Coding agents are being managed as production workers

Research on coding agents is giving user preferences stronger status than memory entries. Trace extracts durable user corrections, rewrites them as atomic rules, and blocks task completion until an active verifier passes. The reported gains are large on ClawArena: violation rate falls from 100.0% to 37.6% in distribution and to 2.0% out of distribution.

Repository-level guidance shows a more uneven picture. A study of 15,549 agentic pull requests across 148 projects finds that instruction files can help, but outcomes depend on the file. Projects with at least 20% merge-rate gains had longer, more structured files, with a median of 976 words compared with 569 words for projects with large drops. The practical lesson is concrete: teams need instructions with scope, checks, and structure, then need runtime hooks that make the agent obey them.

Two AIDev-based studies describe coding agents as contributors whose work now consumes real review capacity. In one sample, 46.41% of bug-fix pull requests from Copilot, Devin, Cursor, and Claude were rejected. The rejection taxonomy points to inactive or superseded fixes, incorrect implementations, wrong approaches, and continuous integration failures.

A separate causal study of 151 Java repositories warns against reading architectural metrics at face value. Agentic AI adoption is linked to a 6.7% lower architectural smell density, but raw smell counts stay flat while code volume rises by 12.8%. Teams that measure agent quality only through normalized density can miss that the underlying architecture burden has barely changed.

AgentBeats makes the benchmark itself an agent. Its Agentified Agent Assessment approach uses Agent-to-Agent communication for task management and Model Context Protocol for tool access, so subject agents can be evaluated through a shared interaction pattern. The authors report a five-month open competition with 298 judge agents, 467 subject agents, and benchmarks across coding, web browsing, healthcare, and multi-agent games.

This matters for reproducibility because agent behavior often depends on the harness. AgentBeats claims its coding case study preserved public-record fidelity where comparison was possible, while also exposing head-to-head results missing in conventional setups. The strongest evidence in the corpus is scale and compatibility, not a single score table.

ComAct targets professional Windows software by using Component Object Model, or COM, as the agent action space. The agent writes Python COM scripts for applications such as SolidWorks and AutoCAD, giving it semantic programmatic control over dense interfaces. On ComCADBench, the benchmark includes 1,000 tasks across three CAD applications, with reported task-success results often far above GUI-based agents, which the paper says were near zero.

Security evidence shows why these action channels need strict authorization. Obsidian Security reports a CVSS 9.9 LiteLLM chain where a default low-privilege user can reach admin routes and execute code on the server. Since LiteLLM sits between agents and model providers, a gateway compromise can expose keys and alter what downstream agents see or do.