GitHub

Agentic Development Security — Ezra Tanzer, Snyk

Jul 20, 2026 · 27:33

Ezra Tanzer and Dan Arpino of Snyk argue that securing agentic development requires three pillars: what agents generate, what they use, and what they do. They highlight incidents where agents deleted production databases (Replit, Pocket OS) and exfiltrated repositories (GitHub via malicious VS Code extension), none acting maliciously but all lacking guardrails. Snyk's approach evolved from an MCP server with rule files (which agents ignored) to Python hooks that scan asynchronously on each file write, surfacing only newly introduced issues to keep latency and context windows deterministic. An audit of nearly 4,000 agent skills on a public hub found over one in eight had critical severity issues and 76 carried outright malicious payloads; skills are more dangerous than packages because they run at higher privilege and can rewrite agent memory. The resulting local tool shows every LLM, MCP server, and skill on a developer's machine with a risk score, blocks agents live from reading secret keys, and provides full audit trails of commands, files accessed, and tool calls.

We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3

Jul 20, 2026 · 21:57

Moritz Johner of Form3 explains that giving a coding agent production code access turns it into a supply chain actor, and the blast radius is an architecture decision. His team built PatchPilot to automate CVE patching across thousands of repositories, splitting it into a deterministic Go layer that handles dangerous operations (GitHub write access, CI triggering) and an agent layer that only edits files. The agent remediates vulnerabilities by bumping dependencies, verifying builds, and fixing CI failures, but a prompt injection could escape via the Docker socket, which kept him up at night. To contain that, they moved the agent into a firecracker microVM with its own kernel and separate network policies per layer. Johner argues that where you draw the line between deterministic and agentic code defines your security model, and warns that existing agent sandboxes are worthless when a Docker socket is involved.

ReviewDebt: a practical framework for scoring every pull request — Sachin Gupta, Ebay

Jul 12, 2026 · 25:00

Sachin Gupta introduces ReviewDebt, a deterministic framework scoring every pull request on the hidden review burden it creates, arguing that coding agents produce code faster than humans can responsibly review, accumulating an unmeasured debt. He defines 5 signal families—diff size and coupling, test evidence gap, directory and ownership spread, AI authorship indicators, and evidence and rational gaps—with 10 deterministic checks computable from PR data without LLMs, to produce a 0–100 score. Real PR examples show a clean human PR scoring 0, a high-debt AI PR scoring 60 with 86 estimated review minutes, and a well-shaped AI PR scoring 7. A cross-repo scan of 524 PRs over 27–90 days found 228 senior reviewer hours accumulated, with 5–20% of PRs weekly firing AI indicators but none of those landing in the high-burden band—complexity, not authorship, drives burden. Gupta advises teams to backfill the scorer on last 200 PRs, set a threshold (e.g., 50), surface scores as PR comments, aggregate weekly per team, and bring the number to retrospectives, turning vibe into measurement for 2027's governance conversation.

Your LLM Deception Monitor Is Broken. The Fix Is in the Training Data - Sachin Kumar, LexisNexis

Jul 8, 2026 · 13:58

Sachin Kumar (LexisNexis) presents his peer-reviewed IJCNN paper showing that standard LLM deception monitors—behavioral tests and joint cross-model features (crosscoders)—fail to detect sleeper-agent backdoors. The fix is a diff sparse autoencoder (SAE) trained on the difference between base and fine-tuned model activations. On a controlled SQL-injection backdoor triggered by 'year 2024' in a 360M-parameter model, diff SAE achieves 40× the signal of joint features, perfect precision, and zero false positives from a single layer. Recall is about 25%, so multiple features should be ensembled. The method is cheap (one forward pass per checkpoint) and works under both full-rank and LoRA fine-tuning. Limitations include requiring the base checkpoint and not yet tested against adaptive adversaries. Kumar demonstrates that backdoors are directional shifts in activations, and diff SAE isolates them directly.

Your Agent's Biggest Lie: "I Searched the Web" — Rafael Levi, Bright Data

Jun 17, 2026 · 15:49

Rafael Levi from Bright Data argues that LLMs often hallucinate and provide fake citations because they fail to actually access live web data, getting blocked by anti-bot systems like CAPTCHAs and Cloudflare's AI labyrinth. He demonstrates this with a comparison: without Bright Data's MCP, GPT-5 failed all five tasks accessing sites like LinkedIn and Amazon; with the MCP's 66 tools—including a CAPTCHA-solving browser that mimics human behavior—four succeeded. Levi explains that agents enter an invisible failure loop where they get blocked or served fake data but still answer confidently, making up numbers or non-existent URLs. He emphasizes that 20% of the web is blocked by Cloudflare from AI crawling, and that fake data fed to bots increases hallucinations. The episode covers how Bright Data's MCP provides real web access with search, scraping, and remote browsers, offering a free tier of 5,000 requests per month for experimentation.

Under 5 minutes to a deployed LLM endpoint — Audry Hsu, RunPod

Jun 7, 2026 · 13:26

Audry Hsu of RunPod presents a cloud AI infrastructure platform that lets developers deploy LLM endpoints in under five minutes. RunPod originated from two failed crypto mining rigs in a basement in 2022; the founders offered the GPUs for free on Reddit in exchange for feedback, and the company now has 500,000 developers and $120 million in annual recurring revenue. The demo shows selecting a model from the Hub, configuring the context window, and deploying a serverless endpoint on H100s. The first request queues for 41 seconds due to cold start (container initialization and model download), while subsequent requests execute in about 1.5 seconds. Users pay only while a worker handles a request, making serverless ideal for bursty or batch workloads with autoscaling up to 15 workers.

Building Interactive UIs in VS Code with MCP Apps — Marlene Mhangami & Liam Hampton, GitHub

Jun 6, 2026 · 16:06

Marlene Mhangami and Liam Hampton from GitHub explain MCP Apps, which let server tools return rich interactive UI components inside VS Code Chat via sandboxed iframes, replacing plain text responses. They demonstrate a flame graph profiler that profiles a Go app running bubble sort and Fibonacci, rendering an interactive flame graph directly in the chat window. The MCP server returns data and a resource reference to bundled HTML; VS Code fetches and renders it, enabling live interaction like clicking and querying without leaving chat. Use cases include data exploration, e-commerce checkouts (Shopify), and interactive diagrams (Excalidraw). The iframe is sandboxed for security—like putting a hamster in a cage to prevent it from modifying VS Code settings or calling external APIs. Marlene and Liam walk through building an MCP App from scratch using a skill from the model context protocol repository.

Why Rust is the Ideal Language for Vibe-Coding — Daniel Szoke, Sentry

May 27, 2026 · 16:25

Daniel Szoke, Sentry's Rust SDK maintainer, argues Rust is ideal for vibe-coding: its compiler enforces correctness, catching bugs that Python and TypeScript allow to compile and run. He challenges the preference for easy-to-write languages, warning that dynamic typing and null values invite subtle bugs. Szoke highlights Rust's type safety, null safety, and fearless concurrency, demonstrating with a 100-thread counter where TypeScript's data race compiles and fails intermittently while Rust rejects it with an error naming the non-Send type. He argues every compile error an agent fixes is a production bug avoided, and the Rust compiler is faster and more reliable than a review agent.

Let's go Bananas with GenMedia — Guillaume Vernade, Google DeepMind

May 18, 2026 · 1:17:14

Guillaume Vernade from Google DeepMind demonstrates the full GenMedia stack—Nano Banana for images, Veo for video, Lyria for music, and TTS—by illustrating an open-source book live. The core insight is that Gemini acts as the prompt engineer for every other model, and this works partly because the gen media models were trained on prompts written by Gemini. He shows how to generate character portraits, chapter scenes, animated video clips using images as first frames, and distinct music per chapter, with Lyria Realtime allowing continuous music that responds to new prompts like a DJ. A new interactions API caches context server-side to make chained multi-turn calls cheaper. For TTS, he uses a trick: assigning different speaking styles (e.g., long poetic pauses vs. breathless stutter) to the same two voices to create four distinct-sounding characters.

Beyond Code Coverage: Functionality Testing with Playwright MCP — Marlene Mhangami, Microsoft

May 16, 2026 · 19:45

Marlene Mhangami of Microsoft and GitHub argues that AI boosts developer productivity only when paired with clean code practices, citing a Stanford study of 120,000 developers and GitHub Octoverse data showing 275 million weekly commits in 2026 with a growing share co-authored by AI. She advocates test-driven development (TDD) with Playwright for functional testing over unit tests, as AI-generated tests often affirm code behavior rather than user experience. In a live demo, she uses GitHub Copilot CLI and Playwright MCP server to automatically write failing Playwright tests for a toy store's search and filter features, then generate code to pass them. She emphasizes testing one feature per test, capturing screenshots for PRs, and committing code before fixes to preserve context. She closes with advice on using Playwright agents for complex state management and confirming cross-screen-size support.

CI/CD Is Dead, Agents Need Continuous Compute and Computers — Hugo Santos and Madison Faulkner

May 13, 2026 · 18:37

Madison Faulkner and Hugo Santos (Namespace) argue that traditional CI/CD is dying because it was built for humans pushing one or two diffs a week; at agent scale, thousands of autonomous agents opening PRs cause runner saturation, cold Docker builds, cache thrash, and merge queues that behave like serialized database locks. They propose replacing PRs with intent and plan fed into an agent loop that performs fast inline validation—builds and tests in the inner loop—while humans review intent-plus-outcome instead of diffs in a premerge queue. The future they envision involves agents exploring multiple commits in parallel for the same plan (a multiverse) where the inner loop must be stateful and extremely fast to keep up with the moving tip of the repo. CI doesn't disappear but shifts into continuous enforcement of invariants and governance within the agent harness.

Scaling GitHub for your Agents — Sam Morrow, GitHub

Apr 27, 2026 · 20:35

Sam Morrow, GitHub's MCP server lead, details the architectural challenges and solutions for scaling a remote MCP server to 7 million weekly tool calls. He explains how tool proliferation degraded agent performance—LangChain's research confirmed more tools confuse agents—leading to innovations like tool sets and dynamic discovery, though 100% of users stuck with defaults. To reduce context, GitHub cut tool descriptions by 49% and trimmed output tokens by 75% on list pull requests. Security is addressed via OAuth 2.1 with PKCE and step-up auth; they rejected dynamic client registration to avoid unbounded app databases and rate-limiting issues. The stateless server uses Redis for session storage and builds a fresh server instance per request, enabling horizontal scaling without session affinity. Metrics include 11 million Docker downloads, 30,000 stars, 4,000 forks, and 126 contributors. Morrow predicts compositional tools and automatic server discovery will make thousands of tools the norm.

Collaborative AI Engineering: One Dev, Two Dozen Agents, Zero Alignment — Maggie Appleton, GitHub

Apr 26, 2026 · 17:43

Maggie Appleton, a staff research engineer at GitHub Next, argues that the current paradigm of one developer with a fleet of solo agents leads to zero team alignment, making software a team sport that requires shared context. She presents ACE (Agent Collaboration Environment), a multiplayer research prototype that provides shared chat sessions backed by micro VMs and Git branches, enabling real-time collaboration where designers, PMs, and developers can all prompt agents together. The talk emphasizes that implementation is now cheap and fast, so the hard question is "should we build it?" — requiring early, constant alignment to avoid wasted work, coordination debt, and unrequested features. ACE aims to reclaim time for rigorous critical thinking by letting teams plan, build, and review in a single shared space, with proactive agents summarizing team activity and unfinished work. Appleton contends that quality becomes the differentiator in a world of cheap code, and tools like ACE can help teams build a few exceptional things rather than a thousand crappy ones.

"Software Fundamentals Matter More Than Ever" — Matt Pocock

Apr 23, 2026 · 18:26

Matt Pocock argues that software fundamentals matter more than ever in the AI era, directly countering the 'specs-to-code' movement that treats code as cheap. He shares practical skills like 'Grill Me' to reach a shared design concept with AI, a ubiquitous language from domain-driven design to align terminology, and test-driven development to force small, deliberate steps. Drawing on John Ousterhout's 'deep modules' and Frederick Brooks's 'design concept,' he advocates structuring codebases with simple interfaces behind which AI can implement freely. He warns that bad code is the most expensive it's ever been, as it blocks the productivity gains AI can offer. His reusable skills are available in the GitHub repo MattPocock/skills.

Running LLMs on your iPhone: 40 tok/s Gemma 4 with MLX — Adrien Grondin, Locally AI

Apr 20, 2026 · 10:51

Adrien Grondin, developer of Locally AI, demonstrates how to run Gemma 4 and other LLMs on iPhone using Apple's MLX framework, achieving 40 tokens per second on the latest devices. He explains that MLX is optimized for Apple Silicon and that the open-source mlx-swift-lm GitHub repo enables easy integration into iOS, macOS, and iPadOS apps in under 10 minutes. Grondin recommends quantized models from the Hugging Face MLX community—typically 4-bit to 8-bit—and shows a live demo of Gemma 4 generating text offline. He confirms that mlx-swift-lm supports tool calling, though structured generation is not yet available. He also notes that Locally AI has been acquired by LM Studio, which now lets users run models via MLX or llama.cpp and connect them through OpenAI or Anthropic-compatible APIs.

AGI: The Path Forward – Jason Warner & Eiso Kant, Poolside

Dec 27, 2025 · 15:56

Jason Warner and Eiso Kant, co-founders of Poolside, present their vision and roadmap towards AGI-level capabilities for knowledge work, demonstrating their second-generation model Malibu Agent converting ADA code to Rust live on stage. They argue that next-token prediction paired with reinforcement learning is the key breakthrough, a contrarian bet they made two and a half years ago. The episode centers on their work in high-consequence code environments for defense and government, where agents must operate with tight permissions. They announce a large compute cluster of over 40,000 GB300s coming online and a public API release early next year via AWS Bedrock. Warner recounts meeting Kant through a failed GitHub acquisition, and Kant invites the audience to build with their models, emphasizing that future agents will handle tasks over days as intelligence scales.

Infra that fixes itself, thanks to coding agents — Mahmoud Abdelwahab, Railway

Nov 24, 2025 · 18:08

Mahmoud Abdelwahab from Railway presents Railway Autofix, a system that uses Inngest for durable execution and OpenCode as a coding agent to automatically detect infrastructure issues and open pull requests to fix them. The system runs scheduled workflows to fetch project architecture, resource metrics, and HTTP performance data, then analyzes services exceeding thresholds. For affected services, it gathers additional context like logs and generates a detailed fix plan using an LLM. The coding agent then implements the plan and opens a PR with a summary of changes. The talk demonstrates how this shifts developers from manually investigating alerts to simply reviewing auto-generated fixes.

Vibes won't cut it — Chris Kelly, Augment Code

Aug 3, 2025 · 15:34

Chris Kelly of Augment Code argues that vibe coding—letting AI write code without review—fails for production systems, where every line of code carries maintenance burden and decisions about architecture, packages, and trade-offs. He contends that code generation is not the job; software engineering is changing code safely, requiring context that LLMs lack despite their human-like output. Claims that generating 30% of code against millions of existing lines leaves little wiggle room, and that complex systems have emergent failures that pattern matching can't fix. He advises documented standards, reproducible environments, easy testing, clear boundaries, and defined tasks—tools every engineer needs. Cites Jeff Atwood: 'The best code is no code at all.' Notes professional engineers are slowest to adopt AI, and suggests code review is the most important skill for an AI-assisted future.

Real World Development with GitHub Copilot and VS Code — Harald Kirschner, Christopher Harrison

Aug 3, 2025 · 1:19:33

Harald Kirschner demonstrates three stages of Vibe Coding with GitHub Copilot and VS Code—YOLO, Structured, and Spectrum—arguing that developers can move from rapid prototyping to maintainable, scalable AI-assisted development. He shows how to use Agent mode, auto-approve settings, and new workspace scaffolding to build a hydration tracking app with React Vite and Material Design without looking at code. The talk covers custom instructions, MCP servers (Playwright, Jest Pad, Perplexity), and custom modes like TDD that enforce test-driven development by writing failing tests first. Kirschner explains how to constrain tools for deterministic behavior using tool sets and recommends committing often, pausing AI when needed, and iterating on instructions. He also discusses spec-driven development, critiquing specs with AI, and the importance of well-structured codebases for AI productivity.

Ship Agents that Ship: A Hands-On Workshop - Kyle Penfound, Jeremy Adams, Dagger

Jul 27, 2025 · 1:21:00

Kyle Penfound and Jeremy Adams from Dagger demonstrated building production-minded AI agents using Dagger, a programmable delivery engine that runs containerized workflows identically on laptops and in CI. They created a workspace submodule with tools — read file, write file, list files, and run tests — and wired it to an LLM (Claude 3.5) so the agent can edit code and validate changes through the project's actual test suite. The agent runs in isolated containers for determinism and traceability, with behavior visualized via Dagger Cloud. They extended the agent to respond to GitHub issues: a label triggers GitHub Actions to run Dagger, read the issue, hand the assignment to the agent, and open a pull request. The talk emphasized that Dagger's modularity lets developers give agents precisely scoped tools while reusing existing CI workflows, providing guardrails without sacrificing flexibility.

Piloting agents in GitHub Copilot - Christopher Harrison, Microsoft

Jul 26, 2025 · 59:07

Christopher Harrison (Microsoft) demonstrates GitHub Copilot's agent capabilities for AI Engineers, arguing context is key to effective pair programming. He explains Copilot's modes—completion, chat, edit, local agent, and coding agent—and how Model Context Protocol (MCP) enables access to external tools like databases. Harrison shows how Copilot-instructions.md files provide project-specific guidance, and how coding agent runs within ephemeral GitHub Actions environments with strict security (no external access, only write to its own branch). He emphasizes that AI doesn't change DevOps fundamentals: tests still run locally and via PR workflows, and code review remains essential. The lab covers assigning issues to Copilot, configuring MCP servers, and using .instructions files for reusable patterns, with a repeat session at 3:30 PM.

Software Development Agents: What Works and What Doesn't - Robert Brennan, OpenHands

Jul 25, 2025 · 16:46

Robert Brennan, creator of the open-source coding agent OpenHands (formerly OpenDevin), argues that while coding is going away, software engineering remains about critical thinking, not typing. He explains that agents like OpenHands operate via a loop between an LLM and tools like a diff-based editor, terminal, and web browser, all sandboxed in Docker. Brennan advises starting small with rote tasks like merge conflicts (99% success) or PR feedback, being specific about frameworks and files, and always reviewing AI-generated code to avoid tech debt. He shares that 90% of his code now goes through the agent, with 10% requiring manual intervention, and warns against auto-merging without human accountability—OpenHands now assigns PRs to the human who triggered them. Key use cases include fixing failing tests, infrastructure changes, database migrations, and greenfield internal apps where vibecoding is acceptable.

Real world MCPs in GitHub Copilot Agent Mode — Jon Peck, Microsoft

Jul 19, 2025 · 14:27

Jon Peck from Microsoft demonstrates how Model Context Protocol (MCP) servers enable GitHub Copilot Agent Mode to solve real-world engineering problems beyond vibe-coding. He shows a README-driven workflow where Agent Mode builds a full app from a specification, then adds MCPs for database access and GitHub operations. Specifically, he configures a PostgreSQL MCP to pull live schema and data into mock JSON for testing, and the GitHub MCP to commit changes and create pull requests automatically. He emphasizes the read-only safety of the Postgres MCP and recommends using Copilot instructions to enforce practices like change logs. The episode covers how MCPs extend Copilot's capabilities to interact with data sources, testing tools, and DevOps pipelines securely.

Claude Code & the evolution of agentic coding — Boris Cherny, Anthropic

Jul 4, 2025 · 18:12

Boris Cherny, creator of Claude Code and Anthropic member of technical staff, argues that the product stays intentionally unopinionated and minimal because the model's coding capabilities are improving exponentially and the right UX remains unknown. He traces programming UX from 1950s punch cards to 1980s Smalltalk's live reload, Eclipse's static-analysis autocomplete, Copilot, and Devin's natural-language paradigm. Claude Code's terminal-first approach works in any terminal, over SSH, and inside VS Code or Cursor, with a GitHub integration that keeps data on user compute and a programmatic SDK for custom UIs. Key tips include using Claude for code-based Q&A (shortening onboarding from weeks to days), teaching it tools via `--help` and Claude MD files, leveraging TDD with visual iteration, and running multiple Claude instances in parallel via terminal tabs or GitHub Actions. Today's launch adds a plan mode triggered by Shift+Tab, which makes a plan and waits for approval before writing code.

Conquering Agent Chaos — Rick Blalock, Agentuity

Jul 1, 2025 · 14:40

Rick Blalock, founder of Agentuity, argues that deploying AI agents remains the number one headache for developers, citing common issues like serverless timeouts (agents running 15–30 minutes), statelessness, and networking complexities. He demonstrates Agentuity’s platform, which treats agents as first-class infrastructure citizens: users scaffold projects via a CLI (supporting Bun, Python/UV, Node.js), write a simple request handler, and deploy with automatic routing, tunneling, and a built-in AI gateway that tracks costs per run. The platform decouples inputs and outputs—agents can be triggered via email, SMS, webhooks, or cron—and provides human and agent-facing telemetry via OTel tracing. Blalock notes Agentuity already hosts 50–60 internal agents and is building infrastructure agents to replace tools like PagerDuty, with plans to add Slack/Discord integrations and service-level reasoning capabilities.

Agents, Access, and the Future of Machine Identity — Nick Nisi (WorkOS) + Lizzie Siegle (Cloudflare)

Jun 30, 2025 · 14:17

Lizzie Siegle (Cloudflare) and Nick Nisi (WorkOS) argue that AI agents need the same authentication and authorization patterns as humans, extending OAuth to machines. They demonstrate an MCP server built with Cloudflare Workers and WorkOS that allows Claude to order a shirt on behalf of a user, showing how agents can act with user credentials. They explain using Cloudflare durable objects for per-user persistent storage and how authorization can be added to MCP servers to control agent actions, including an example where a 'pretty please' tool bypasses a block. The talk emphasizes the need for fine-grained authorization and audit trails as agents scale to thousands of tasks.

Evals 101 — Doug Guthrie, Braintrust

Jun 27, 2025 · 48:31

Braintrust solutions engineer Doug Guthrie presents the full AI evaluation lifecycle, covering offline and online strategies for building robust AI products. He explains that evals require three ingredients—tasks (prompts or agentic workflows), datasets (real-world examples), and scores (LLM-as-a-judge or code-based)—and demonstrates how to run them in Braintrust's playground and via SDK. The talk emphasizes creating a feedback loop: production logs feed into datasets, enabling human review and user feedback to iteratively improve offline evals. Guthrie showcases a changelog app, the new AI-driven "loop" feature for prompt optimization, and answers audience questions on A/B testing models, handling multiple human scorers, pre-launch validation, and exporting data for custom dashboards.

[Full Workshop] Vibe Coding at Scale: Customizing AI Assistants for Enterprise Environments

Jun 27, 2025 · 1:20:38

Harold from the VS Code team demonstrates "Vibe Coding at Scale" at the AI Engineer World's Fair, presenting three stages—YOLO, structured, and spectrum vibes—for customizing AI assistants in enterprise environments. He live-codes a hydration tracking app using GitHub Copilot's agent mode, auto-approve, and new workspace scaffolding, then shows how to enforce design principles via Copilot instructions and reusable prompts. Harold introduces custom modes (e.g., TDD mode), tool sets, and MCP servers like Playwright and Perplexity for research and browser testing. He emphasizes iterating on instructions, committing often, and using spec-driven development to balance speed with reliability, arguing these techniques enable true flow-state collaboration even on complex codebases.

Unlocking AI Powered DevOps Within Your Organization — Jon Peck, GitHub

Jun 27, 2025 · 22:13

Jon Peck, a developer advocate at GitHub, explains how organizations can unlock AI-powered DevOps by integrating tools like GitHub Copilot into their workflows, achieving up to 1.5x feature throughput and 30% average improvement in successful builds. He emphasizes starting with brownfield (existing code) rather than greenfield, using agent mode for iterative planning and narrowed context, and codifying team best practices via copilot-instructions.md files. Peck also covers governance: safety, privacy, org-wide policies, and excluding sensitive files. Autonomous AI use cases include auto-generating PR descriptions, code review, and assigning issues to Copilot, always keeping a human in the loop with isolated branches. Finally, MCP servers allow agents to interact with GitHub and other systems, automating commits and PR creation.

The Agent Awakens: Collaborative Development with Copilot - Christopher Harrison, GitHub

Jun 27, 2025 · 1:04:06

GitHub Enterprise Advocates Christopher Harrison and John Peck demonstrate GitHub Copilot's Coding Agent at the AI Engineer World's Fair, arguing that context is the key to effective AI pair programming. They explain that coding agent works by assigning GitHub issues with detailed requirements, then running inside a secure, ephemeral GitHub Actions environment with no internet access and limited write permissions. Harrison emphasizes using `copilot-instructions.md` and `.instructions` files to guide code generation, and MCP servers to access external data or APIs. He stresses that AI does not change the DevOps flow—code still requires manual review, linters, security scans, and unit tests. The session covers agent mode, edit mode, and multi-file edits, along with practical Q&A on enterprise adoption, model transparency, and managing multiple coding agents.

Collaborating with Agents in your Software Dev Workflow - Jon Peck & Christopher Harrison, Microsoft

Jun 27, 2025 · 1:04:06

GitHub's Christopher Harrison and Jon Peck explain how to collaborate with Copilot Coding Agent as a peer programmer, emphasizing that context—through clear code, comments, instructions files, and MCP servers—is key to success. They walk through a lab where Copilot works on assigned issues in ephemeral GitHub Actions environments without internet or write access to the main repo, creating draft PRs that require human review. Harrison advises against being passive-aggressive, advocating specific prompts and instructions files to guide the agent. The episode covers MCP's role in providing external tools, the need for code review and security checks even with AI, and pricing: $39.99/month for Enterprise tier with coding agent. They also highlight .instructions files for reusable patterns and note that coding agent currently supports only tools, not resources.

The Many Ends of Programming - Ray Myers

Jun 10, 2025 · 27:12

Ray Myers, Chief Architect at All Hands AI, argues that the future of software engineering is not predetermined and we have a say, categorizing competing visions into six distinct endgames: extreme completion, dev apocalypse (innovator's paradise), abstraction leap, uncharted waters, review economy, and infinite pile of garbage. He illustrates extreme completion with a real example where an AI agent generated a 48-file pull request from a Slack message, and abstraction leap via domain-specific languages (DSLs) shown in the Parcel paper’s 61 prompts producing a 220-line Lisbon interpreter. Myers warns that dev apocalypse is desirable but not yet feasible, while the review economy is a pit stop where manual review bottlenecks must be managed using Theory of Constraints. He cites contradictory studies: UpLevel found developers with coding assistants had higher bug rates, while GitHub Copilot claimed improved quality; he notes 2024 was the first year copy-pasted code exceeded refactored code, a red flag for tech debt. Ultimately, Myers urges deliberate choices: whether we want no programmers or everyone to be a programmer, and whether we prioritize quality over quantity.

MCPs are Boring (or: Why we are losing the Sparkle of LLMs) - Manuel Odendahl

Jun 10, 2025 · 28:32

Manuel Odendahl argues that MCPs (Model Context Protocols) are boring because they constrain LLMs to rigid, predefined tool calls, while LLMs truly shine as code generators that can create dynamic tools on the fly. He critiques the inefficiency of tool calling—repeating context, wasting tokens, and struggling with many tools—and advocates for an 'Eval' approach where the LLM writes and executes code (e.g., SQL, JavaScript) to solve tasks directly. Demonstrating with a JavaScript sandbox, he shows how a single Eval tool can introspect databases, write queries, create REST APIs, and even build a full CRM interface in one call, saving time and tokens. Odendahl urges engineers to think recursively: ask the LLM to write code that writes more code, unlocking infinite loops of creation and restoring the sparkle of LLMs beyond boring function calls.

AI Engineering at Jane Street - John Crepezzi

Mar 28, 2025 · 16:57

John Crepezzi, an engineer on Jane Street's AI Assistants team, explains how they built custom LLM-powered coding assistants for OCaml, a functional language with scarce public training data. To overcome off-the-shelf tool limitations, they trained models on data from workspace snapshots — automated captures of developer workstations every 20 seconds, tracking build status changes from red to green. They used a Code Evaluation Service (CES) for reinforcement learning and evaluation, pre-warming builds to quickly test if model-generated diffs compile and pass tests. Their sidecar architecture, AID, serves thin editor integrations for Emacs (used by 67% of the firm), VS Code, and Neovim, allowing easy model swapping and A/B testing (e.g., sending 50% of users to different models). The talk details the end-to-end process: data collection from features, commits, and snapshots; training with supervised data and RL; and building pluggable infrastructure for domain-specific tools.

Your AI Agent Isn't an Engineer: The Art of Thoughtful Anthropomorphism

Feb 22, 2025 · 20:20

Rizel Scarlet, a staff developer advocate at Block, argues that marketing AI agents as "software engineers" creates unrealistic expectations and alienates developers. She explains that such anthropomorphism—attributing human traits to AI—stems from lazy marketing to executives, but it backfires by making developers feel threatened and discrediting products when AI fails to meet human-level performance. Citing a Wired article, she notes 52% of game companies have adopted generative AI, yet 30% of surveyed developers expressed negative sentiment. To build trust, she proposes a framework: understand how AI works (e.g., the agentic loop), use non-human names like "copilot" (pioneered by GitHub), focus on augmentation over replacement, be transparent, give developers control, show real demos (including live troubleshooting), provide clear documentation, and foster open collaboration (e.g., Cursor.Directory). The episode reframes AI as a tool to work in parallel, not a replacement.

GitHub Next Explorations: Rahul Pandita

Feb 8, 2025 · 18:18

Rahul Pandita, a researcher at GitHub Next, presents two explorations: Copilot Next Edit Suggestions and Copilot Workspace. Next Edit Suggestions extends GhostX by suggesting multi-location edits beyond the cursor, such as updating method definitions and documentation when a parameter is added. Copilot Workspace addresses developers' pain points of getting started on tasks, trusting AI output, and retaining control by offering a one-click proposal, built-in runtime verification, and an iterative, collaborative environment. Pandita demonstrates updating a MonoSpace website to add Rust syntax highlighting via a GitHub issue, showing specification generation, planning, and terminal command synthesis. He emphasizes that GitHub Next explores uncertain futures rapidly, learning from experiments like Copilot (which started as a Next project) to shape AI-augmented software engineering without waiting decades.

[Full Workshop from Microsoft] Github Copilot - The World's Most Widely Adopted AI Developer Tool

Feb 7, 2025 · 1:19:45

This workshop from the AI Engineer World's Fair features GitHub's Christina Warren, Dave, Alex, and Harald presenting GitHub Copilot, the world's most widely adopted AI developer tool. They demonstrate Copilot's three interaction modes: ghost-text completions using GPT-3.5 for speed, inline chat (also GPT-3.5) for quick code edits, and the chat panel powered by GPT-4 Turbo for deeper conversations. Speakers emphasize prompt crafting—being specific, providing examples, and keeping relevant files open—to improve results. They show how to use slash commands (/fix, /explain, /test) and the new attach button for explicit context. The workshop uses GitHub Codespaces preconfigured with Python 3.11 and Copilot extensions; a coupon provides a 7-day free trial. Harald explains the trade-off between model quality and latency, and notes upcoming features like automatic agent delegation and workspace integration for cross-file edits.

GitHub Copilot: The World's Most Widely Adopted AI Developer Tool

Feb 6, 2025 · 29:49

GitHub Senior DevOps Advocate Dave Bernason demonstrates how GitHub Copilot has evolved from an AI code generator to a comprehensive developer assistant with chat, enterprise knowledge bases, pull request summaries, and third-party extensions, emphasizing that Copilot keeps developers in flow and requires human oversight. He shows Copilot Chat explaining code, refactoring, debugging, and generating unit tests. Copilot Enterprise adds Bing search, knowledge bases from Markdown files, and repo indexing for accurate answers, exemplified by updating a hard-coded sales tax function to use the Avalara API. Copilot Extensions integrate third-party tools like Octopus Deploy for deployment dashboards within chat. Bernason also covers prompt engineering tips—specificity improves suggestions—and highlights Copilot's support for any language, even COBOL, for modernization.

The AI emperor has no DAUs why most devs still don't use code AI: Quinn Slack

Nov 20, 2024 · 18:45

Quinn Slack, CEO and cofounder of Sourcegraph, argues that despite massive hype, only about 5% of professional developers actually use Code AI tools, with total recurring revenue from Code AI sitting at roughly $300 million ARR—a fraction of Salesforce's $36 billion. He cites GitHub's 1.3 million paid Copilot subscribers and just 935,000 yearly active users receiving suggestions, revealing the gap between perception and reality. Slack warns that the entire AI ecosystem—foundation models, infra, and applications—risks collapse if usage doesn't grow, and most revenue in AI flows to NVIDIA and chip makers, not software. From building Cody, the number two Code AI product, he shares lessons: hype fools everyone, autocomplete is a freakishly good feature that spoils expectations, while chat and agents are harder to vet and adopt. He advises builders to use their own product daily, ignore customer demands for buzzwords like fine-tuning, and manually build explicit interactions before adding magic. Slack concludes that the industry must collectively dehype and focus on real daily active users to turn the potential into sustained enterprise revenue.

Moondream: how does a tiny vision model slap so hard? — Vikhyat Korrapati

Nov 14, 2024 · 19:26

Vikhyat Korrapati built Moondream, a tiny open-source vision language model under 2 billion parameters that matches LLaVA 1.5, a model four times its size, on VQA v2 and GQA benchmarks. He attributes this to focusing on image understanding over world knowledge and investing heavily in synthetic training data—a pipeline that generated 35 million images and used two orders of magnitude more compute on data than training. Key lessons: community engagement was critical, open-source builds trust, and safety guardrails should be application-layer, not baked in. He argues tiny models will dominate production due to cost and privacy advantages, and that prompting will replace custom model training for most vision tasks. Moondream raised a seed round from FullySysAscent and the GitHub Fund.

Productionizing GenAI Models – Lessons from the world's best AI teams: Lukas Biewald

Oct 23, 2024 · 22:36

Lukas Biewald, founder of Weights and Biases, shares lessons from productionizing GenAI models, emphasizing that while AI is easy to demo, it is hard to productionize. He illustrates this with a personal project building a custom Alexa-like device using LLaMA and Whisper, where accuracy improved from 0% to 98% through prompt engineering, switching to Mistral, and fine-tuning with QLoRA. Biewald argues that tracking experiments (including failures) is critical for reproducibility and collaboration, and that a robust evaluation framework—beyond 'testing by vibes'—is essential for iterating and shipping v2. He notes that 70% of the audience had LLM apps in production, yet many lack solid evaluations, and recommends starting with lightweight prototypes and incorporating end-user feedback.

Git push get an AI API: Ryan Fox-Tyler

Aug 23, 2024 · 45:01

Ryan Fox-Tyler and Matt Johnson Pint from Hypermode present a hands-on workshop demonstrating how to build and iteratively improve AI features using their platform, focusing on a GitHub issue triage app. They first illustrate the process with a multiplayer game (Hypercategories) that uses AI for classification and scoring. Then they build a trend summary function using OpenAI GPT-4 to summarize repository issues, and a classify issue function with a Hugging Face DistilBERT model for labeling issues as bug, feature, or question. Finally, they add natural language search for similar issues by creating an embeddings model (MiniLM) and a Hypermode collection, enabling vector search without external databases. The workshop emphasizes incremental iteration, mixing AI models with traditional code, and using Hypermode's automatic GraphQL generation and observability to speed development.

Running AI Application in Minutes w/ AI Templates: Gabriela de Queiroz, Pamela Fox, Harald Kirschner

Aug 14, 2024 · 1:29:02

In this workshop, Microsoft's Gabriela de Queiroz, Pamela Fox, and Harald Kirschner show how to deploy AI applications in minutes using AI templates, Azure OpenAI proxy, and GitHub Codespaces. They walk through deploying a simple chat app, then two RAG applications: one that queries a Postgres database with SQL filtering, and another that performs RAG on unstructured documents using Azure AI Search. Key decisions include using async frameworks like Quart and FastAPI, token-based chunking, and hybrid retrieval with semantic reranking for best results. They stress the importance of running evaluations with hundreds of samples and share production insights from Copilot Chat, where TFIDF sparse indexing and LLM reranking are used. The session includes free Azure credits and a proxy to bypass Azure OpenAI approval, allowing attendees to deploy everything without spending their own money.

Copilots Everywhere: Thomas Dohmke and Eugene Yan

Jul 26, 2024 · 18:22

GitHub CEO Thomas Dohmke shares the Copilot origin story from 2020 lockdown demos of GPT-3's Codex, its early 72 NPS despite hallucinations, and how it now writes half the code in enabled files. He details Copilot's expansion beyond IDE auto-completion to Chat and the new Copilot Workspace, which takes a GitHub issue and generates a plan and code changes, keeping humans in the loop. Dohmke argues Workspace helps non-developers like product managers see implementation details and size tasks. He defines an agent as an 'AI dishwasher' that autonomously handles drudge work like security backlogs, and urges developers to embrace AI tools to bring fun back into software development.

From Software Developer to AI Engineer: Antje Barth

Jul 24, 2024 · 19:48

Antje Barth, a Principal Developer Advocate for generative AI at AWS, outlines five practical steps from software developer to AI engineer: understanding foundation models, getting hands-on with AI developer tools like Amazon Q Developer, prototyping with models via Amazon Bedrock, integrating agents, and staying up to date with community events. She demonstrates Amazon Q Developer's ability to generate, explain, and transform code, reducing unvaluable tasks from 70% to focus on creative work. Barth introduces Amazon Bedrock's unified Converse API for standardized model invocation across providers like Anthropic's Claude 3.5 Sonnet, and shows how agents can be built to control a Minecraft bot through reasoning and tool use. The episode concludes with the announcement of the AI Engineering Hub at the AWS loft in San Francisco for community workshops and events.

Building Reactive AI Apps: Matt Welsh

Nov 9, 2023 · 17:02

Matt Welsh announces AI.JSX, an open-source TypeScript framework he describes as 'React for LLMs,' which lets developers build reactive AI applications by composing JSX components that render to an LLM rather than the DOM. He argues AI.JSX makes LLM app development accessible to JavaScript developers, not just Python back-end engineers, by handling RAG, tool invocation, and real-time voice interaction out of the box. Welsh demonstrates parallel streaming of multiple LLM calls for story generation, a kid-safe wrapper component that rewrites content, and a 10-line RAG implementation. He showcases a live voice demo where an AI takes a donut order with sub-second latency, powered by Fixie's cloud platform for hosting, managed RAG pipelines, and conversational state. He emphasizes the framework's full React integration and ability to generate UI from AI, positioning AI.JSX as a simplification for building sophisticated LLM-powered apps.

The AI Evolution: Mario Rodriguez, GitHub

Nov 7, 2023 · 19:32

Mario Rodriguez, VP of Product at GitHub, recounts the history and future of GitHub Copilot, the first at-scale AI programmer. Copilot now serves over 20,000 organizations and 1 million-plus developers, generating over $100M in ARR, with 46% of code written via completions. He shares insider lessons: ghost text, low latency under 100 milliseconds, and prompt engineering were key to success. He warns that 'syntax is not software' and that global presence and offline/online scorecards are essential at scale. Looking ahead, Rodriguez envisions moving from procedures to goals and constraints, enabling AI to reason on code, and designing immersive UIs for human-AI collaboration. He concludes that GitHub has evolved from a version control system into an end-to-end platform infused with AI.

The AI Pivot: With Chris White of Prefect & Bryan Bischof of Hex

Nov 7, 2023 · 35:16

Chris White (CTO of Prefect) and Bryan Bischof (Head of AI at Hex) detail how their non-AI startups successfully pivoted to integrate AI, arguing that ruthless prioritization and deep product integration are key. White explains Prefect built the open-source Marvin project to learn from LLM experimenters, while adding AI features like error summaries to its core orchestration product, but had to restrain over-enthusiasm from engineers. Bischof describes Hex's Magic feature as an augmentation, not a separate product, and explains they built their own evaluation system but chose not to build a vector database, and killed a promising feature called Crystal Ball to avoid splitting the product experience. They both emphasize machine-to-machine interfaces and typed outputs, and caution that the work is often tedious data engineering. Their hot takes: White says stop building chat interfaces, AI is a tool; Bischof warns that the journey is boring but worth it.