AI engineering tools are being judged by retention, guardrails, and control paths

Gemini for Google (GfG) is the only item with a large measured deployment result. The paper adapts Gemini to Google’s internal engineering data through continued pre-training and post-training, with a mid-training method to reduce catastrophic forgetting. In a blind A/B study with 29,000 developers, it reports 23% fewer mean iterations per turn and about 17% higher code survival rates.

The Polyglot Protocol is weaker as performance evidence, because it reports no task-success benchmark or baseline comparison. Its value is procedural: it tells coding agents to inspect the repository, choose languages under explicit rules, verify APIs and tools, check dependencies and security, and label unsupported checks. The repository covers 22 languages and includes adapters for Codex, Claude Code, and OpenCode.

Resident applies agent-written code to physical devices with a tight safety boundary. It embeds a Lua runtime on ESP32 devices and exposes selected driver APIs, such as button events and display writes. Apps arrive over Wi-Fi through a websocket and run without compiling or flashing firmware.

The design keeps the live device loop local. The author cites 150 ms as the response limit for an interaction to feel instant, while cloud large language model calls add latency and often need remote personal context. The release is alpha v0.5.0, and the corpus gives no benchmark for load latency, memory use, safety tests, or device coverage. The concrete claim is hot loading inside a sandbox that blocks unrestricted capabilities such as the network stack.

Two items treat AI-agent products as systems with financial, operational, and security attack surfaces. The Polsia article audits a claimed autonomous company-builder through a public API and shipped source map. It says the public dashboard’s $9.70M annualized figure includes only about $4.63M in subscription revenue, with about 48% monthly paid churn and daily AI cost equal to about 57% of subscription run-rate. It also reports 1,355 public source modules, admin controls, human QA labels, and exposed owner or operational data for showcased companies.

The GSD incident focuses on the update path. The post says the original maintainer still controlled the npm packages get-shit-done-cc and @gsd-build/sdk after a reported token rug pull. Because these agents can run with shell and bash permissions, the guidance is to uninstall old packages, check npm and Claude directories, and use the audited community fork only if users still want that workflow.