The TLM Forge Blog
TLM Blog
Field notes on agentic coding, AI code review, model performance, and shipping production-ready software with Claude Code.
Featured · Security
91 Spring CVEs in One Day: The AI Vuln Firehose
On Aug 20, 2026 Broadcom shipped 91 Spring CVEs affecting 209,569 components. AI now finds vulnerabilities faster than teams can remediate them.
Security
The New OWASP Top 10 for AI Agent Skills
The OWASP Agentic Skills Top 10 v1.0 landed Aug 17, 2026. What the ten SKILL.md risks mean for your Claude Code and Cursor…
Security
How to Vet MCP Servers Before You Trust Them
An MCP registry listing proves ownership, not safety. How to vet an MCP server as a supply-chain decision before you connect it.
Engineering
When AI-Written Code Breaks in Production
AI code is slow to debug in production not because it fails more, but because nobody kept the intent. Fix it with provenance at…
Security
The AI Worm That Spreads Through Agent Memory Files
An Anthropic and EPFL paper shows self-replicating prompts spread agent-to-agent through editable memory files like SOUL.md and…
Agentic Coding
How AI Agents Keep State Across Sessions
A fresh session forgets everything and re-explores. Bigger context windows do not fix this. Externalize a session-end handoff…
Security
54 of 55 CVEs Were AI-Invented. One Scored a 10.0
JFrog found 54 of 55 CVEs from one GitHub account were AI-fabricated. One hit a 10.0. The pipeline never asked for a working…
Engineering
Clean Git History When an Agent Writes the Code
Agents default to one 500-line commit, which breaks git bisect, blame, and clean reverts. The discipline: atomic commits split…
Engineering
Build an Eval Harness for Your Coding Agent
Coding agents regress silently when you swap a prompt, tool, or model. Build a private, tiered eval harness from your own PRs to…
Code Review
GitHub Code Quality: A Merge Gate for AI Code
GitHub Code Quality hit GA: CodeQL, AI detection, and Copilot Autofix as a pre-merge gate. What a single scanner covers, and…
Code Review
Stop Your AI Agent Writing 1,000-Line PRs
Coding agents emit 1,000-line PRs reviewers rubber-stamp. Fix diff size at generation, not review: specs, stacked PRs, and…
Security
Shipping AI Code in a Regulated Codebase
In SOC 2, HIPAA, and GDPR environments, AI-written code must satisfy audit and accountability, not just pass tests. Capture…
Agentic Coding
Running Parallel AI Agents Without Merge Conflicts
Git worktrees isolate each agent's files, not the shared runtime, and conflicts move to merge time. How to run parallel coding…
Engineering
Onboarding Junior Engineers in the AI Era
The job flipped: a junior's first skill is now evaluating code they did not write, including the AI's. A practical onboarding…
Agentic Coding
Why Your CLAUDE.md Gets Ignored
CLAUDE.md gets ignored because instruction-following decays as rule count rises and prose has no enforcement. What to keep, cut,…
Engineering
Your AI Docs Describe Code That Changed
AI-written docs drift the moment code moves, and confident inaccuracy is worse than none. Generate from real signatures and test…
Spec-Driven Dev
Your AI Agent Passed the Tests by Luck
A study of 2,614 AI agent runs found 10.7 percent of the passing runs went green by luck. Why green is a weak merge gate, and…
Engineering
AI's Code Review Bill Lands on Senior Engineers
After Copilot arrived, core developers reviewed 6.5 percent more code and shipped 19 percent less of their own. Where that cost…
Engineering
Your AI Coding Policy Template Enforces Nothing
Oracle banned AI code in OpenJDK, then allowed it in GraalVM two weeks later. A rule with no mechanism and no owner is not a…
Code Review
Copilot Was on the PR. Wiz's Agent Walked Out With a Token
Copilot was on the PR. GitHub's scanners missed the flaw. Wiz's agent exploited it and reached a live token. What review…
Agentic Coding
How to Do Agentic Coding Without Shipping Slop
Agentic coding lets an AI plan, edit, and run code across many files on its own. Here is a repeatable workflow that keeps the…
AI Coding
Seven Common Mistakes Teams Make With AI Coding Tools
AI coding tools fail in predictable ways: skipped tests, unread diffs, hallucinated APIs, and lost context. Here are the seven…
Code Review
Why Multi-Agent Code Review Beats a Single Reviewer
A single reviewer, human or AI, misses defects a different lens catches. Why splitting review across correctness, security, and…
AI Council
What Is an LLM Review Council, and Why You Need One
An LLM review council uses several independent AI reviewers, including one adversarial red-team voice, to check a plan and its…
Model Performance
How to Judge Model Performance for Coding Tasks
Benchmark leaderboards measure narrow, synthetic problems. Here is what actually predicts coding usefulness, and why a review…
Spec-Driven Dev
Spec-Driven Development, Explained
Spec-driven development means writing inputs, edge cases, and a definition of done before any code exists, because a spec is…
Code Review
An AI Code Review Checklist That Actually Catches Bugs
A concrete checklist for reviewing AI-generated code: spec match, tests that check behavior, hallucinated APIs, error handling,…
Agentic Coding
Context Management for AI Coding
A large context window is not memory. Here is what belongs in context for one task, what belongs in persistent memory instead,…
Security
Prompt Injection in AI-Generated Code
Untrusted issues, docs, and tool output can steer an AI coding assistant off course, and its generated code can repeat the same…
Model Performance
How to Choose a Model for AI Coding
A practical framework for choosing an AI coding model per task: weigh capability, cost, latency, context needs, and tool-use…
Agentic Coding
A Claude Code Workflow That Actually Ships
A repeatable workflow for shipping Claude Code features: audit the spec, review the plan, build test-first, then clear a…
Security
How to Run a Security Review of AI-Written Code
A practical checklist for reviewing AI-generated code before it ships: injection, broken access control, hardcoded secrets, and…
Engineering
How to Refactor With AI Without Breaking Things
A practical guide to refactoring with an AI assistant: pin behavior with tests first, take small reversible steps, keep scope…
AI Coding
When Not to Use AI Coding Tools
AI coding assistants are powerful when you can specify the goal and verify the result. Here is where they are a poor fit, and…
AI Coding
Four Myths About AI Coding Productivity
Four common claims about AI coding speed do not hold up: universal speedups, optional review, code volume as progress, and tests…
Engineering
Guardrails for AI-Generated Code
How deterministic checks, enforced tests, independent review, scope limits, and a CI gate catch an AI coding agent's mistakes…
Security
Red-Teaming Your AI-Generated Code
What it means to red-team AI-generated code: a distinct adversarial review, framed as a malicious user with full source access,…
Spec-Driven Dev
The Convergence Gate: Ship Only When Critical Issues Hit Zero
A convergence gate loops review and fix until critical and high-severity findings hit zero, turning the ship decision into…
Engineering
How to Ship Production-Ready AI Code
A concrete checklist for AI-generated code: spec match, real tests, error handling, independent review, a red-team pass,…
Agentic Coding
Agentic Coding vs Vibe Coding
Vibe coding and agentic coding are not the same practice. One suits a throwaway prototype; the other is what production code…
Spec-Driven Dev
How to Write a Spec an AI Coding Agent Can Follow
A practical guide to writing specs AI coding agents can execute: goal, inputs and outputs, constraints, edge cases, explicit…
AI Coding
Why AI Invents APIs That Do Not Exist, and How to Catch It
LLMs invent function signatures, config keys, and package names that look real. Why it happens, why hallucinated packages are a…
Code Review
Code Review at AI Speed
AI generates code faster than teams can review it. How smaller diffs, machine pre-review, and risk-based triage keep review…
Engineering
How to Test AI-Generated Code Properly
AI-generated tests often pass without verifying anything. How to spot tautological assertions and mock-heavy tests, and use…
AI Coding
Rolling Out AI Coding Tools Across a Team Without Chaos
A framework for rolling out AI coding tools across a team: shared conventions, one review gate, CI guardrails, and metrics that…
Model Performance
How to Actually Measure the ROI of AI Coding Tools
Lines of code and acceptance rate do not measure AI coding ROI. Here is what to track instead: rework rate, cycle time, and…
Security
Secure Defaults: Making AI Write Safe Code by Design
AI coding assistants default to insecure patterns because training data mixes safe and unsafe code. How to flip the default…
Agentic Coding
AI Pair Programming: What Works and What Backfires
AI pairing speeds up exploring options, boilerplate, and unfamiliar APIs, but automation bias, anchoring, and quiet skill…
Engineering
How to Debug With AI Without Chasing Ghosts
A protocol for debugging with AI: demand a stack trace and a failing test instead of a guess, force a falsifiable hypothesis,…
Engineering
AI Coding and Technical Debt: Faster Is Not Free
AI coding tools multiply output, but churn, duplication, and inconsistent conventions compound just as fast. Here is what keeps…
Engineering
Why TDD Enforcement Matters When AI Writes Your Code
AI code generators skip tests by default. TLM enforces test-driven development so every feature ships with coverage from day…