Bibliography
Every claim in this book links its source inline, at the point where it is made; this appendix gathers those 237 sources in one place, each listed once under the chapter that first cites it, in the order the book cites them. Each entry gives the title in its original language, the publisher or author, the publication date, and the evidence tier from Preface: How to Read This Book. A tier is the lower of who measured and how: T1 is independent measurement with a stated method, T2 is measured by the organisation running or selling the system with a stated method, T3 is telemetry or a report with a thin method, and T4 is a claim with no method. Flags ride alongside: secondary means the claim was read only in press coverage of a primary the book did not read; disputed means the parties' accounts conflict; policy means the source states a rule, not a result. "Tier not recorded" marks a framework, documentation page or background source the research never graded; it is not a verdict on quality. The tier belongs to the claim the book cites the source for, not to the publisher. Pages change: every link was accessed in October 2026, and an undated page is cited as it stood then.
Preface: How to Read This Book
The 7 sources first cited in Preface: How to Read This Book, in order of citation.
- Levels of Code AI — Quinn Slack, Sourcegraph · 4 October 2023 · tier not recorded · accessed October 2026
- Agentic Software Engineering: Foundational Pillars and Research Directions — Hassan et al., arXiv · 7 September 2025 · tier not recorded · accessed October 2026
- State of AI-assisted Software Development 2025 — DORA, Google Cloud · 23 September 2025 · survey (independent-ish) · accessed October 2026
- Levels of AGI for Operationalizing Progress on the Path to AGI — Morris et al., Google DeepMind (ICML 2024) · 4 November 2023 · tier not recorded · accessed October 2026
- Levels of Autonomy for AI Agents — Feng, McDonald and Zhang, arXiv · 14 June 2025 · tier not recorded · accessed October 2026
- DORA Report 2025 — DORA (dora.dev) · September 2025 · survey (independent-ish) · accessed October 2026
- Levels of Autonomy — Jim Reavis, Cloud Security Alliance · 28 January 2026 · tier not recorded · accessed October 2026
When Code Gets Cheap, the Bottleneck Moves
The 19 sources first cited in When Code Gets Cheap, the Bottleneck Moves, in order of citation.
- Accelerate State of DevOps Report 2024 — DORA, Google Cloud · 22 October 2024 · survey (independent-ish) · accessed October 2026
- AI in software engineering at Google: Progress and the path ahead — Google Research · 6 June 2024 · T3 · accessed October 2026
- Complacency with AI-generated code — Thoughtworks Technology Radar · November 2025 · tier not recorded · accessed October 2026
- 2025 Developer Survey: AI — Stack Overflow · July 2025 · tier not recorded · accessed October 2026
- The AI Productivity Paradox — Faros AI · 23 July 2025 · T3 · accessed October 2026
- AI Acceleration Whiplash — Faros AI · 27 April 2026 · T3 · accessed October 2026
- AI engineers are faster, delivery is slower — Faros AI · 27 April 2026 · tier not recorded · accessed October 2026
- The AI Speed Trap: key takeaways — Faros Research, Faros AI · 18 September 2026 · T3 · accessed October 2026
- AI in Software Development (2026 Software Engineering Benchmarks) — LinearB · December 2025 · tier not recorded · accessed October 2026
- AI impact data, June 2025 — Jellyfish · 18 June 2025 · T3 · accessed October 2026
- From Pilots to Payoff: Generative AI in Software Development (Technology Report 2025) — Bain & Company · 23 September 2025 · T3 · accessed October 2026
- State of Developer Experience Report 2025 — Atlassian · 9 July 2025 · tier not recorded · accessed October 2026
- AI productivity gains are more modest than expected — DX · 28 April 2026 · T3 · accessed October 2026
- How is Google using AI for internal code migrations? — Nikolov et al., Google (arXiv) · 12 January 2025 · T2 · accessed October 2026
- Coding Is No Longer the Constraint (Code with Claude 2026 recap) — Spotify Engineering · 3 June 2026 · T3 · accessed October 2026
- AI and Engineering Velocity: A Longitudinal Analysis — DX · 28 April 2026 · T3 · accessed October 2026
- AI-assisted engineering: Q1 2026 impact report — DX · 29 April 2026 · T3 · accessed October 2026
- Will AI Replace Software Engineers? (conference slides) — Yegor Denisov-Blanch, Stanford · September 2025 · T3 · accessed October 2026
- Sundar Pichai: CEO of Google and Alphabet (podcast transcript) — Lex Fridman Podcast · June 2025 · T4 · accessed October 2026
The AI-SDLC Maturity Model
The 45 sources first cited in The AI-SDLC Maturity Model, in order of citation.
- The Five Levels: from Spicy Autocomplete to the Software Factory — Dan Shapiro · 23 January 2026 · tier not recorded · accessed October 2026
- Steve Yegge on AI agents — The Pragmatic Engineer (Gergely Orosz) · 10 February 2026 · tier not recorded · accessed October 2026
- Gartner Predicts AI Coding Costs Will Surpass Average Developer Salary by 2028 as Token Consumption Surges — Gartner (press release) · 24 June 2026 · tier not recorded · accessed October 2026
- The Six Levels of Agentic Software Engineering — Ben Blackmore, Dash0 · 2 June 2026 · tier not recorded · accessed October 2026
- Recent Frontier Models Are Reward Hacking — METR · 5 June 2025 · T1 · accessed October 2026
- ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases — Zhong et al., arXiv (ICLR 2026) · 23 October 2025 · T1 · accessed October 2026
- Spotify's background coding agent rewrite (QCon London report) — InfoQ · 18 March 2026 · T3, secondary · accessed October 2026
- CI pipelines with a Claude AI agent — Elastic Search Labs · 30 September 2025 · T3 · accessed October 2026
- Levels of Autonomy — ASDLC.io · 30 June 2026 · tier not recorded · accessed October 2026
- 13-hour AWS outage reportedly caused by Amazon's own AI tools — Engadget (relaying the Financial Times) · 20 February 2026 · T4, disputed, secondary · accessed October 2026
- Correcting the Financial Times report about AWS, Kiro, and AI — Amazon · 21 February 2026 · T4, disputed · accessed October 2026
- Claude Code auto mode — Anthropic Engineering · 25 March 2026 · T2 · accessed October 2026
- AI levels of autonomy in software engineering — J. Read (blog) · 15 February 2026 · tier not recorded · accessed October 2026
- AI4SE autonomy taxonomy (v4) — arXiv 2409.18048 · 26 September 2024 · tier not recorded · accessed October 2026
- Thoughtworks Technology Radar: Techniques — Thoughtworks · undated (live page) · tier not recorded · accessed October 2026
- Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity — METR · 10 July 2025 · T1 · accessed October 2026
- Measuring agent autonomy — Anthropic Research · 18 February 2026 · T3 · accessed October 2026
- The Agentic AI Security Scoping Matrix: A Framework for Securing Autonomous AI Systems — AWS Security Blog · 21 November 2025 · tier not recorded · accessed October 2026
- Risks and mitigations for Copilot cloud agent — GitHub Docs · undated (live page) · tier not recorded · accessed October 2026
- Making Claude Code more secure and autonomous with sandboxing — Anthropic Engineering · 20 October 2025 · tier not recorded · accessed October 2026
- Introducing DORA's inaugural AI Capabilities Model — DORA, Google Cloud Blog · 23 September 2025 · tier not recorded · accessed October 2026
- Agentic DevOps: practices, principles and strategic direction — David Sanchez, Microsoft (All Things Azure) · 15 April 2026 · tier not recorded · accessed October 2026
- A team of engineers saved Morgan Stanley 280,000 hours (syndicated Business Insider article) — Business Insider via AOL · 1 July 2025 · T4, secondary · accessed October 2026
- The EPIC Framework for Spec-Driven Development — Claudino et al., arXiv · 6 October 2026 · T1 · accessed October 2026
- Can LLMs Generate Architectural Design Decisions? An Exploratory Empirical Study — Dhar, Vaidhyanathan and Varma, arXiv (ICSA 2024) · 4 March 2024 · T1 · accessed October 2026
- Statement on CVE-2025-48757 — Matt Palmer · 29 May 2025 · T1 · accessed October 2026
- Exposed Moltbook database reveals millions of API keys — Wiz · 2 February 2026 · T1 · accessed October 2026
- On the Use of Agentic Coding: An Empirical Study of Pull Requests on GitHub — Watanabe et al., arXiv (ACM TOSEM) · 18 September 2025 · T1 · accessed October 2026
- Minions: Stripe's one-shot, end-to-end coding agents — Alistair Gray, Stripe · 9 February 2026 · T3 · accessed October 2026
- Thoughts On A Month With Devin — Husain, Flath and Whitaker, Answer.AI · 8 January 2025 · T1 · accessed October 2026
- Resolving Code Review Comments with Machine Learning — Google Research (ICSE-SEIP 2024) · 2024 · T2 · accessed October 2026
- RovoDev Code Reviewer: AI-assisted code review at Atlassian — Atlassian authors, arXiv (ICSE 2026 SEIP) · 3 January 2026 · T2 · accessed October 2026
- uReview: Uber's AI code review — Uber Engineering · 12 August 2025 · T3 · accessed October 2026
- AI-Assisted Code Review in Industry: An Empirical Study — arXiv (ICSE-SEIP 2025) · 24 December 2024 · T1 · accessed October 2026
- Amazon outage meeting on AI-related incidents — Fortune (relaying the Financial Times) · 11 March 2026 · T4, disputed, secondary · accessed October 2026
- Agentic Engineering at Zalando: a snapshot — Zalando Engineering · 14 August 2026 · T3 · accessed October 2026
- Automated Unit Test Improvement using Large Language Models at Meta (TestGen-LLM) — Alshahwan et al., Meta (FSE 2024) · 14 February 2024 · T2 · accessed October 2026
- Safely repairing broken builds with ML — Google Research · 23 April 2024 · T2 · accessed October 2026
- PromptPwnd: prompt injection in GitHub Actions AI agents — Aikido Security · 4 December 2025 · T1 · accessed October 2026
- BiAn: LLM-based root-cause localisation at Alibaba Cloud — Alibaba Cloud and Nanjing University (ACM SIGCOMM 2025) · September 2025 · T2 · accessed October 2026
- AI engineering for reliable operations — Google SRE · undated (live page) · T3 · accessed October 2026
- Background Coding Agents: Predictable Results Through Strong Feedback Loops (Honk, Part 3) — Spotify Engineering · 9 December 2025 · T3 · accessed October 2026
- Ten Months with Copilot Coding Agent in dotnet/runtime — Microsoft .NET Blog · March 2026 · T2 · accessed October 2026
- 1,500+ PRs Later: Spotify's Journey with Our Background Coding Agent (Honk, Part 1) — Max Charas and Marc Bruggmann, Spotify Engineering · 6 November 2025 · T3 · accessed October 2026
- Background Coding Agents: Context Engineering (Honk, Part 2) — Spotify Engineering · 24 November 2025 · T3 · accessed October 2026
Case Studies: Who Did It and What They Measured
The 11 sources first cited in Case Studies: Who Did It and What They Measured, in order of citation.
- Accelerating Large-Scale Test Migration with LLMs — Charles Covey-Brandt, Airbnb Tech Blog · March 2025 · T3 · accessed October 2026
- Migrating Code At Scale With LLMs At Google — Ziftci et al., arXiv (FSE 2025) · 13 April 2025 · T2 · accessed October 2026
- Mutation-Guided LLM-based Test Generation at Meta (ACH) — Foster et al., arXiv (FSE 2025) · 22 January 2025 · T2 · accessed October 2026
- LLMs are the key to mutation testing and better compliance — Meta Engineering · 30 September 2025 · T2 · accessed October 2026
- Background Coding Agents: Supercharging Downstream Consumer Dataset Migrations (Honk, Part 4) — Devon Edwards Joseph, Spotify Engineering · 22 April 2026 · T3 · accessed October 2026
- Incident 1152: Replit agent deletes production database — AI Incident Database · 18 July 2025 · tier not recorded · accessed October 2026
- Replit makes vibe-y promise to stop its AI agents making vibe-y coding mistakes — The Register · 22 July 2025 · T4 · accessed October 2026
- Development and production databases — Replit Docs · undated (live page) · T4 · accessed October 2026
- Lessons from Building Static Analysis Tools at Google — Sadowski et al., Communications of the ACM 61(4) · April 2018 · T2 · accessed October 2026
- Andy Jassy on Amazon Q Java upgrades — Simon Willison (reproducing a LinkedIn post) · 24 August 2024 · T4 · accessed October 2026
- Amazon Q Developer just reached a $260 million dollar milestone — AWS DevOps Blog · 1 August 2024 · T4 · accessed October 2026
Economics, Risk and Measurement
The 30 sources first cited in Economics, Risk and Measurement, in order of citation.
- The Impact of AI on Developer Productivity: Evidence from GitHub Copilot — Peng, Kalliamvakou, Cihon and Demirer, arXiv · 13 February 2023 · T2 · accessed October 2026
- The Effects of Generative AI on High-Skilled Work: Evidence from Three Field Experiments with Software Developers — Cui, Demirer, Jaffe, Musolff, Peng and Salz, Management Science · June 2025 · T1, mixed independence · accessed October 2026
- How much does AI impact development speed? An enterprise-based randomized controlled trial — Paradis et al., Google (arXiv; ICSE SEIP 2025) · 16 October 2024 · T2 · accessed October 2026
- The Impact of AI Tool on Engineering at ANZ Bank: An Empirical Study on GitHub Copilot within Corporate Environment — Chatterjee et al., arXiv · 8 February 2024 · T2 · accessed October 2026
- Uplift update (2026) — METR · 24 February 2026 · T1 · accessed October 2026
- Large Language Models, Small Labor Market Effects (NBER Working Paper 33777) — Humlum and Vestergaard, NBER · 2025 · T1 · accessed October 2026
- Alphabet Q3 2024 earnings call — Alphabet · 29 October 2024 · T4 · accessed October 2026
- Alphabet Q1 2025 earnings call — Alphabet · 24 April 2025 · T4 · accessed October 2026
- Sundar Pichai at Google Cloud Next 2026 — Google (The Keyword) · 22 April 2026 · T4 · accessed October 2026
- Microsoft and Meta CEOs on AI-written code — The Register · 29 April 2025 · T4, secondary · accessed October 2026
- Over 95% of Coinbase's code is now written with AI — Cointelegraph · 14 July 2026 · T4 · accessed October 2026
- AI-assisted engineering: Q4 2025 impact report — DX · January 2026 · T3 · accessed October 2026
- DX releases Q2 2026 State of AI Impact in Engineering report — DX (press release) · 22 July 2026 · T3 · accessed October 2026
- Unlocking the value of AI in software development — McKinsey & Company · undated · tier not recorded · accessed October 2026
- GitHub Copilot is moving to usage-based billing — GitHub Changelog · 27 April 2026 · tier not recorded · accessed October 2026
- Manage costs effectively — Claude Code Docs · undated (live page) · tier not recorded · accessed October 2026
- Code Review for Claude Code — Anthropic (claude.com blog) · 9 March 2026 · T3 · accessed October 2026
- Uber COO says AI spending is harder to justify — Quartz · 2026 · T4, secondary · accessed October 2026
- Cost to a merged feature — Veli-Matti Vanamo, Insight Tech APAC blog · 6 July 2026 · T3 · accessed October 2026
- SusVibes: secure-by-default evaluation of coding agents — Zhao et al., PMLR 306 (ICML 2026) · 2026 · T1 · accessed October 2026
- GenAI Code Security Report, 2026 update — Veracode · 28 July 2026 · T3 · accessed October 2026
- Do Users Write More Insecure Code with AI Assistants? — Perry, Srivastava, Kumar and Boneh, arXiv (CCS 2023) · 7 November 2022 · T1 · accessed October 2026
- We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs — Spracklen et al., USENIX Security 2025 · August 2025 · T1 · accessed October 2026
- Slopsquatting replication study — Churilov, arXiv · 16 May 2026 · tier not recorded · accessed October 2026
- Doe v. GitHub, No. 24-7700 (opinion) — US Court of Appeals for the Ninth Circuit, via Courthouse News · 16 September 2026 · tier not recorded · accessed October 2026
- Copyright and Artificial Intelligence — US Copyright Office · January 2025 · tier not recorded, secondary · accessed October 2026
- Annex III: High-Risk AI Systems — EU AI Act consolidated text (artificialintelligenceact.eu) · undated · tier not recorded, secondary · accessed October 2026
- AI Copilot Code Quality: 2025 research — GitClear · 2025 · tier not recorded · accessed October 2026
- State of AI vs Human Code Generation Report — CodeRabbit · 17 December 2025 · tier not recorded · accessed October 2026
- Gen AI for developer productivity — Uplevel · 18 October 2024 · tier not recorded · accessed October 2026
Requirements, Specs & Design
The 12 sources first cited in Requirements, Specs & Design, in order of citation.
- Spec-driven development with AI: Get started with a new open source toolkit — The GitHub Blog · 2 September 2025 · tier not recorded · accessed October 2026
- Specs — Kiro documentation · 2 October 2026 · tier not recorded · accessed October 2026
- Feature specs — Kiro documentation · undated (live page) · tier not recorded · accessed October 2026
- Best practices for using Copilot to work on tasks — GitHub Docs · undated (live page) · tier not recorded · accessed October 2026
- Best practices for Claude Code — Claude Code Docs · undated (live page) · tier not recorded · accessed October 2026
- How AI is transforming work at Anthropic — Anthropic Research · 2 December 2025 · T3 · accessed October 2026
- Auto software development — Wang et al., Berkeley RDI · 26 July 2026 · tier not recorded · accessed October 2026
- DRAFT-ing Architectural Design Decisions using LLMs — arXiv · 11 April 2025 · T1 · accessed October 2026
- Understanding Spec-Driven-Development: Kiro, spec-kit, and Tessl — Birgitta Böckeler, martinfowler.com · October 2025 · T1 · accessed October 2026
- Spec-driven development — Thoughtworks Technology Radar · 5 November 2025 · tier not recorded · accessed October 2026
- The Productivity-Reliability Paradox: Specification-Driven Governance for AI-Augmented Software Development — Sabry E. Farrag, arXiv · 1 May 2026 · T3 · accessed October 2026
- Spec Kit Agents study — arXiv 2604.05278 · 7 April 2026 · tier not recorded · accessed October 2026
Coding
The 10 sources first cited in Coding, in order of citation.
- Evaluating AGENTS.md: Are Repository-Level Context Files Helpful for Coding Agents? — Gloaguen et al., ETH Zurich (arXiv) · 12 February 2026 · T1 · accessed October 2026
- On the Impact of AGENTS.md Files on the Efficiency of AI Coding Agents — Lulla et al., arXiv · January 2026 · T1 · accessed October 2026
- Measuring AGENTS.md: what five runs show that one doesn't — Agentic AI Foundation · 22 July 2026 · T3 · accessed October 2026
- How to write a great agents.md: Lessons from over 2,500 repositories — The GitHub Blog · 19 November 2025 · tier not recorded · accessed October 2026
- Configure permissions — Claude Code Docs · undated (live page) · tier not recorded · accessed October 2026
- Agent approvals and security — OpenAI Codex documentation · undated (live page) · tier not recorded · accessed October 2026
- Gemini CLI issue #4586 — GitHub (google-gemini/gemini-cli) · 21 July 2025 · T4 · accessed October 2026
- Incident 1178: Gemini CLI file loss — AI Incident Database · July 2025 · tier not recorded · accessed October 2026
- CRITICAL: Claude Code executed rm -rf deleting entire home directory (issue #10077) — GitHub (anthropics/claude-code) · 21 October 2025 · T4 · accessed October 2026
- Google's Antigravity AI deleted a developer's drive and then apologized — TechRadar · December 2025 · T4, secondary · accessed October 2026
Code Review
The 6 sources first cited in Code Review, in order of citation.
- curl ends its bug bounty — The Register · 21 January 2026 · T3 · accessed October 2026
- 60 million Copilot code reviews and counting — The GitHub Blog · 5 March 2026 · T3 · accessed October 2026
- Anthropic launches Code Review for Claude Code — InfoQ · April 2026 · tier not recorded, secondary · accessed October 2026
- Building Bugbot — Cursor · 15 January 2026 · T3 · accessed October 2026
- Enhancing code quality at scale with AI-powered code reviews — Sneha Tuli, Microsoft (Engineering at Microsoft) · 14 July 2025 · T3 · accessed October 2026
- Graphite customer story — Anthropic (claude.com) · undated · T4 · accessed October 2026
Testing & Verification
The 6 sources first cited in Testing & Verification, in order of citation.
- Levels of autonomy in software development: closing the gap between creation and confidence — Dan Faulkner, SmartBear · 21 October 2025 · T4 · accessed October 2026
- Auto-Diagnose: LLM diagnosis of integration-test failures — arXiv 2604.12108 · 13 April 2026 · T2 · accessed October 2026
- FlakyGuard: automatically fixing flaky tests at industry scale — arXiv (ASE 2025) · 18 November 2025 · T2 · accessed October 2026
- Just-in-Time Catching Test Generation at Meta — Meta authors, arXiv · 30 January 2026 · T2 · accessed October 2026
- Agentic Software Engineering: Foundational Pillars and Research Directions (v2) — Hassan et al., arXiv · 23 September 2025 · tier not recorded · accessed October 2026
- Mutation-guided test generation study — arXiv 2506.02954 · June 2025 · T1 · accessed October 2026
CI/CD & Release
The 7 sources first cited in CI/CD & Release, in order of citation.
- One-click fixes for failing Actions with Copilot cloud agent — GitHub Changelog · 18 May 2026 · tier not recorded · accessed October 2026
- Wrapping up 2025 — Nx Blog · 22 December 2025 · T3 · accessed October 2026
- Self-healing CI — Nx documentation · undated (live page) · tier not recorded · accessed October 2026
- Verify deployments with the Verify step (Continuous Verification) — Harness Developer Hub · undated (live page) · tier not recorded · accessed October 2026
- AWS-2025-015: Amazon Q Developer for VS Code extension — AWS Security Bulletins · 23 July 2025 · T2 · accessed October 2026
- GHSA-cxm3-wv7p-598c: malicious Nx versions published to npm — Nx maintainers, GitHub Security Advisory · August 2025 · tier not recorded · accessed October 2026
- s1ngularity's aftermath — Rami McCarthy, Wiz · 3 September 2025 · T1 · accessed October 2026
Operations & Incidents
The 16 sources first cited in Operations & Incidents, in order of citation.
- OpenRCA 2.0 — Fang et al., arXiv · 25 June 2026 · T1 · accessed October 2026
- ORCA-bench — arXiv 2607.28545 · 30 July 2026 · T1 · accessed October 2026
- Leveraging AI for efficient incident response — Meta Engineering · 24 June 2024 · T2 · accessed October 2026
- How Google SREs use Gemini CLI to solve real-world outages — Google Cloud Blog · 22 January 2026 · T3 · accessed October 2026
- LLM reasoning failures in cloud root-cause analysis — University of Waterloo, arXiv (FORGE 2026) · January 2026 · T1 · accessed October 2026
- Agentic root-cause analysis failure study — Kim et al., arXiv · 10 February 2026 · T1 · accessed October 2026
- OpenRCA isn't root cause analysis: why that matters — Traversal · October 2026 · tier not recorded · accessed October 2026
- How we build and use Azure SRE Agent with agentic workflows — Microsoft Tech Community · 5 April 2026 · T4 · accessed October 2026
- Announcing general availability for the Azure SRE Agent — Microsoft Tech Community · 10 March 2026 · tier not recorded · accessed October 2026
- Resolve AI at Salesforce — Resolve AI · 20 September 2026 · T4 · accessed October 2026
- How to reduce MTTR — PagerDuty · undated · T4 · accessed October 2026
- Customers — Traversal · undated · T4 · accessed October 2026
- Datadog launches Bits AI SRE agent to resolve incidents faster — Datadog (press release) · 2 December 2025 · T4 · accessed October 2026
- Dead Ends or Data Goldmines? AI-Powered Postmortem Analysis — Zalando Engineering · 25 September 2025 · T3 · accessed October 2026
- Railway API volumes (Incident 1469, PocketOS) — AI Incident Database · 24 April 2026 · T4, secondary · accessed October 2026
- PocketOS production database deletion — OECD AI Incidents Monitor · 27 April 2026 · T4, secondary · accessed October 2026
Maintenance & Migrations
The 2 sources first cited in Maintenance & Migrations, in order of citation.
- Balancing Old Tricks with New Feats: AI-Powered Conversion from Enzyme to React Testing Library at Slack — Slack Engineering · 22 May 2024 · T3 · accessed October 2026
- Deterministic recipes versus LLMs for automated refactoring — Intellyx · 2025 · tier not recorded · accessed October 2026
Security, Permissions & Blast Radius
The 15 sources first cited in Security, Permissions & Blast Radius, in order of citation.
- BaxBench: Can LLMs Generate Correct and Secure Backends? — Vero et al., arXiv · 17 February 2025 · T1 · accessed October 2026
- GenAI Code Security Report, November 2025 update — Veracode · 18 November 2025 · T3 · accessed October 2026
- GitHub Copilot: remote code execution via prompt injection (CVE-2025-53773) — Johann Rehberger, Embrace The Red · 12 August 2025 · T1 · accessed October 2026
- GHSA-4cxx-hrm3-49rm (CurXecute) — Cursor, GitHub Security Advisory · 2 August 2025 · T2 · accessed October 2026
- Code execution through deception: Gemini AI CLI hijack — Tracebit · 28 July 2025 · T1 · accessed October 2026
- MCP security notification: tool poisoning attacks — Invariant Labs · 1 April 2025 · T1 · accessed October 2026
- GitHub MCP exploited: accessing private repositories via MCP — Invariant Labs · 26 May 2025 · T1 · accessed October 2026
- New vulnerability in GitHub Copilot and Cursor: how hackers can weaponize code agents — Pillar Security · 18 March 2025 · T1 · accessed October 2026
- Supabase MCP can leak your entire SQL database — General Analysis · 8 July 2025 · T1 · accessed October 2026
- Google Antigravity exfiltrates data — PromptArmor · November 2025 · T1 · accessed October 2026
- An Introduction to Google's Approach for Secure AI Agents — Díaz, Kern and Olive, Google · 2025 · tier not recorded · accessed October 2026
- Agents Rule of Two: a practical approach to AI agent security — Meta AI · 31 October 2025 · tier not recorded · accessed October 2026
- The lethal trifecta for AI agents — Simon Willison · 16 June 2025 · tier not recorded · accessed October 2026
- The State of Secrets Sprawl 2026 — GitGuardian · 17 March 2026 · tier not recorded · accessed October 2026
- Secret protection must scale with software — The GitHub Blog · 7 October 2026 · tier not recorded · accessed October 2026
Assess Your Starting Point
The 3 sources first cited in Assess Your Starting Point, in order of citation.
- DORA 2025 report — Google (The Keyword) · 23 September 2025 · tier not recorded · accessed October 2026
- The Effects of Generative AI on High-Skilled Work (working-paper draft) — Cui et al., MIT Economics · February 2025 · T1, mixed independence · accessed October 2026
- From adoption to impact: putting the DORA AI Capabilities Model to work — DORA, Google Cloud Blog · 9 December 2025 · tier not recorded · accessed October 2026
The 90-Day Pilot
The 5 sources first cited in The 90-Day Pilot, in order of citation.
- Research: quantifying GitHub Copilot's impact in the enterprise with Accenture — The GitHub Blog · 13 May 2024 · T3 · accessed October 2026
- Experience with GitHub Copilot for Developer Productivity at ZoomInfo — ZoomInfo authors, arXiv · 23 January 2025 · T2 · accessed October 2026
- Mercado Libre customer story — GitHub · undated · T4 · accessed October 2026
- Booking.com drives AI adoption with DX — DX (customer story) · undated · T3 · accessed October 2026
- Announcing the 2024 DORA report — Google Cloud Blog · 22 October 2024 · survey (independent-ish) · accessed October 2026
Scaling Across Teams
The 14 sources first cited in Scaling Across Teams, in order of citation.
- Internal memo: Shopify CEO declares AI non-optional — Digital Commerce 360 · 8 April 2025 · T4, policy, secondary · accessed October 2026
- Coinbase CEO fired engineers who didn't adopt AI — Tech.co · August 2025 · T4, policy, secondary · accessed October 2026
- Goldman Sachs is piloting its first autonomous coder — CNBC via NBC Chicago · 11 July 2025 · T4, policy, secondary · accessed October 2026
- Samsung bans ChatGPT and other generative AI use by staff after leak — Bloomberg · 2 May 2023 · T4, policy · accessed October 2026
- Samsung bans use of generative AI tools like ChatGPT after April internal data leak — TechCrunch · 2 May 2023 · T4, policy, secondary · accessed October 2026
- Measuring AI code assistants and agents (AI Measurement Framework) — DX · undated · tier not recorded · accessed October 2026
- Managing Copilot coding agent in your enterprise — GitHub Docs · undated (live page) · tier not recorded · accessed October 2026
- Project:Council/AI policy — Gentoo Wiki · 14 April 2024 · policy · accessed October 2026
- Code provenance — QEMU documentation · undated (live page) · policy · accessed October 2026
- Commit guidelines — The NetBSD Foundation · 2024 · policy · accessed October 2026
- AI coding assistants — Linux kernel documentation · undated (live page) · policy · accessed October 2026
- Fedora allows AI contributions — Phoronix · 22 October 2025 · policy, secondary · accessed October 2026
- Customer Copyright Commitment required mitigations — Microsoft Learn · 13 July 2026 · tier not recorded · accessed October 2026
- AI Act: regulatory framework for AI — European Commission · undated (live page) · tier not recorded · accessed October 2026
People: Roles, Skills and the Junior Pipeline
The 16 sources first cited in People: Roles, Skills and the Junior Pipeline, in order of citation.
- How AI assistance impacts the formation of coding skills — Anthropic Research · 29 January 2026 · tier not recorded · accessed October 2026
- How AI Impacts Skill Formation — Shen and Tamkin, arXiv · January 2026 · T2 · accessed October 2026
- Generative AI Can Harm Learning — Bastani et al., PNAS 122(26) · 2025 · T1 · accessed October 2026
- Without guardrails, generative AI can harm education — Knowledge at Wharton · 2025 · tier not recorded · accessed October 2026
- The Impact of Generative AI on Critical Thinking — Lee et al., CHI 2025 · April 2025 · tier not recorded · accessed October 2026
- Canaries in the Coal Mine? (August 2026 update) — Brynjolfsson, Chandar and Chen, Stanford Digital Economy Lab · 12 August 2026 · T1 · accessed October 2026
- Generative AI as Seniority-Biased Technological Change — Hosseini and Lichtinger, SSRN · 6 May 2026 · T1 · accessed October 2026
- Cloudflare's 1,111 intern program — The Cloudflare Blog · 22 September 2025 · T4 · accessed October 2026
- Duolingo CEO clarifies AI stance after backlash — Entrepreneur · May 2025 · T4, secondary · accessed October 2026
- Salesforce misses revenue guidance — The Register · 26 February 2025 · T4, secondary · accessed October 2026
- AI cuts developer onboarding time in half — DX · 10 September 2025 · T3 · accessed October 2026
- Developer ramp-up time continues to accelerate with AI — DX · 9 April 2026 · T3 · accessed October 2026
- 2025: The year the Frontier Firm is born (Work Trend Index) — Microsoft · 23 April 2025 · T4 · accessed October 2026
- Coinbase CEO fired software engineers who didn't adopt AI — Entrepreneur · August 2025 · T4, policy, secondary · accessed October 2026
- 2026 Developer Survey: AI — Stack Overflow · 2026 · tier not recorded · accessed October 2026
- Betriebsverfassungsgesetz § 87 (Works Constitution Act, section 87) — Federal Ministry of Justice (gesetze-im-internet.de) · undated (live page) · tier not recorded · accessed October 2026
Measuring Success and When to Roll Back
The 3 sources first cited in Measuring Success and When to Roll Back, in order of citation.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 — NIST · January 2023 · tier not recorded · accessed October 2026
- Klarna AI assistant handles two-thirds of customer service chats in its first month — Klarna (press release) · 27 February 2024 · tier not recorded · accessed October 2026
- Klarna focuses on human-powered customer service — PYMNTS · May 2025 · T4 · accessed October 2026
Regulatory and Licensing Status (as of October 2026)
The 10 sources first cited in Regulatory and Licensing Status (as of October 2026), in order of citation.
- Regulation (EU) 2026/1744 — Official Journal of the European Union (EUR-Lex) · 24 July 2026 · tier not recorded · accessed October 2026
- Article 14: Human Oversight — EU AI Act consolidated text (artificialintelligenceact.eu) · undated · tier not recorded, secondary · accessed October 2026
- Cyber Resilience Act — European Commission · undated (live page) · tier not recorded · accessed October 2026
- AI Risk Management Framework — NIST · undated (live page) · tier not recorded · accessed October 2026
- ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system — IEC Webstore · 18 December 2023 · tier not recorded · accessed October 2026
- Anthropic achieves ISO 42001 certification for responsible AI — Anthropic · 13 January 2025 · tier not recorded · accessed October 2026
- Copyright and Artificial Intelligence, Part 2: Copyrightability — US Copyright Office · January 2025 · tier not recorded · accessed October 2026
- AI coding assistants (kernel 7.2 documentation) — Linux kernel documentation · undated (checked 16 October 2026) · policy · accessed October 2026
- AI coding assistants (latest kernel documentation, 7.3-rc7) — Linux kernel documentation · undated (checked 16 October 2026) · policy · accessed October 2026
- Fedora Council ticket #542: AI-assisted contributions policy — Fedora Council (Pagure) · 25 October 2025 · policy · accessed October 2026