3 Things Worth Reading #004
Self-Taught Engineer my weekly reading problem
This week three articles survived my yellow highlights in my readwise account. The first is anybody reading the outputs of most coding agents anymore? the second says the agents have moved on from writing code to running the whole computer and beyond, and the third explains why you can’t secure any of it very well by design.
1. Nobody’s reading the code.
Joe Reis
The more I use these systems the harder it’s been to wrestle with reading, and the piece I couldn’t finish in one sitting is called *The Post-Literate Engineer*. Point taken, Joe.
His argument: generating stuff got cheap, judgment stayed scarce. Producing an artifact has come apart from being able to read it, explain it, or say whether it’s any good. I saw him give the Great Pacific Garbage Patch of AI Slopware talk at Big Data London last year. This is that argument with another year of evidence behind it.
He’s careful to say this isn’t an anti-AI piece, and I’ll say the same. AI is real leverage for a strong engineer the way power tools are real leverage for a skilled carpenter. I have three or four coding agents running right now. Under 10% of one of my codebases was written by my own hands and I don’t see this changing.
Why this matters: the argument I keep hearing is that nobody needs to learn to code because AI writes it. That’s like saying nobody needs math because calculators exist. If you are not doing the thinking, who is? Come on folks.
2. The agents stopped writing code and started using the computer
How do “computer use” agents work?
Technically
Technically explains hard technical things to people who aren’t engineers, which is exactly why it’s good at this one.
A computer use agent doesn’t hand you a diff. It drives the machine like filesystem, terminal, browser, apps etc… through the same interfaces you’d use. It clicks, types, fills forms, and spins up sub-agents to work in parallel across repos. We think we multitask. These things actually do.
A few things I found interesting, On the WebVoyager browsing benchmark, an agent reading only the accessibility tree scored 40.1%. The same agent with vision scored 59.1%.
Why this matters: the design decision is the action space. Too narrow and the agent can’t finish the job. Too broad and you can’t audit what it did. There’s no clean middle you’re trading capability for legibility, every time.
And here’s the part that connects to #1: if your team already produces more than it can read, the action space is wider than anyone is auditing whether you designed it that way or not. Mine does. Most days, even with AI helping us read.
On credentials, the piece is pretty blunt that auth is still a mess agents need scoped tokens, not your username and password. I currently run scoped tokens, minimum access per task, 1Password cli so the system has to come ask me and I a fairly solid management method in place, WorkOS in my own applications. That’s not a solution. It’s just what hasn’t burned me yet.
---
3. Prompt injection is SQL injection before we invented parameters
LLM Security Basics: The Full Threat Model *paid
ByteByteGo
I sent people to ByteByteGo two issues ago for distributed systems fundamentals. Same reason again.
They map the whole LLM attack surface and then do the thing almost nobody does trace it back to one root property. The model receives your instructions and the untrusted data in a single undifferentiated token stream.
Parameterization solved SQL injection by separating code from data at the database boundary. No equivalent exists for natural language, because instructions and information are both expressed as words, and there is currently no reliable method to mark a span of text as inert and have that marking respected during generation.
The anchor case is EchoLeak, the zero-click exfiltration in M365 Copilot (CVE-2025-32711). Nobody clicked anything. The instruction arrived inside content the model was asked to read.
Why this matters: I spent many years learning to never concatenate a user string into a query, and yet we shipped an entire generation of tooling that does the moral equivalent by design. Now go back and reread #2. An agent with a browser, a shell, and my scoped tokens is reading untrusted content all day every day.
The thread I see:
I left C, but greatest book on C programming by Brian W. Kernighan and Dennis M. Ritchie was still sitting there when I needed to look. That’s the whole reason “understanding moves up a layer” has been a safe trade many times running the layer underneath stayed readable even when I stopped reading it.
The pile of generated artifacts is growing faster than any of us can review it. This isn’t a new layer. It’s a tsunami of information.
I don’t know what comes after. I’d like to say WALL-E. It’s looking more like Idiocracy, which is quickly turning into a documentary, and Joe Reis and I seem to agree on this point.
If you’ve been running agents for more than a couple of months are you actually reading what they produce? All of it? Or are you shipping on top of it?
What did you read this week that survived the filter? Hit reply, I read everything.
I also write/podcast about raising four kids with my neuroscientist wife over at Little Big Humans