Engineering Leader & CTO Brief

Executive Summary

AI Engineer Europe 2026 surfaced a clear and urgent message for engineering leaders: the transition from AI-assisted development to AI-native engineering organisations is already underway at pace, and the gap between early movers and laggards is compounding fast. The conference featured first-hand accounts from CTOs and senior engineers who have already restructured their teams, eliminated entire Scrum ceremony sets, and measured concrete output multipliers — not theoretical ones. Mike Spitz (CTO, PFF) reported a 25x increase in deployment frequency and a 10x output gain from a two-engineer AI-native team versus a ten-engineer traditional team, with customer satisfaction rising from 7.0 to 8.6/10. Brian Scanlan (Senior Principal Engineer, Intercom) reported that Claude Code drove a doubling of PR throughput in under a year with 17.6% of pull requests now auto-approved under full SOC 2, ISO 27001, and HIPAA compliance. Ryan Lopopolo (OpenAI) reported his team operating at 3–5 PRs per engineer per day, spending over $1,000/day on tokens, and banning direct editor access in favour of delegating all implementation to coding agents.

The dominant architectural pattern emerging from the conference is what speakers called "harness engineering" — the discipline of building the supervisory scaffolding (guardrails, lint rules, review agents, eval pipelines, context management) that enables coding agents to operate reliably at high velocity. Lopopolo defined it as "surfacing the right instructions to the model at the right time," not frontloading everything. The consensus is that the harness — not the prompt, not the model — is now the primary engineering lever. Teams that invest in their harness compound gains; teams that do not accrue technical debt faster than any prior era because agents generate enterprise-grade complexity in weeks, not years, and do so silently.

Two structural risks dominated the governance and security tracks. First, the security surface area of agentic systems is qualitatively different from traditional software: Diego Carpentero (ModernBERT) catalogued six production attack vectors including MCP tool-description asymmetry exploits, supply-chain attacks via agent-installed NPM packages (affecting ~5,000 developers in a February 2026 incident), and RAG poisoning requiring only five malicious chunks in an eight-million-document corpus. Peter Steinberger (OpenAI, OpenClaw creator) reported 1,142 security advisories in five months — 16.6 per day — calling it "GitHub's fastest-growing software project" by advisory rate. Second, CI/CD infrastructure is already breaking under agent-driven PR volume: Hugo Santos and Madison Faulkner (Namespace/NEA) presented concrete evidence of runner saturation, merge queue serialisation failures, and cache thrash at teams whose agent fleets are generating thousands of PRs against the same codebase.

For CTOs weighing the organisational and strategic implications, the key insight from this conference is that the bottleneck has permanently shifted. Implementation is no longer scarce. The new scarce resources are: (1) human judgment about what to build and why; (2) context engineering quality — the institutional knowledge, architectural decisions, and domain-specific constraints encoded into agents; and (3) evaluation infrastructure — the harnesses, evals pipelines, and observability tooling that let organisations know whether agents are producing trustworthy output at scale. Leaders who invest in these three domains now will compound; those who optimise for raw token throughput will accumulate invisible debt.

Key Findings

Finding 1: The 10–25x Output Multiplier Is Real But Requires Specific Team Architecture

The conference moved beyond claims and into empirically reported results. Mike Spitz (CTO, PFF) conducted a controlled three-month experiment (January–March 2026) comparing two engineers using AI agents against ten engineers on the same codebase. The AI-native pair achieved 25x higher deployment frequency (five deploys per day versus one per five days) and 10x higher weighted output. Customer satisfaction rose from 7–7.5 to 8.6/10 as a consequence of faster iteration cycles. Critically, Spitz eliminated all Scrum ceremonies: standups replaced by PR-state ticket auto-update, sprint planning eliminated as velocity estimation became meaningless, retrospectives replaced by customer satisfaction surveys. What remained was a biweekly half-hour review.

Brian Scanlan (Intercom) reported doubling PR throughput in under a year with Claude Code, with CI infrastructure "melting" under volume — an unintended but telling signal of success. His team maintains hundreds of internal skills encoding 15 years of Rails conventions, pushes them to all engineer laptops via internal Claude plugins, and mines session transcripts stored in S3 to evaluate skill effectiveness.

Ryan Lopopolo (OpenAI) reported 3–5 PRs per engineer per day and described GPT-5.2 as the inflection point at which "code is effectively free." His "Garbage Collection Fridays" convert synchronous human review feedback into lint rules, reviewer agents, and documentation — permanently eliminating entire classes of slop rather than reviewing it case by case.

The critical caveat from Spitz: engineer selection matters enormously. The profile that succeeds is curious, self-directed, and comfortable with ambiguity. Prescriptive engineers who rely on detailed specifications struggle. Recommended path: start with engineers who have the deepest system knowledge, experiment on non-critical systems first, and use phased rollout rather than company-wide hackathon-style launches.

Finding 2: Harness Engineering Is the Primary Leverage Point — Not Model Choice

Multiple independent speakers converged on the same insight: the harness surrounding a model matters more than the model itself. Tejas Kumar (IBM) demonstrated this live: using GPT-3.5 Turbo — a deliberately old, cheap 2023 model — he built a browser automation agent that successfully completed a complex task by iteratively layering four harness components (guardrails, retry logic, a deterministic verify step, and a programmatic login handler), without modifying the prompt once.

The Anthropic Applied AI team (Ash Prabaker and Andrew Wilson) presented their state-of-the-art harness for long-running agents: a GAN-inspired generator–evaluator adversarial architecture where a standalone evaluator uses Playwright MCP to open live pages, click through applications, and score output on four criteria (design, originality, craft, functionality) — not merely read diffs. The key innovation is a pre-coding "done contract" negotiated via files on disk: the generator proposes acceptance criteria, the evaluator pushes back, and both iterate until agreed. This contract layer prevents 30-minute agent runs from silently drifting away from intent. With this harness, a "retro game maker" prompt produced a self-named application with 54-color sprite palettes, working physics, and collision detection — none of which were specified — at approximately $200 and 6 hours of compute.

Eric Zakariasson (Cursor) described running 5–10 cloud agents asynchronously at any given time, with a daily review agent aggregating Slack and GitHub activity, an agentic code-owner system that assesses PR risk and dynamically routes reviews (approving low-risk changes automatically), and a continual learning plugin that scans chat transcripts to extract and persist rules without manual effort.

Patrick Debois (DevOps founder, Tessl) formalised this as the Context Development Lifecycle (CDL): Generate, Evaluate, Distribute, and Observe — a structured engineering discipline for managing prompts, rules, memory, and instructions with the same rigour teams apply to software: versioning, testing, packaging, and observability.

Finding 3: Context Engineering Quality Determines Agent Reliability — and Most Teams Are Getting It Wrong

Context engineering emerged as the conference's central technical theme, discussed from radically different angles but reaching the same conclusion: agents fail because of context, not prompts or models. Several distinct failure modes were documented.

Brendan O'Leary (Kilo Code) identified context bloat — quality degrading noticeably above 50% context window utilisation — and context poisoning, where mixing unrelated tasks or stale exploratory paths causes bad patterns to re-emerge. His prescription: research-plan-implement loops with strict context isolation, persistent working memory in external files (agents.md), and parallel agents for isolation rather than extended single sessions.

Sally-Ann DeLucia (Arize) documented a vicious context growth loop in their production observability agent Alyx: the agent would run on span data, spans would grow, context limits would be hit, the agent would fail and retry, adding more data to an already-overfull context. The stable solution was head-plus-tail smart truncation combined with a retrievable memory store, with sub-agent delegation for heavy data operations.

Raj Navakoti (IKEA) presented demand-driven context — a "pull" methodology for building enterprise knowledge bases by observing where agents fail rather than attempting to curate context top-down. Starting from agent incidents and surfacing the specific institutional knowledge gaps, his team improved agent confidence scores from 1.5 to 4.4 across 14 sequential incidents and built a context gap scanner that classifies missing knowledge by criticality. Average per-domain context fits within approximately 96K tokens — comfortably within a 1M-token context window — meaning full-context retrieval often outperforms RAG for typical domain scopes.

Nick Nisi (WorkOS) reported deleting 95% of generated skills (10,000 lines down to 553 lines of handwritten "gotcha" notes) and achieving better pass rates, faster evals (68 minutes to 6 minutes), and a 20-percentage-point accuracy improvement on one specific task. His key finding: agents already know how to code; they only need to know where the landmines are in your specific product. Exhaustive documentation creates noise.

Michal Cichra (Safe Intelligence) demonstrated machine-enforceable governance: Architecture Decision Records (ADRs) linked from CI failures so agents read, understand, and fix violations; BDD with Cucumber for executable specifications that cannot be faked; and module import linting to make entire classes of bugs (N+1 queries) structurally impossible rather than caught in code review. After 20–50 context compacts per session, the rules survive because they live in git and CI — not in the prompt.

Finding 4: Production Security and Governance of Agents Is a Distinct and Urgent Problem

The security track was among the most alarming at the conference. Diego Carpentero (ModernBERT guardrails) catalogued six production attack vectors with concrete 2025–2026 examples: direct prompt injection (the Sydney/Bing case exfiltrating system rules on day one of launch); indirect context injection (March 2026 case of attacker-crafted prompts embedded in websites overriding AI advertising review systems); GCG gibberish suffix tokens that transfer attack patterns from open-weight models to closed black-box models; RAG poisoning requiring only five chunks in an eight-million-document corpus (2025 Poison RAG paper); MCP tool-description asymmetry where agents see full hidden instructions while humans see only a one-liner; and agentic escalation — a February 2026 supply-chain attack where a malicious NPM package referenced in a GitHub issue was installed by a coding agent, affecting 4,000–5,000 developers.

Peter Steinberger (OpenAI, OpenClaw) described what he called the "lethal trifecta" of agentic risk: personal data access + untrusted content + communication ability. OpenClaw received 1,142 security advisories in five months (16.6/day, 99 critical) — twice curl's lifetime total. He is forming the OpenClaw Foundation with contributions from Nvidia, Microsoft, Tencent, and Bytedance.

Karan Sampath (Anthropic Forward Deployed Engineering) presented the case for MCP Gateways as the critical missing enterprise infrastructure: a middleware layer providing authentication (OAuth/IDP integration), role-based access control, secure tunnelling, internal server sub-registry, and full observability into tool usage. Without gateways, enterprises face the "three-headed hydra" of observability gaps (no visibility into who uses which MCP tools), access control failures (cannot scope permissions by role), and security gaps (no ability to verify servers won't exfiltrate data). His prescriptive guidance: invest in common MCP infrastructure, avoid per-team siloed rollouts, and build toward an architecture where agent harnesses are decoupled from data layers.

Ioana Ghita (Accesa) presented a class of failure invisible to technical monitoring: "unmodeled semantic and decision states" — situations where agents make technically correct decisions that are strategically wrong, with no fallback. In a manufacturing anomaly detection case, an agent correctly identified and labelled a spike but triggered a decision involving hundreds of millions of euros that was wrong — not a bug, not a hallucination, but a valid semantic state with no decision boundary. Infrastructure dashboards showed zero errors. The fix requires logging agent reasoning, not just agent actions, with end-to-end trace IDs at every decision checkpoint.

Jun Yu Tan (Tusk) quantified the reliability mathematics: a 99% reliable probabilistic classifier yields only approximately 30% zero-error probability over a 120-tool-call session and essentially zero over 1,000 calls. His Fence system enforces file-system, network, and command policies at OS kernel level — no container runtime required — providing a deterministic execution boundary as the middle layer in a classifier → OS policy → container isolation stack.

Finding 5: CI/CD and Infrastructure Are Already Breaking Under Agent-Driven Volume

Hugo Santos (Namespace, former Google microservices lead) and Madison Faulkner (NEA partner, former Meta AI researcher) documented that traditional CI/CD is fundamentally incompatible with agentic development at scale. The core problem is throughput mismatch: CI/CD was designed for humans submitting one or two diffs per week. At agent scale, thousands of autonomous agents open PRs continuously, causing runner saturation, cold Docker builds on every short-lived branch, cache thrash, and merge queues behaving like serialised database locks. Namespace reports their own team's PR-equivalent volume is already 4x historical norms, making per-PR human review untenable.

Their proposed replacement architecture: codified intent-and-plan captured in Linear/Slack/spec documents, inline validation embedded in the agent loop rather than as post-hoc gate, pre-merge queue for serializability across concurrent agent branches, and human review on intent-plus-outcome (including feature demo videos and LLM security reports) rather than raw diffs. External validation moves to specialised LLM reviewer agents (security-focused, API-conformance-focused) that provide structured feedback directly back into the harness.

Liam Hampton (Microsoft) demonstrated VS Code as a three-tier agent architecture: local agents (human-in-loop, tests), background agents in Git worktrees via GitHub Copilot CLI (parallel UI building), and cloud agents in GitHub Actions (firewalled, no main-branch access). This tier separation is the emerging best practice for managing risk while maximising throughput.

Vincent Koc (OpenClaw) described running 15–20 parallel coding sessions in "swim lanes" organised by work type, with sub-agents pushing the effective total to 60–70 concurrent agents. His infrastructure: a dot-skills dotfiles system, semantic graph clustering with vector embeddings over GitHub issues (each PR represented as a node with 73–106 edges), and evaluation loops using a synthetic Slack environment to validate provider integrations after refactors.

Finding 6: Evals and Observability Are Mandatory Infrastructure — Not Nice-to-Haves

The evals and observability track presented the clearest evidence that teams building agents without continuous evaluation infrastructure are flying blind. Multiple production failures were attributed not to bad models or bad prompts but to absent or insufficient evaluation pipelines.

Lawrence Jones (Incident.io) built eval infrastructure specifically to debug an AI SRE running hundreds of telemetry queries per investigation. His eval YAML CLI ("eval-tool") enables coding agents to modify prompts without context overflow. His fleet-scale analysis pipeline uses 25 parallel Claude Code sub-agents to independently analyse investigations, then clusters results to surface systemic failure patterns — turning what was a one-hour-per-incident manual review into minutes. His generalised principle: prefer downloadable file systems over MCPs or browser-use agents as agent context, because bulk file downloads enable grep-based traversal that outperforms interactive UIs.

Samuel Colvin (Pydantic, Logfire) demonstrated GEPA (Genetic Evolution of Prompts via Agents) — a genetic algorithm for prompt optimisation that achieved 96.7% accuracy versus 92% for manually engineered prompts and 87% for a simple one-line prompt, using 400 evaluation calls. Crucially, Shopify reduced annual model costs from approximately $5 million to $73,000 by combining GEPA-style optimisation with a smaller quantised model instead of GPT-5. Logfire managed variables enable live A/B traffic splitting for model and prompt changes without server restarts.

Phil Hetzel (Braintrust) argued that agent observability is categorically different from traditional observability: non-deterministic control flows, traces exceeding 1 GB, individual spans reaching 20 MB, and the requirement for domain experts (clinicians, lawyers, wealth advisors) as the human review layer. Braintrust built a custom database from scratch for this, incorporating a write-ahead log, analytical indexes, and a forked version of Tantivy (Rust-based full-text search) because ClickHouse lacked robust full-text indexing for agent trace data.

Nicholas Kang and Michael Aaron (Google DeepMind / Kaggle) highlighted benchmark opacity as a systemic risk for teams making model selection decisions: on SWE-Bench Pro, the harness they run inside shifts performance by 22%, meaning two labs can report dramatically different numbers from the same benchmark without fraud, and neither number is informative.

Finding 7: Organisational Change Is the Constraint — Not Technology

Maggie Appleton (GitHub Next) delivered the conference's most pointed organisational warning: the dominant model of agentic development — one developer orchestrating a fleet of solo coding agents — exacerbates existing team alignment problems. When implementation collapses from days to minutes, the natural alignment checkpoints embedded in traditional workflows (draft PR comments, Slack conversations, issue discussions) vanish from the front of the process and pile up as post-implementation burdens on pull requests. The result: duplicate work from parallel agents, merge conflicts, surprise features nobody agreed to build, and enormous stacks of PRs with no context.

Her team at GitHub Next built ACE (Agent Collaboration Environment): multiplayer chat, coding agents, sandboxed micro VMs per session on isolated Git branches, and real-time collaborative editing. The micro VM architecture means sessions persist independently of individual machines — a developer can close their laptop and teammates continue prompting agents on the shared cloud computer. A Monday-morning dashboard gives individuals awareness of teammates' recent shipping activity — critical when one engineer can now ship five features per day.

Phil Hetzel (Braintrust) argued that the most common organisational anti-pattern is delegating agent ownership to data science teams, when the actual skill profile required is distributed systems engineering, prompt/context engineering, and functional evaluation design — none of which are core ML/data science competencies. His recommended team composition: data scientists for statistical rigour and LLM-as-judge calibration; product/systems engineers for agent infrastructure; domain experts for human annotation and prompt authorship.

Gergely Orosz (The Pragmatic Engineer) documented the "token maxing" phenomenon at large tech companies: Meta uses AI token consumption as a performance metric, causing engineers to artificially inflate usage; Salesforce mandates $175/month in AI spend per employee. He described the Metr study of 30 developers in which participants felt 20% more productive but demonstrated 20% less productivity on measurable tasks — cautioning that intuitions about productivity gains must be validated with controlled measurement rather than self-reporting.

Finding 8: Cost Architecture for Agents Requires Active Management

Token economics surfaced repeatedly as a strategic constraint. At $1,000+/day for a single team (Lopopolo, OpenAI), the economics of agentic development require deliberate architectural choices rather than default behaviour.

Cloudflare's Code Mode (Sunil Pai) demonstrated compressing 2,600 API endpoints from 1.2 million tokens to approximately 1,000 tokens — a 99.9% reduction — by exposing two tool calls (search and execute) rather than one tool per endpoint. Rita Kozlov (Cloudflare) calculated token usage drops of 70% versus vanilla MCP when using Code Mode. Laurie Voss (Arize) ran 500 structured evaluations comparing MCP versus CLI approaches for the GitHub API and found MCP used 12 tool calls versus 5 per complex task and incurred 6x higher cost, with verbose JSON payloads overflowing context windows.

Cerebras (Sarah Chieng) introduced the concept of "latency debt": generation speeds have stayed flat at 50–150 tokens/second across major model families while context and output volumes tripled. Their Codex Spark model runs at 1,200 tokens/second — 20x faster — enabling continuous automated validation (test suites, linters, browser QA) at every pipeline step at effectively zero marginal cost. Morph LLM (Tejas Bhakta) demonstrated specialised sub-agent models: a context compaction model at 33,000 tokens/second and a code-search model supporting 12 parallel tool calls. Cross-customer data showed doubling speed without hurting accuracy roughly doubles conversion rates.

Gemini API context caching (Google DeepMind) reduces costs by up to 90% for repeated queries over the same large files, with the Interactions API showing 2–3x higher cache hit rates compared to client-side history management.

Strategic Implications

The implementation bottleneck has permanently moved. Code generation is no longer the constraint. Engineering leaders must restructure team incentives, hiring profiles, and performance metrics around the new scarce resources: judgment (what to build), context engineering quality (what agents know about your domain), and evaluation infrastructure (how you know agents are correct). Teams still optimising for individual engineer velocity are optimising the wrong variable.

The security perimeter has fundamentally expanded. Every agent with access to untrusted content and external communication capability is a potential injection vector. The MCP tool-description asymmetry, RAG poisoning, and supply-chain attack via coding agent vectors documented at this conference are not theoretical — they are 2025–2026 production incidents. Engineering leaders must treat agent security with the same rigour as production API security: threat modelling, controlled capability grants, audit trails, and incident response plans specific to agentic scenarios. The Anthropic MCP Gateway architecture (Karan Sampath) should be evaluated as table-stakes enterprise infrastructure, not a future consideration.

CI/CD investment is now a first-class agentic enabler. The Namespace/NEA findings are a warning: teams that do not re-architect their CI/CD pipelines for agent-scale PR volume will find their infrastructure becoming the bottleneck rather than agent capability. The migration is non-trivial and requires intentional design: stateful compute environments, pre-merge queues for serializability, intent-plus-outcome review interfaces, and inline validation embedded in the agent loop.

Organisational change is the rate-limiting factor, not tooling. The gap between AI-native teams (Spitz's two-person team, Koc's 60–70 concurrent agents, Lopopolo's 3–5 PRs/engineer/day) and traditional teams is already one to two orders of magnitude in output velocity. Because velocity compounds, a team that falls three months behind today is six to twelve months behind in six months (Spitz's observation). The limiting factor is almost always organisational: misaligned incentives, the wrong people in agent roles, absent evaluation infrastructure, or siloed agent ownership in data science rather than product engineering.

Context engineering is a permanent ongoing investment, not a one-time setup. Institutional knowledge decays, codebases evolve, models change. The Intercom S3 transcript mining, the IKEA demand-driven context gap scanner, the Lovable Stack Overflow injection system, and the WorkOS skill pruning cycle are all manifestations of the same operational requirement: continuous maintenance of the context that agents operate on. Engineering leaders should build this as infrastructure — with versioning, testing, and observability — not as an ad hoc prompt file.

Domain experts are a strategic moat that agents cannot displace. The Legora (Lauritzen), Anterior/Notius (Lovejoy), and Incidentio (Jones) case studies all converge on the same finding: agents fail on institutional and domain-specific knowledge, not on general reasoning. The "verifier's rule" (tasks only become agent-solvable when they are verifiable) means the most defensible competitive positions are domains where your team has the deepest context — because that context cannot be scraped, cannot be purchased from a model provider, and cannot be replicated by a competitor's generic deployment.

Action Items

Priority 1 — Immediate (0–4 weeks)

1. Conduct an agent security audit. Map every agent's access to: (a) sensitive or personal data, (b) untrusted external content sources, and (c) communication capabilities. Any agent sitting at the intersection of all three is the "lethal trifecta" (Steinberger). Implement MCP tool-description reviews, capability-based access scoping, and an incident response plan specific to prompt injection and agent-escalation scenarios.

1. Assign eval ownership. If no team member owns the eval pipeline for your production agents, this is an immediate risk. Hire or designate an owner, establish a golden eval dataset for every agent in production, and instrument production traces as the source of ground truth. Prefer production traces over hand-authored examples (DeLucia, Arize).

1. Audit your CI/CD for agent readiness. Measure current PR volume and trend. If volume is growing faster than runner capacity, begin evaluating stateful compute environments and pre-merge queue architectures before queue serialisation becomes your primary bottleneck (Santos/Faulkner, Namespace).

Priority 2 — Near-Term (1–3 months)

1. Build or designate a skills/context library. Formalise the process by which institutional knowledge (architectural decisions, domain constraints, security rules) is encoded into agent context. Use ADRs linked from CI failures (Cichra), machine-enforceable lint rules, and BDD specifications. Version and test context the same way you version and test code. Mine session transcripts for gaps (Scanlan, Intercom).

1. Pilot the research-plan-implement loop on one team. O'Leary's (Kilo Code) framework — read-only research phase producing a review document, explicit plan with file list and test commands, isolated implementation session starting fresh — is the most operationally mature workflow pattern presented. Instrument with evals before and after to measure impact.

1. Evaluate MCP Gateway architecture. Karan Sampath's (Anthropic) three-headed hydra (observability, access control, security) is a production blocker for enterprise MCP adoption. Evaluate whether a gateway layer is needed before scaling MCP servers across teams. Anthropic has open-source examples and professional support available.

1. Select one team as the AI-native pilot. Based on Spitz's guidance: choose engineers with deep system knowledge, start on non-critical or new systems, implement Spec → LDD → Auto-ticket flow, eliminate standups, and measure output and satisfaction over 90 days. Use the results to inform the broader rollout plan.

Priority 3 — Strategic (3–12 months)

1. Re-architect review and approval workflows. Move toward intent-plus-outcome review (feature demo videos, LLM security reports) rather than raw diff review. Implement persona-based automated reviewer agents (security, reliability, API conformance) that run on every push and provide structured blocking feedback — removing humans from synchronous review loops (Lopopolo, Zakariasson).

1. Invest in agent observability as infrastructure. Instrument agent reasoning (not just agent actions) with end-to-end trace IDs. Implement explicit and implicit signal monitoring — tool error rates, latency, cost, user frustration classifiers, and self-diagnostic tools (Raindrop framework). Build domain expert review workflows as the human annotation layer driving automated scoring calibration.

1. Identify and eliminate organisational anti-patterns. Assess whether agent ownership is siloed in data science (wrong), whether performance metrics incentivise token maxing (dangerous), and whether team alignment checkpoints have disappeared as implementation windows collapsed (Appleton, GitHub). Consider an ACE-style collaborative agent environment or equivalent if teams are shipping in isolation and colliding in review.

Sessions to Watch

1. "Agents Don't Do Standups: Building the Post-Engineer Engineering Org" — Mike Spitz, CTO PFF: The most concrete case study at the conference — a three-month controlled experiment comparing two AI-native engineers against ten traditional engineers, with measured output, velocity, and customer satisfaction data. Essential viewing for any CTO evaluating organisational restructuring.

1. "Harness Engineering: How to Build Software When Humans Steer, Agents Execute" — Ryan Lopopolo, OpenAI: The canonical reference for harness engineering philosophy — repository structure for agent legibility (750-package PNPM monorepo, 350-line file limit), Garbage Collection Fridays, persona-based reviewer agents, and the economics of running $1,000+/day in agent compute. Directly applicable to any team at scale.

1. "Anthropic Workshop: Build Agents That Run for Hours" — Ash Prabaker & Andrew Wilson, Anthropic Applied AI: State-of-the-art harness architecture: generator–evaluator adversarial loop, Playwright MCP for live app evaluation, sprint contract negotiation between agents, and practical guidance on pruning harness components as model capabilities improve. Includes benchmark evolution from 1-hour to 12-hour minimum harness scores.

1. "$1 AI Guardrails: The Unreasonable Effectiveness of Finetuned ModernBERTs" — Diego Carpentero: The most comprehensive security threat landscape at the conference — six documented production attack vectors with 2025–2026 case studies, and a practical sub-dollar self-hosted guardrails layer achieving 35ms classification at 85% accuracy. Essential for any team building production agentic systems.

1. "CI/CD Is Dead, Agents Need Continuous Compute and Computers" — Hugo Santos & Madison Faulkner, Namespace/NEA: The infrastructure perspective on agent-scale development — concrete evidence of runner saturation, merge queue failures, and the architectural replacement: intent-plus-plan, stateful compute environments, pre-merge queues, and intent-plus-outcome human review. Critical reading before your CI/CD breaks under volume.

1. "Gateways Are All You Need" — Karan Sampath, Anthropic: The enterprise MCP deployment blueprint — the three-headed hydra of observability, access control, and security blocking most enterprises at single-digit MCP deployments, and the gateway architecture that resolves it with OAuth/IDP integration, role-based access control, and centralised root of trust. Directly actionable for any team scaling MCP across departments.

1. "BDD, ADR, PRD, WTF: Capturing Decisions for Humans and AI Alike" — Michal Cichra, Safe Intelligence: Machine-enforceable governance for agentic codebases — ADRs linked from CI failures, BDD with Cucumber, module import linting as a structural bug prevention mechanism. The context compact resilience demonstration (20–50 compacts per session with no rule degradation because rules live in git/CI) is the key insight for long-running agent workflows.

1. "Collaborative AI Engineering: One Dev, Two Dozen Agents, Zero Alignment" — Maggie Appleton, GitHub Next: The organisational failure mode most leaders will encounter — the collapse of implementation windows eliminating alignment touchpoints and creating PR pile-ups with no context. The ACE (Agent Collaboration Environment) architecture offers a concrete countermeasure: multiplayer agent prompting, shared dev server previews, and proactive team dashboards. Reframes the AI productivity question from "how do we go faster?" to "how do we think more rigorously before agents start working?"