Vibe Coding Weekly #22

Vibe Coding Weekly is your definitive source for staying current with the latest trends, tools, and techniques that are transforming the development landscape.

Happy Sunday!

Welcome to edition #22 of Vibe Coding Weekly.

This week in one satisfying refactor:

• The Big Story: GitHub went all-in on agents: Copilot CLI reached GA, Claude and Codex landed in every Business/Pro subscription, and the coding agent gained model selection, self-review, and built-in security scanning

• The Threshold Crossed: Cursor’s cloud agents now author 30%+ of internal PRs, and Bugbot can automatically fix what it finds — with a 76% resolution rate

• The Macro Signal: Jack Dorsey announced Blocks is cutting nearly half its workforce — from 10,000 to under 6,000 — and cited AI directly as the reason. The business is profitable. The cuts are structural.

---

This was the week the “agentic turn” stopped being a forecast and became a changelog. GitHub shipped four separate Copilot announcements in three days. Cursor’s agents passed the 30% PR threshold internally. Anthropic quietly acquired a computer-use AI startup and expanded Claude Cowork with 13 new enterprise plugins, pushing Claude Sonnet 4.6 to 72.5% on the OSWorld computer-use benchmark. Apple integrated agent support into Xcode. And one brilliant (or reckless, depending on who you ask) Cloudflare engineer vibe-coded a Next.js replacement over a long weekend.

But the story that may matter most in the long run didn’t come from a developer tool. Jack Dorsey announced that Blocks is cutting its workforce from over 10,000 to under 6,000 — and he attributed the decision explicitly to AI: “the intelligence tools we’re creating and using, paired with smaller and flatter teams, are enabling a new way of working which fundamentally changes what it means to build and run a company.” The company is profitable and growing. These aren’t reactive layoffs — they’re a structural bet. It’s the clearest signal yet that the productivity gains from AI aren’t just a developer story. They’re beginning to reshape what an organization looks like.

Meanwhile, the ecosystem is starting to feel the friction: open-source maintainers are closing their doors to outside contributions under a flood of AI-generated slop, a new security vulnerability has surfaced in Google’s API key management for Gemini, and the Pentagon is now seeking AI-powered coding tools for tens of thousands of military developers. The agents are shipping fast — but the guardrails, the institutions, and the headcounts are still catching up.

---

Key Takeaways

• GitHub’s most agent-packed week ever: Copilot CLI is now GA, Claude and Codex are available to all Copilot Business and Pro subscribers at no extra cost, and the coding agent gained a model picker, self-review on PRs, and built-in security scanning

• Cursor crossed a symbolic threshold: Over 30% of internal PRs at Cursor are now created by autonomous cloud agents, and Bugbot Autofix merges fixes in 35%+ of runs

• Anthropic is assembling an agentic platform: The acquisition of Vercept (computer-use AI) plus 13 new enterprise MCP plugins in Claude Cowork — and Claude Sonnet 4.6 at 72.5% on OSWorld — signal a push toward full desktop-level agent control

• AI is rewriting the build vs. buy calculus: Cloudflare rebuilt Next.js for $1,100 in tokens; Ladybird ported 25,000 lines of JavaScript engine code in two weeks. The cost of “just build it” has collapsed

• The macro signal is here: Jack Dorsey announced Blocks is cutting from over 10,000 to under 6,000 employees, citing AI directly: “the intelligence tools we’re creating and using… fundamentally changes what it means to build and run a company.” The business is profitable — the cuts are structural, not reactive

• The open-source ecosystem is under strain: “AI Slopageddon” is forcing cURL, Ghostty, and tldraw to close external contributions — researchers warn of a structural feedback-loop collapse that could erode software quality long-term

---

📦 Releases & News

GitHub Copilot CLI is now generally available

The terminal-native coding agent is out of beta and available to all Copilot subscribers. Copilot CLI has grown from a terminal assistant into a full agentic development environment: it plans tasks in Plan mode (Shift+Tab), runs autonomously in Autopilot mode, and delegates work to cloud agents in the background with &. It ships with support for Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.3-Codex, and Gemini 3 Pro, a built-in GitHub MCP server, plugin support, and session memory that persists across conversations. Enterprise teams get centralized governance and audit logging included.

---

Claude and Codex now available for all Copilot Business & Pro users

Anthropic’s Claude and OpenAI’s Codex are now available as coding agents inside GitHub, GitHub Mobile, and VS Code for all Copilot Business and Pro subscribers — no additional subscription required. Developers can assign issues to Claude, Codex, or Copilot, compare how different agents approach the same problem in parallel, and review all agent-generated work as draft PRs within existing workflows. The expansion comes days after Copilot Enterprise and Pro+ users received access earlier in February.

---

What’s new with GitHub Copilot coding agent

Five enhancements to GitHub’s background coding agent shipped this week. The most impactful: a model picker (choose between faster and more capable models per task), and self-review (the agent reviews its own PR using Copilot code review before opening it, iterating until the patch meets quality standards). The update also adds built-in security scanning (code scanning, secret detection, Dependabot checks), custom agent definitions via .github/agents/ YAML files, and CLI handoff to continue cloud sessions locally without losing context.

---

GPT-5.3-Codex is now available in GitHub, GitHub Mobile, and Visual Studio

OpenAI’s latest coding model is now generally available across all Copilot tiers — Enterprise, Business, Pro, and Pro+. GPT-5.3-Codex is available in the chat model picker across GitHub web, GitHub Mobile, VS Code, and Visual Studio. The model is described as 25% faster than its predecessor for agentic coding tasks, and administrators can opt in via Copilot organization settings to make it available to their teams.

---

Anthropic updates Claude Cowork with 13 new enterprise plugins

At its “Briefing: Enterprise Agents” virtual event, Anthropic announced 13 new MCP connectors for Claude Cowork — integrating with Google Workspace (Drive, Calendar, Gmail), DocuSign, Apollo, Clay, Outreach, and more. The update comes alongside a benchmark milestone: Claude Sonnet 4.6 now reaches 72.5% on the OSWorld computer-use evaluation, approaching human-level performance on complex tasks like multi-tab browser workflows and spreadsheet automation. For enterprise teams exploring AI agents for knowledge work, Claude Cowork is becoming a serious contender.

---

Cursor agents can now control their own computers

Cursor launched Cloud Agents: autonomous AI agents running in isolated Linux VMs in the cloud. They can build software, run tests, record video demos of their work, navigate the browser, and produce merge-ready PRs complete with screenshots and verification artifacts. More than 30% of internal merged PRs at Cursor are now created by these agents. The announcement also revealed early examples — agents triaging security vulnerabilities, building features end-to-end, and doing full UI walkthroughs of documentation sites — all autonomously, while the developer does other things.

---

Cursor Bugbot Autofix

Cursor’s Bugbot code-review agent can now automatically fix the issues it identifies in PRs. Bugbot Autofix spawns cloud agents in isolated VMs, runs tests, proposes patches, and submits them back to the PR. Over 35% of Bugbot Autofix changes are directly merged, and the resolution rate for flagged bugs has climbed from 52% to 76% over the last six months, while the average issues found per run has nearly doubled. Autofix is now out of beta and available to all Bugbot users.

---

Anthropic acquires Vercept, a computer-use AI startup

Anthropic acquired Vercept, a Seattle-based startup that built Vy — a cloud agent that could operate a remote Apple MacBook. Vercept had raised $50 million and counted Eric Schmidt and Jeff Dean among its angel investors. The acquisition follows Anthropic’s December purchase of the Bun JavaScript engine to scale Claude Code, and signals a growing push toward full desktop-level agent autonomy. Vercept’s product will be shut down on March 25, with co-founders including Luca Weihs and Ross Girshick joining Anthropic.

---

Apple releases Xcode 26.3 with support for agentic coding

Xcode 26.3 now natively integrates with Anthropic’s Claude Agent and OpenAI’s Codex. Agents can search documentation, explore file structures, update project settings, and verify their work by capturing Xcode Previews and iterating through builds and fixes — all without leaving the IDE. Xcode also exposes its agent interface via MCP, making any MCP-compatible tool a first-class citizen in the iOS/macOS development workflow. Developer reception has been enthusiastic, with several early adopters reporting successful full-app builds and Objective-C-to-Swift rewrites.

---

One engineer and an AI rebuilt Next.js in a week — meet vinext

Last week, one Cloudflare engineer rebuilt the Next.js API surface from scratch on top of Vite in a single week, spending $1,100 in tokens. The result — vinext — is a drop-in replacement (npm install vinext, swap next for vinext in your scripts) that builds production apps up to 4.4x faster and produces client bundles up to 57% smaller. It deploys to Cloudflare Workers with a single command and is already running in production. The post is a landmark case study in what AI-assisted large-scale software engineering looks like today.

---

📚 Tutorials & Resources

Writing about Agentic Engineering Patterns

Simon Willison launched a new guide — Agentic Engineering Patterns — to document the coding practices that help developers get the best results from coding agents like Claude Code and Codex. He distinguishes between “vibe coding” (no attention to the code at all) and “agentic engineering” (professional developers using agents to amplify their expertise). The guide is structured like a design patterns book, released one or two chapters per week, with the first two covering “Writing code is cheap now” and “Red/green TDD”. Mandatory reading for anyone building seriously with agents.

---

An AI agent coding skeptic tries AI agent coding, in excessive detail

Max Woolf, a data scientist who publicly doubted coding agents in May 2025, writes a rich, data-driven account of what changed his mind. Starting with YouTube metadata scrapers and escalating to porting Python’s scikit-learn machine learning library to Rust, he documents a series of projects that a former skeptic couldn’t explain away. His AGENTS.md strategy — an obsessively detailed instruction file that forces agents to follow strict code quality rules — is itself worth reading. The post is the best antidote to both uncritical AI hype and reflexive dismissal.

---

Ladybird adopts Rust, with help from AI

The Ladybird browser project is switching from C++ to Rust, and AI-assisted the first major port. Founder Andreas Kling used Claude Code and OpenAI Codex to translate LibJS (Ladybird’s JavaScript engine) to Rust — 25,000 lines of code, zero regressions across 65,000+ tests, two weeks of work. The same migration would have taken months by hand. Kling describes a human-directed process: hundreds of small prompts, adversarial review passes, and a strict requirement for byte-for-byte identical output. A rigorous example of what “AI as engineering accelerant” means in practice.

---

💡 Others

Jack Dorsey announces Blocks cuts nearly half its workforce, citing AI

Jack Dorsey announced that Blocks (formerly Square) is reducing its workforce from over 10,000 to just under 6,000 employees — and he attributed the decision directly to AI. In a public memo, Dorsey wrote: “the intelligence tools we’re creating and using, paired with smaller and flatter teams, are enabling a new way of working which fundamentally changes what it means to build and run a company.” The company is profitable and growing; the cuts aren’t a response to financial distress, but a structural bet on a new operating model. Severance includes 20 weeks of salary, equity vested through May, 6 months of healthcare, and $5,000 for transition costs. Dorsey explicitly said that making the changes gradually would have been more damaging than a clean break. This is the most direct public signal yet from a major tech CEO that AI is reshaping organizational headcount — not as a future risk, but as a present reality.

---

Google API Keys Weren’t Secrets. But then Gemini Changed the Rules.

Truffle Security discovered a silent privilege-escalation vulnerability in Google Cloud: when the Gemini API is enabled on a project, all existing API keys (including those publicly embedded in websites for Maps and Firebase, exactly as Google’s docs told developers to do) silently gain access to Gemini endpoints with no warning. They found 2,863 live affected keys in a Common Crawl scan — including keys from Google itself, deployed since 2023. Practical mitigation steps are included, and TruffleHog now detects the pattern. If you use Google Cloud, check this immediately.

---

AI “Vibe Coding” Threatens Open Source as Maintainers Face Crisis

Open-source projects are being flooded with AI-generated contributions so numerous and low-quality that maintainers can’t keep up — what RedMonk analyst Kate Holterhoff calls “AI Slopageddon.” Daniel Stenberg ended cURL’s bug bounty (20% of submissions were AI-generated, valid-rate dropped to 5%). Mitchell Hashimoto banned AI code from Ghostty. Research from Central European University shows vibe coding creates a structural negative feedback loop: fewer docs visits, fewer genuine bug reports, and eroding contributor incentives — predicting declining software quality even as individual productivity rises. The pattern mirrors what happened to Stack Overflow after ChatGPT launched.

---

DOD wants AI-enabled coding tools for ‘tens of thousands’ of users in its developer workforce

The Pentagon’s Chief Digital and AI Office (CDAO) is seeking AI-powered coding tools — both IDE and CLI — capable of scaling across tens of thousands of military developers. The DOD acknowledges it “currently lacks standardized, enterprise-wide access to AI-enabled coding tools,” describing this gap as a direct impediment to software delivery speed and national security. Proposed tools must meet FedRAMP High and DISA IL5 compliance requirements. Phase 1 responses were due March 6. When the US Department of Defense starts posting RFIs for AI coding tools at this scale, it signals that the enterprise adoption wave has moved well beyond the early adopter phase.

---

That’s a wrap for this week. The agents are shipping. The benchmarks are climbing. And one of the most prominent fintech CEOs just cut half his workforce and cited AI by name. Whether you read that as a warning, a preview, or an opportunity depends on where you sit — but it’s worth reading carefully either way.

Stay tuned for next week’s edition.

---

Vibe Coding Weekly is your definitive source for staying current with the latest trends, tools, and techniques that are transforming the development landscape.

In each update, you’ll receive:

• Deep dives into new technologies and emerging frameworks

• Optimized code patterns that enhance both efficiency and readability

• Curated tools and resources that will supercharge your workflow

• Community insights that are defining the future of development

Our goal is to provide you with concise, relevant, and actionable information that you can immediately apply to your projects.

Clean code and positive vibes,

The Vibe Coding Team