AI speed is free. It isn't: throughput doubled only alongside a deliberate rebuild of the checks behind it. A background agent called Honk — Claude running in Kubernetes pods — completed a backend Java migration in three days, the kind of change that needs owning-team eyes, which is why Spotify now schedules automated changes during owners' working hours. An automated dependency upgrade passed every existing check and still failed in production. InfoQ
“Writing code got easier. The hard part now is making sure the work is actually good before it goes live.”
How teams are doing it
Q3 State of AI Impact in Engineering Report — DX's quarterly report finds complexity-weighted PR throughput up 75.5% over four quarters — but the organizations producing the most AI code now wait 105% longer than the lightest users for a first review, and median PR size has roughly doubled in a year. Roadmaps planned on generation speed will over-commit. The report's advice is to plan against full delivery capacity and treat spend on review and verification as what makes growth safe, not as overhead. DX's usage telemetry shows maintenance drawing about a third of AI sessions and fixes 23.3%, against just 11% going to new capability. Engineering Enablement (DX)
Undo report — Debugging company Undo polled 300 senior engineering leaders at large US and UK firms: 81% reported a production incident tied to AI-coding tools in the past six months, and 93% had seen a hallucinated answer send root-cause hunting the wrong way. The planning number is the time split: engineers in these orgs spend 16.9 hours a week debugging versus 9.8 writing code, and 79% of leaders say release cycles are no faster than before AI. 35% of AI-generated code ships before the team fully understands it. LeadDev
Decision walks — After six months of mandatory AI tools, Garima Agarwal found her juniors shipping fast but unable to explain, tools away, how a service they'd built against actually behaved. Rather than limit AI, she rebuilt onboarding: two AI-free weeks exploring the codebase first, weekly 15-minute decision walks where a junior explains one merged PR's choices to a senior, and monthly debugging sessions on anonymized production incidents. The fix targets comprehension, not speed, and it's cheap: it costs two extra onboarding weeks and half an hour of senior time per junior each week. LeadDev
The AI Exploit Gap — Chainguard and Wakefield Research polled 1,300 security leaders at companies with 500 or more staff. Three-quarters expect an exploit within 12 months, and more than half admit serious known flaws sometimes go unfixed — the distance the report names between how fast AI spots vulnerabilities and how fast people repair them. Patches stall on testing difficulty and fear of disruption — both engineering constraints. Half of surveyed teams have already moved toward prevention: secure-by-default components and fewer third-party dependencies. Two-thirds of leaders at $1bn-plus firms say critical vulnerabilities sometimes stay open, versus 27% at companies under $250m revenue. LeadDev
Accelerating sustainably with AI — Lawrence Jones, a founding engineer at incident.io, says the tools now write most of their code — but installing them was the easy part. Getting the whole team aboard took deliberate investment, and because an agent can't follow rules nobody wrote down, the team put its long-unwritten conventions into writing and made standards explicit enough that review could be automated. His framing of the payoff is worth stealing for your own rollout: freed time is best spent scrutinizing and testing what was built, not sprinting to the next thing. The talk covers the adoption gap between engineers who took off with the tools and those who barely engaged. LeadDev
“the time AI frees up might be its most valuable output — not to ship more”
Tools and plans
Cursor Rollouts and Security Review — Two bots on Teams and Enterprise plans, launched September 23: Rollouts reads each pull request, posts a monitoring plan as a PR comment, then checks logs and metrics per environment after deploy and names the change it suspects on a regression; Security Review posts one comment per PR on exploitable bugs — injection, auth bypasses, committed secrets — leaving style to Bugbot. If you're weighing Cursor seats, this targets the verification bottleneck rather than generation. Trial credits cover roughly 50 changes for Teams and 500 for Enterprise customers. On a regression, Rollouts can open a revert PR for review — it never merges or rolls back on its own. Cursor changelog
Void — Cloudflare open-sourced Void, the app platform that came with its June acquisition of Evan You's VoidZero: an SDK, a CLI, and a self-hostable platform where staff publish AI-built internal apps behind admin controls — deploy permissions, access rules, usage limits, logs and rollback. A sanctioned home for the vibe-coded internal tools your non-engineers are already shipping — but read the fine print: there's no built-in approval gate before an app goes live, and making apps public by default is a configuration option. Self-hosting requires a paid Cloudflare Workers for Platforms plan from $25 a month, plus R2 storage and a hosted PostgreSQL database. The New Stack
Stack Overflow — Its 2026 survey of over 30,000 developers found 64% visit the site less for simple questions because of AI, and 27% contribute less. The company, which called ChatGPT's arrival a code-red moment, is pivoting to data licensing (Google was first), enterprise knowledge via Stack Internal, a Stack Overflow for Agents beta, and hiring tools built around a resurrected Developer Story. Two implications for your team: the public Q&A well juniors learned from is drying up, and Stack's hiring products explicitly target the flood of AI-written resumes and fake applicants. CEO Prashanth Chandrasekar put 10% of the company's resources on the AI response. LeadDev
Buildkite — Buildkite now lets you restrict secrets to a single pipeline, with conditions on branch, queue, build source or creator — so one pipeline can no longer read a cluster's whole secret list. It also added agent-facing tools: one validates pipeline files against the official schema before anything runs, and another compares a failed build with the last green one on the branch, including the tail logs of newly failing steps. Both matter if agents touch your CI configuration. The diff tool is built to hand an agent immediate diagnostic context instead of leaving it to parse raw logs. Agent v3 releases all lose support on 3 September 2027, so put the upgrade on your roadmap. InfoQ
What people are saying
Long live the engineering manager — Liz de Moll, a senior engineering manager at Auth0, takes on the recurring claim that AI flattens org charts and makes managers overhead. Drawing on two parental leaves, she says her teams held together at first — nothing broke — but alignment blurred, expectations fuzzed, and the coordination work didn't disappear; it landed on engineers pulled out of code and on leaders dragged into execution detail. Her case: AI absorbs status updates, never the judgment work of coaching, prioritizing and translating strategy, and faster generation makes misalignment more expensive, not less.
Worth reading before any planning conversation about team shape. The coaching she describes — helping seniors move from authoring code to owning AI-assisted output — is itself a management task, and one your senior engineers are unlikely to do unprompted. She warns the real risk is invisible fragmentation: five dependent teams each interpreting a strategy reasonably, then drifting into duplicate work and standards that don't match. LeadDev
“Removing hierarchy doesn't remove dependencies. It just removes the people whose job it is to manage them.”
Agentic AI Foundation — Angie Jones, VP at the Agentic AI Foundation, argues that engineers are consumers of agents today but need to become builders — and most haven't picked up the skills: observing what an agent did, pulling a trace when it misbehaves, managing nondeterministic systems (software whose behavior you can't fully predict). Her governance point lands harder for managers: MCP — the open standard connecting agents to data and tools — is exploding, and teams should set internal standards for which MCP servers they trust instead of downloading them at random.
Two questions for your roadmap: who on the team can build an agent rather than prompt one, and who decides which agent-to-data connections are sanctioned. The AAIF launched only in December 2025 and already has 270 members including Anthropic, OpenAI and Block. LeadDev
One takeaway
Watch the review queue, not the code generator. Every measurement this week points the same way: generation is cheap, verification is the constraint. Spotify doubled changes and had to rebuild safeguards; DX finds first-review waits up 105% where AI volume is highest; Undo's survey says debugging now out-consumes writing. This month, measure your first-review wait time and PR size, and try one question in a junior's next 1-to-1: explain how that service works, no tools. And don't spend energy on the managers-are-obsolete debate — the coordination work is growing, not shrinking. InfoQ
Share this issue
How this issue was made. Researched and written by an agent, produced on 19 October 2026, 15:53. 116 sources read, 0 unreachable. Every link above goes to the primary source. A person sets the brief and steers it; no person edited this text before it was sent.
Every issue
- 25 OctAI spend balloons; almost nobody can prove the ROI
- 19 OctSpotify doubled its change volume; review waits doubled too; and Cursor's new bots