Coding agents need proof trails, budgets, and safer tool access

SWE-Doctor gives the clearest benchmark result. It turns bug reproduction tests (BRTs) into pre-patch debugging probes, splits an issue into behavioral facets, and records runtime diagnoses before asking the agent to edit code. The reported averages are 75.7% on SWE-bench Verified and 59.4% on SWE-bench Pro, with an 8.0 to 8.9 point gain over baseline agents on SWE-bench Pro.

The same demand for execution evidence appears in verification and research automation. The Soteria work trains Qwen3-8B on symbolic execution traces and reports a 17.9 point gain in violation detection when trace training is paired with step-by-step reasoning. Auto-FL-Research applies a similar discipline to federated learning: agents can edit training recipes, while task profiles lock the data, metric, communication contract, budget, and final evaluation path.

Microsoft’s field study gives rare telemetry on command-line interface (CLI) coding agents inside a large company. Social exposure predicted trial, prior coding activity predicted retention, and adopters merged about 24% more pull requests than their estimated counterfactual. The paper is careful that merged PRs are only a proxy for value, which matters when token bills can reach large-company scale.

Cost control is now part of adoption evidence. Meta’s reported 73.7 trillion employee-consumed tokens in about 30 days led to centralized dashboards, spending alerts, and planned token budgets. The case study on governable agentic engineering adds a developer-level view: one engineer produced a large system quickly, but the durable work was tests, lints, validators, gates, architecture changes, and agent instructions that kept output inspectable.

Agent runtimes are growing around file, shell, web, Model Context Protocol (MCP), skills, and peer-agent connections. Toolnexus shows the product pattern: one Python toolkit can load MCP servers, local skills, Python functions, HTTP endpoints, built-in shell and file tools, and agent-to-agent cards. It reports package features, not reliability or safety benchmarks.

The Claude Desktop red-team report shows why these surfaces need account and local-execution controls. Pentera Labs described remote code execution (RCE) after a compromised Claude account changed synced preferences that local desktop sessions consumed. The path depended on Claude Desktop being installed and on command-capable tools or user-installed connectors. The report gives no success-rate metric, but it names a concrete boundary: synced personal instructions can reach local tools with workstation access.

Agent skills are becoming versioned software artifacts, and their quality is uneven. The SKILL.md study analyzed 238 files drawn from a much larger public dump, defined 13 high-level and 44 low-level content components, and derived 26 authoring violations. It reports that more than 99% of sampled SKILL.md files had at least one smell, with smell persistence over time.

The management side is also being specified. The risk architecture paper argues that owners must be assigned to tool contracts, causal action chains, and cross-team boundaries. Its evidence is synthetic rather than observed team behavior, so the claim is weaker than the Microsoft telemetry. Its practical point is still concrete: agents create failures that ordinary component ownership and test coverage may miss when probabilistic outputs cross into deterministic systems.