CodeIsGo.com

Google’s Android Dev Summit announcements signal a shift toward agent-assisted mobile development. For engineering leaders, the real question is not whether to adopt agentic tooling but how to govern it while teams retain ownership of code, testing, and risk. By Nacho Carrión.

The decision Google’s latest Android tooling forces on engineering teams is not whether to let AI agents write code, but how to keep developers accountable for what those agents produce. At Android Dev Summit, Google framed the shift as moving from building features quickly to owning, reviewing, and testing agent output. That reframing is the crux for leaders: velocity is no longer the bottleneck, trust is.

The concrete changes are substantial. Android Studio now lets teams choose preferred coding agents, including Claude, Codex, and Antigravity, while keeping them inside the IDE rather than forcing a switch to CLIs. Android CLI extends agent access to emulators, remote device testing via Firebase, and profiling. New Android SKILLS guide agents through modern practices like XML-to-Compose migrations and AGP upgrades, aiming to raise code quality. On the product side, AppFunctions and the A2UI Compose library let apps expose functionality and render native interfaces for agents, while Journeys introduce natural-language, non-deterministic testing.

Near-term, these tools reduce friction and can accelerate delivery. Longer-term, Touchlab suggests AI-driven tests could eventually replace Espresso and UI Automator, and that agentic exposure could reshape how apps interact with users. But the governance tension is real: teams must still review generated code, adapt test suites to non-deterministic behavior, and manage dependencies on Google’s platform direction.

For leaders, the threshold is clear. Before adopting agentic workflows, decide how you will verify agent output, who owns quality, and how much you lean on Google’s evolving APIs versus portable approaches.

Deloitte’s 2026 State of AI in the Enterprise report charts rising AI spend against modest revenue returns, but its central insight is the persistent gap between experimentation and production deployment. By Jim Rowan and Peter Sonner.

Deloitte’s 2026 State of AI in the Enterprise report, authored by Jim Rowan, Nitin Mittal, Beena Ammanath and Costi Perricos, rests on a single strong claim: enterprise AI investment is rising sharply, yet financial returns remain limited because most organizations have not made the operational changes required to convert spending into revenue. The evidence is concrete. Among 3,235 business and technology leaders surveyed across 24 countries and six industries, 84% are increasing AI budgets, yet only 25% have moved at least 40% of their experiments into production, and just 20% report revenue growth from the technology, against 74% that expected it to expand revenue.

The main points in this report:

• Deloitte’s report argues rising AI investment has not matched the operational changes needed for revenue returns.
• Only 25% of organizations have deployed 40% or more of AI experiments into production.
• Just 20% report revenue growth from AI despite 74% expecting revenue expansion.
• Agentic AI plans outpace governance maturity by a wide margin.
• Most job redesign and business-model transformation remain unfinished.
• The report is a credible baseline but should be read with caution on forward-looking claims.

The report’s reasoning is sound. It separates three stages of adoption—experimentation, integration into existing processes, and transformation of products or business models—and shows that only 34% of organizations are pursuing substantial change. The strongest results cluster around efficiency and productivity, achieved by 66% of respondents, and decision-making, achieved by 53%. This is a measured, defensible picture rather than a hype narrative.

Yet the analysis has limits. The gap between planned agentic AI deployment (74%) and mature governance (21%) is striking, but the report itself notes these measures assess different aspects of readiness, so the 53-percentage-point spread is more suggestive than conclusive. Similarly, the survey captures intentions and self-reported maturity rather than verified outcomes. The mining example illustrates product transformation, but it is anecdotal.

The report is most valuable to executives weighing continued AI investment and to engineers responsible for production deployment. Readers should treat the forward-looking deployment expectations with caution, since planned acceleration does not establish that deployments occurred. Overall, it is a credible, well-sourced baseline for understanding where enterprise AI actually stands. Interesting read!

Organizations are deploying AI agents faster than they can demonstrate value, and the gap between adoption and measurable return stems from a disconnect between buyers and users plus a lack of business context. By Databricks Staff.

The framing of productivity is shifting. Historically it meant how much work a single person could accomplish alone. In an agentic world, it now means how much a person can accomplish with a team of AI assistants working alongside them, without sacrificing quality. That reframing matters to operators because it moves the metric from individual throughput to augmented capability, which is harder to measure and easier to overstate.

The AI ROI gap exists because the people buying AI and the people using it are often different. Buyers evaluate on headline promises and deployment speed; users judge on whether the agent actually improves their workflow. Most organizations remain in a trial-and-error phase, still figuring out which use cases actually work. Until a use case is proven in the hands of the user, any reported productivity gain is speculative.

Speed is the wrong way to measure AI productivity. An agent that responds quickly but produces generic output adds little. The agents that create real value carry business context: your data, your history, your constraints. Without it, an agent can only offer generic advice, not decisions your company can act on. Integration cost is the hidden variable operators face, because building that context requires wiring agents into existing systems, governance, and data pipelines.

The advice to prioritize context does not transfer everywhere. Teams with clean, well-governed data may see faster wins than those burdened by legacy systems. Where the source’s guidance may not hold is when context is unavailable or when quality cannot be verified, because the productivity promise collapses.

Consider whether you have a proven use case with user feedback before scaling. If you lack business context, expect generic output and defer. Test in a bounded workflow where you can measure quality, not just speed. Good read!

An OpenAI model uncovered two critical PHP flaws, triggering a global update race that revealed how fragile and under resourced the internet’s foundational software has become. By Omar Gallaga.

Last week, software engineers worldwide scrambled to patch their websites’ backends after a team using an OpenAI model discovered two major vulnerabilities in PHP, the open-source scripting language that underpins as many as 70% of websites globally. Shortly after alerts issued, new PHP versions shipped and site operators were urged to update. Some government websites went dark in Europe during the rollout, but for much of the web, applying the fixes was left to individual owners.

The deeper story emerged from the PHP Foundation itself. Reuters reported the nonprofit, formed in 2021 to coordinate researchers and cybersecurity firms against crises like this, runs with just one full-time staff member. Executive Director Elizabeth Barron said she works with about 14 part-time contractors and unpaid board members, noting that AI-generated threats have doubled the demand to change PHP code while contributor numbers have not. “It is clear PHP is severely underfunded,” she said.

Awareness gaps compound the problem. A Network Solutions survey of 121 small business owners found 45% had never heard of PHP and 71% didn’t know if their sites used it. Principal systems architect Rick Radinger said owners often assume hosting providers will handle fixes.

Infrastructure companies moved anyway. Cloudflare deployed new web application firewall protections and launched a PHP Capture the Flag contest on HackerOne with cash prizes from $100 to $10,000, while GoDaddy updated managed hosting without requiring owner action.

For users, the vulnerability cannot be fixed by changing passwords or browsers—it lives on the site’s server. As PHP approaches its fourth decade, this scramble suggests many aging tools, from JavaScript to SQL databases, will keep surfacing vulnerabilities unless the web’s neglected maintenance infrastructure is addressed. Nice one!

A new report from Open Markets Institute and Americans for Financial Reform Education Fund argues that the AI boom is being sustained by circular financing, opaque private fund investments, and accounting tricks, and that a sharp correction could trigger a recession or a 2008-scale financial crisis. The report, “Brace for Impact: Protecting People and the Economy when the AI Bubble Bursts,” examines how a handful of tech companies and their financial backers are fueling the bubble, and it calls for transparency, closing regulatory loopholes, stronger supervision of AI financiers, and a commitment not to bail out AI firms or their financial backers.

The report highlights:

• A new report warns that AI’s trillion-dollar spending boom is propped up by circular financing, opaque debt, and accounting gimmicks.
• Warning signs are already emerging: OpenAI revenue miss, Firmus Technologies IPO cancellation, and strategist warnings of a 2027-2028 burst.
• Fitch Ratings and the IMF have flagged AI-driven market corrections as recession and financial stability risks.
• The report names Alphabet, Amazon, Anthropic, Meta, Microsoft, OpenAI, Oracle, and SpaceX as drivers of the spending spree.
• Policy recommendations include transparency, closing regulatory loopholes, stronger supervision, and no bailouts for AI firms or backers.
• The report argues that an AI crash could threaten workers’ jobs, retirement savings, and communities beyond Silicon Valley and Wall Street.

The warning signs are already visible. OpenAI’s annualized revenue was reported to be a full $20 billion below a figure widely reported just weeks earlier. NVIDIA- and Blackstone-backed Firmus Technologies abandoned a planned IPO in Australia after investors balked at its valuation and business prospects. Panmure Liberum’s top strategist warned the AI bubble could burst in 2027 or 2028, potentially triggering a severe stock-market downturn. Fitch Ratings warned that any sharp correction of AI stocks could plunge the U.S. into a recession, and the IMF named an AI-driven market correction as a salient stability risk.

In addition, the report lays out steps that policymakers at every level of government can take to limit potential harms before and after a crash, including demanding financial transparency across the entire Al ecosystem, closing statutory and regulatory loopholes that enable deceptive accounting practices, strengthening regulation and supervision of AI financiers, and refusing to bail out AI firms or financial backers. Excellent read!

The EU Cyber Resilience Act forces a fundamental shift in software architecture, demanding that security boundaries extend beyond the application to encompass the entire supply chain and non-human identities. By Ryan Daws.

The EU Cyber Resilience Act (CRA) fundamentally alters the architectural assumptions of software development by imposing strict supply chain oversight and 24-hour incident reporting mandates. For architects, this regulation shifts the compliance perimeter from the final product to the entire lifecycle, requiring secure-by-design engineering that accounts for maintenance and patching up to five years post-launch. This creates a significant tension for developers building components out of context, where the final deployment environment is unknown during initial development. The requirement for a clear Software Bill of Materials (SBOM) forces teams to maintain active patching regimes and prove secure design for individual libraries, challenging traditional siloed development practices.

A critical architectural failure mode emerges when organizations lack immediate visibility into external dependencies. With the average software supply chain containing over 180 external components, the 24-hour reporting window for actively exploited vulnerabilities is nearly impossible to meet if dependency maps must be reconstructed manually during an incident. This highlights a trade-off between rapid feature development and the rigorous documentation needed for regulatory compliance. Furthermore, the scope of governance now extends to autonomous AI agents and machine identities, which operate across production pipelines with broad permissions. Securing these non-human identities requires comprehensive oversight, as ignorance of their presence is no longer a valid defense under the Act.

The regulation also exposes a conflict between regulatory disclosure and operational recovery. Tight reporting deadlines risk diverting resources from incident remediation to bureaucratic disclosures if governance lines are ambiguous. Teams must establish clear roles for reporting ownership to ensure that satisfying the regulatory clock does not compromise business restoration. Before adopting CRA-compliant architectures, teams must resolve how to maintain real-time dependency visibility and define authority for non-human identity governance. Excellent read!

As software supply chain security shifts from a best practice to a regulatory baseline, engineering leaders must decide how to integrate Software Bill of Materials (SBOM) into their automated delivery pipelines. By GitHub.

Engineering leaders face a growing mandate to secure the ‘hidden’ dependencies that comprise the majority of modern applications. The decision is no longer just about whether to track open-source libraries, but how to operationalize that tracking without slowing down development velocity. Implementing a Software Bill of Materials (SBOM) creates a structured inventory of every component, version, and license in a codebase, providing the visibility necessary to respond to vulnerabilities like those seen in the SolarWinds incident.

This blog post deals with:

• SBOMs provide visibility into hidden transitive dependencies.
• Automation in CI/CD is essential to prevent data staleness.
• Standardization (SPDX/CycloneDX) is key for interoperability.
• Regulatory pressure is driving SBOM adoption into a baseline requirement.
• Shift-left security reduces reactive patching costs.

From a strategic standpoint, SBOMs shift the burden of security from reactive patching to proactive governance. By integrating tools like Syft or Trivy into CI/CD pipelines, organizations can automate component discovery and metadata collection. This allows teams to block risky components before they reach production, effectively shifting security left. However, this creates a new dependency on tooling and standardization; choosing between formats like SPDX or CycloneDX is a critical decision that affects interoperability with third-party scanners and regulatory bodies.

In the near term, the primary challenge is the ‘manual’ overhead of validation and ensuring that SBOMs remain accurate as code changes. Long-term, the goal is a fully automated lifecycle where SBOMs trigger alerts and update security baselines automatically. For leadership, the investment involves balancing the initial friction of pipeline integration against the reduced risk of supply chain breaches and the ability to meet federal and industry-specific compliance requirements.

At what point does your current dependency tracking become a liability, and what is the threshold for automating your first high-risk product’s SBOM? Good read!

Data platforms treat infrastructure and derived decisions as separate worlds. A unified dependency graph joins them so agentic systems can trace outputs back to raw inputs without losing the thread across transformations. By Animesh Kumar.

The article outlines these ideas:

• Infrastructure and derived outputs are structurally distinct and must be treated as such.
• Agentic AI compounds hidden failure modes by chaining outputs into inputs across systems.
• Existing lineage and governance tools are disconnected point solutions; they need a unified dependency graph.
• Every AI output needs an automatic, machine-readable pointer to exact inputs and model version.
• An untraceable output is acted on as fully real despite being structurally unverified.
• Adopt a unified graph if outputs drive automated actions and silent drift is unacceptable; defer if lineage is a single-person memory; investigate by tracing one model to raw inputs first.

A platform’s task extends beyond storing data or even enabling AI: it is to hold the full chain, from infrastructure to insight, inside one structure that can be traversed and audited, so nothing an AI system does rests on a foundation nobody can see. Every AI output should carry an automatic, machine-readable pointer to its exact inputs and model version. An output that cannot be traced back to what it depends on has no settled place in the system that produced it. Interesting read!

A pre-registered study of 1,920 controlled trials found that coding assistants checked provenance before installing software in just 9 cases, or 0.5%, and never once ran a verification command. The September 2026 research tested whether assistants would use supply-chain signals such as SBOMs, signed releases, build provenance, and official channels when selecting dependencies. The finding points to a shift in how software enters applications: AI agents can now identify dependencies, modify manifests, invoke package managers, and resolve conflicts as part of completing a development task, moving much of the selection process inside an automated workflow. By Cybersecurity Insiders.

Consider a developer asking an agent to connect a Python service to an external API. The agent may add the requests package, which currently has four runtime dependencies — certifi, charset-normalizer, idna, and urllib3. The resulting dependency graph can include five separately maintained packages, each with its own release history and security properties. The organization may prefer a different implementation due to provenance, maintenance history, licensing, or internal security policies, but those considerations are unlikely to be captured in a prompt such as “connect this service to an API.”

Software selection becomes harder to control when an agent handles much of the implementation. A developer may specify what the software needs to do, then rely on the agent and package manager to choose dependencies. The final graph may reflect what the model or ecosystem favors without accounting for every organizational requirement. Good read!

Across Europe, public administrations have standardized on PHP applications for digital infrastructure. From Germany’s €108 million Government Site Builder to Drupal-powered EU platforms, PHP underpins government services. This article examines the architectural trade-offs, maintenance dependencies, and procurement shifts that make PHP the de facto standard for digital sovereignty. By Sebastian Bergmann.

Germany is spending €108 million to move its federal websites onto a PHP application. The budget funds the eleventh version of the Government Site Builder: €26.88 million for product development and support, €73.2 million for migration and relaunch, and €8 million for operations over four years. More than 80 federal agencies have built over 250 websites with it.

The decision reflects a broader European pattern. The European Commission operates 770 live sites across 44 services on a shared Drupal platform, handling 700 million annual visits. The EU Aviation Safety Agency runs its Sustainability Portal on Drupal, serving 350 airlines and 31 national authorities. In the Netherlands, DICTU’s GovNL CMS reduces government website deployment from three months to ten minutes using Drupal Recipes and automated infrastructure. France monitors a Drupal base theme for its state design system. The UK and Ireland’s LocalGov Drupal has over 58 councils sharing a codebase, reporting 50 to 80 percent savings versus building from scratch. Australia’s GovCMS hosts 370 websites for 115 agencies with OFFICIAL:Sensitive classification. Interesting read!