4 posts
A follow-up. The under-specification problem in coding agents does not close by writing better specs upfront. Models do not stick to instructions anyway. The gap closes by building better detection: catching deviation cheaply, often, and at the right level of abstraction. The lever is the loop, not the prompt.
Coding agents write impressive first drafts. But under the surface, corners are cut, details are missing, and technical debt accumulates with every change. The problem is not the model. It is that what we ask it to do is fundamentally under-specified.
Agent frameworks hide the loop behind agent.run() and a graph DSL. But the loop is where every interesting decision happens: what the model sees, whether a tool call proceeds, when to stop, what to record. What if you owned the loop and the framework just made it composable?
Offense asks 'does a bug exist?' Defense asks 'are all bugs gone?' One is an existential claim you can check with a single example. The other is a universal claim nobody can check. This asymmetry, not model capability, is what determines where AI agents work in security.
