Code, agents, and the work of verification

Intro

This week's available work reading moved from everyday software development to research claims and a kernel vulnerability. Across those topics, the recurring question is how to make fast-moving work inspectable: where human judgment belongs, what evidence supports a result, and what remains uncertain.

Faster code still needs judgment

1) Treat code as clay, but keep the engineer's eye

Alberto Denia describes agentic coding as making software cheap to reshape. That favors modeling a feature in the running system and refining what works, rather than treating plans and mockups as the only safe way to explore. His useful distinction is when judgment enters: the artisan applies it during each iteration, while the factory moves it upstream into specifications, generators, tests, evaluations, and guardrails. In practice, teams can mix the two. Reading note: Code is clay now

2) Give coding agents a legible environment and ask for evidence

Thorsten Ball's guide to working with agents recommends making the software lifecycle visible and actionable, testing whether accumulated agent instructions help, building tools for iteration, and asking for evidence rather than assurances. Its broader point is that autonomy depends on an environment agents can operate in and results people can assess. These are lessons from his team's workflow, not universal rules; review should still reflect the consequences of failure. Reading note: How I work with Agents

Why it matters: Cheap code changes increase the value of fast feedback, but they do not remove judgment. They make it more important to decide whether judgment belongs in a hands-on loop, a verification system, or both.

Powerful results need careful claims

3) AI-assisted mathematical results enter a verification process

OpenAI announced three model-produced results spanning local smoothing, a formalized refutation of the Exponential Time Hypothesis, and a mathematical existence proof related to QCD. The announcement describes external researchers shepherding review of the ETH result and public Lean artifacts. Its theoretical subexponential algorithm is not a claim that SAT is practically easy or that P versus NP is resolved; independent scrutiny and practical consequences remain separate questions. Reading note: OpenAI's AI-assisted research results

4) Separate a confirmed kernel bug from a reported exploit chain

The Linux kernel CVE team documents and fixes an IPv4 TCP use-after-free. Anthropic separately reports that an internal research model developed an exploit for servers with an MPTCP listener, including a path to command execution. The tested configuration and exploit code are not public, so the report should not be generalized to every vulnerable Linux server. Operators should check current distribution advisories and installed kernels. Reading note: CVE-2026-98432: Linux IPv4 TCP use-after-free and the MPTCP exploit claim

Closing note

The common thread is not speed alone. Useful automation makes its work observable: a product can be exercised, an agent can show evidence, a proof can be inspected, and a security claim can be separated from the confirmed fix. That is how faster output remains open to judgment instead of asking readers to trust confidence by itself.