A peer-reviewed study found regex tied an LLM on accuracy for structured extraction while running 28,000× faster. The case for AI as seasoning, not flour: route the predictable 90% to deterministic code, escalate only the fuzzy long tail to a model. A decision rule, real numbers, and the honest counterpoint (don't parse HTML with regex).
Chroma tested 18 models: accuracy falls well before the advertised limit, and semantically-similar distractors hurt more than the raw token count — models even did better on a shuffled haystack than a coherent one. Plus RULER's 'effective context' and Lost-in-the-Middle. Why curated retrieval still beats stuffing everything in the window.
A July 2026 Concordia benchmark (IssueTrojanBench) found 66.5% of malicious instructions hidden in GitHub issues bypassed every guardrail in Cursor, Claude Code and Codex — and nearly every block came from the base LLM refusing, not the agent's own safety layer. What that means if you point an agent at anything you didn't write.
Wiz disclosed a symlink flaw (July 8) letting a malicious repo trick six AI coding assistants — Claude Code included — into writing to your ~/.ssh while the approval dialog showed a harmless filename. How it works, the CVEs, Anthropic's fair-to-note dispute, and why the approval prompt was never my real security boundary.
Final approval landed July 20. Training on legally-acquired books was ruled fair use; acquiring pirated copies was not. But the ruling says nothing about model outputs and creates no forward license — so for a dev using Claude to write code, it changes nothing in either direction. Separating the headline from the law.
METR ran a proper randomised trial: experienced devs felt AI made them 20% faster; the stopwatch said 19% slower. I use Claude Code daily and would have bet the same way they did. What the study actually measured, the nuance that stops it being 'AI is useless', and the uncomfortable thing I caught myself doing on code I know cold.
I shipped an llms.txt on this blog last week, then went looking for proof anything reads it. Google's John Mueller compares it to the old keywords meta tag; a 2026 study of ~38,000 AI-cited domains found zero citation advantage (p=0.85). Where it's genuinely useful, how to test it against your own logs, and why a helper file is a long shot on a web that already ignores robots.txt.
The panic says every European developer needs a compliance officer by Sunday. I read the regulation instead. Using Claude Code to write code? Nothing changes for you. Shipping an LLM feature? Smaller than you fear. The €35M headline? Not even the right number. An honest split of hype from what a solo dev must actually care about.
GitHub Copilot went token-metered on 1 June, Cursor split its usage pools, and Sonnet 5's intro API price expires 31 August. The flat monthly plan for AI coding is quietly over. Why it broke, what it does to a working dev's bill, and the one rule I now budget by.
Pi is Mario Zechner's minimal coding agent: four tools, a system prompt under 1,000 tokens, and skills that load only when needed. I ran it on this blog's Drupal repo. It's the clearest look at the machinery I've had in a while, and it has no seatbelts, on purpose.
