Bitter Frontier
Coding agents can create work faster than teams can verify it.
Source-backed, cross-project reporting on what coding agents just made cheaper, what became the new bottleneck, and where operators should spend scarce human attention.
- Bitter Lesson Maxing
- Build where improving general agents compound your advantage, not where their next release erases it.
- Amdahl Maxing
- Treat human attention as the scarce serial resource and spend it where judgment changes the outcome.
A pinned letter from the founder: an ode to the Bitter Lesson and Amdahl's law maximalism ->
Latest Published Brief
Foreground Attention Is No Longer the Control
Claude Code v2.1.198 let background agents finish code work by committing, pushing, and opening draft pull requests. Hermes, Codex, and Gemini CLI moved adjacent security boundaries through a tagged hardening wave, a trace-payload scrub, and a nightly-only memory-import fix. Operators should move control to branch policy, retained-log hygiene, and the exact release channel they run.
- Upgrade / check
- Claude Code: before rolling out v2.1.198, which lets background agents commit, push, and open draft pull requests, decide whether that authority belongs in shared repositories. Wire Notification hooks and rely on branch protection, not foreground attention. Signal
- Watch
- Gemini CLI: the memory-import symlink escape fix is in the July 2 nightly. Avoid untrusted `GEMINI.md` memory imports until preview or stable absorbs it, or run the nightly with that tradeoff in mind. Signal
Latest Profile Reviews
Recent Signals
-
Claude Code background agents now commit, push, and open draft PRs instead of stopping to ask
Claude Code v2.1.198 makes subagents background by default and says background agents launched from `claude agents` now commit, push, and open a draft PR after worktree code work instead of stopping to ask.
-
Hermes v2026.7.1 tags the security wave that was main-only last issue
Hermes v2026.7.1 ships the prior main-only wave: MCP-config persistence hardening, cron `base_url` credential-exfiltration blocking, prefix-secret sentinels for file reads, Slack `xapp-` token redaction, browser cloud-metadata guardrails, resume/session scoping, and a dependency floor.
-
Codex 0.142.5 stops writing full Responses WebSocket payloads to trace logs
Codex rust-v0.142.5 says full Responses WebSocket request payloads no longer go to trace logs.
-
Gemini CLI fixes a memory-import symlink escape in nightly only
Nightly v0.51.0-nightly.20260702.gff00dacd9 fixes a symbolic-link directory escape in the memory import processor.
-
OpenHands shipped its dependency-CVE fixes on the cloud channel; the OSS 1.8.0 line is frozen and a new CVE already sits untagged on main
Last window's unreleased dependency-CVE batch reached tags this window -- but only on the CLOUD channel: cloud-1.39.0 (2026-06-24, ~16-item CVE/dependency batch) and cloud-1.40.0 (2026-06-26, a 4-item CVE/GHSA batch). The OSS line got NO new tag; the newest non-cloud release is still 1.8.0 (2026-06-10).
-
Google retired consumer Gemini CLI (June 18) and force-migrated users to closed-source Antigravity -- which hardened one approval gate and auto-opened another the same week
Per Google's own announcement, consumer Gemini CLI stopped serving requests on 2026-06-18 (AI Pro/Ultra, free individual Code Assist, new GitHub-org installs). Enterprise Code Assist retained access and the OSS gemini-cli repo stays Apache-2.0. The successor, Antigravity CLI (the `agy` binary), is closed-source Go. If you ran Gemini CLI as an individual, your path is now a binary you cannot read.