The developer stories enterprise IT leaders actually read.
Volume 342, Issue 5 · 9 articles
Ian Cooper explains how to govern asynchronous APIs in event-driven architectures using AsyncAPI, CloudEvents and schema registries.
In this InfoQ presentation from QCon London, Ian Cooper, a coding architect formerly at Just Eat Takeaway and Reuters, tackles how to manage the many APIs generated by event-driven architectures and outlines the 'ABCs' of messaging: Address, Binding and Contract.
Drawing on real-world practice at Just Eat Takeaway, Cooper covers discovery, governance and provisioning using AsyncAPI, CloudEvents and schema registries.
He also shows how automated CI/CD infrastructure pipelines can provision messaging resources at scale.
OpenAI's DevDay 2026 brought GPT-6.1 Sol, computer use in the Agents API, cloud Codex and a new Decisions API.
InfoQ's Daniel Dominguez recaps OpenAI DevDay 2026, where the Agents API gained computer use, multi-agent capabilities, tool search and context compaction on OpenAI-managed infrastructure, and GPT-6.1 Sol arrived for coding and professional tasks, approaching GPT-6 Astra on several evaluations at one-fifth the price.
Codex can now run in cloud environments and gains voice input, an /agents interface, PR and merge-request review and Codex Security Cloud scanning.
A Decisions API in limited preview uses the smaller Luna model to choose from predefined options, alongside new ChatGPT plugin capabilities.
James Bach finds testing an AI coding agent is mostly close reading and legalistic debate with other AI agents.
Tester James Bach describes a project systematically testing Claude Opus as a coding agent, where most of Bach's time goes not to engineering but to analyzing documents that define behaviors and scoring criteria, and debating AI 'skills' that must agree with Bach's findings before a bug report can be filed.
Bach likens the work to expert-witness and legal practice, requiring patience, close reading, logic and rhetoric.
Bach argues engineers are becoming human agents in a web of loops, both controlling and controlled by AI.
Bain finds AI coding gains are stalling at code review and verification, and urges CIOs to build quality controls into the workflow.
Bain & Co. finds that AI is speeding up code generation, but review and verification have become the new bottleneck, leaving organizations with 20-27% gains against expectations of much larger improvements.
Bain recommends giving AI tools better context about codebases, architecture and standards, and building automated testing, security checks and policy controls into AI-assisted workflows while keeping human review for the highest-value decisions.
CIOs should measure end-to-end delivery through release frequency, cycle time, defect rates and deployment success rather than code volume.
NBER economists infer from stock prices that AI raised expected software engineering productivity by 32.6%.
CIO.com covers a National Bureau of Economic Research paper, 'The Macroeconomic Effect of AI: Sizing the Software Engineering Channel,' whose researchers reasoned that firms relying more on software engineers should see bigger stock gains from AI news and combined those price reactions with a model to estimate expected productivity.
They conclude that from November 2022 to December 2025, AI raised the market's expected value of software engineering productivity by the equivalent of a permanent 32.6% increase.
The article notes this is a market expectation, but a useful starting point for balancing AI tool spend against payroll.
Vibe coding's risk comes from teams trusting speed over validation, not from AI itself.
An AIwire article argues that the security problems tied to vibe coding rarely stem from AI itself but from teams letting speed replace validation.
Citing Sonar's 2026 developer survey, AI now generates 42% of committed code, yet most organizations have not expanded review and governance capacity to match, and Veracode's 2025 research found vulnerabilities in 45% of tested AI-generated code samples.
The piece says this does not create a new class of risk, but it scales familiar threats such as poor input validation, exposed secrets, broken access controls and weak authentication, making them easier to overlook.
OWASP Noir scans source code to inventory every exposed endpoint, including undocumented shadow APIs.
Help Net Security profiles OWASP Noir, an open-source static analysis tool that reads source code and lists the endpoints an application exposes, including paths, methods, parameters, headers and cookies tied to file and line, surfacing shadow APIs, deprecated routes and undocumented handlers that DAST crawlers miss.
A single binary supports 29 languages and 205 frameworks, can fall back to an LLM for unusual routing, flags hardcoded secrets and tags endpoints such as admin or payment.
Its output serves human reviewers, AI code auditors and DAST tools like ZAP and Burp Suite.
Python leads for model building and experimentation, while Go excels at performant, concurrent AI production services.
Analytics Insight compares Python and Go for AI development, noting Python remains the mainstay thanks to its mature ecosystem of PyTorch, TensorFlow, scikit-learn, pandas and NumPy, and simple syntax that speeds experimentation.
Go offers performance, concurrency and efficient deployment, making it well suited to scalable APIs, data pipelines and cloud services that put AI into production.
The article concludes both have a role and that teams should choose based on the stage of the AI project.
CodeScene used coding agents to refactor a 300,000-line C codebase in three weeks for about $4,000 in tokens.
InfoQ's Steef-Jan Wiggers reports on a CodeScene case study in which coding agents refactored the 300,000-line C decompilation of Street Fighter III: 3rd Strike in three weeks for about $4,000 in tokens, producing 2,903 commits across 726 files and raising the Code Health score from 5.6 to 10.0.
Two mechanisms made it work: the CodeHealth MCP Server as a deterministic quality signal, and a replay-trace harness that verified behavior frame by frame.
The agents also built their own playbook of 22 refactoring recipes, while practitioners debate how far the result generalizes.
More from Developer · All IT section newsletters · This week