The Model Was Never the Hard Part

For a year, the whole conversation was about which model won this week. That race is still loud, but it stopped being the thing that decides whether your team ships good software. The tools around the model grew up. The place bugs hide moved. And the buying decisions inside big companies shifted under your feet.

Let me catch you up on what actually changed and what you should bring to your next review.

The 90/10 split you got backwards

Here is the reframe worth sitting with. The model gives an agent its raw reasoning. The harness gives it your instructions, your files, your tools, your guardrails, and the checks that catch bad output before it reaches you. Wyndo argues the split is closer to 50/50, not the 90/10 that most people assume in the model's favor.

The harness is the half you control. Anthropic even calls Claude Code "the agentic harness around Claude." Cursor defines its harness as instructions plus tools plus the chosen model. Same model, different wrapper, different results.

This is why a new model does not fix a broken setup. Swap engines all you want. If your instructions, context, and checks are thin, you are still re-explaining the same job to a smarter machine. Build the wrapper once and it carries across models. A better model becomes a multiplier on work you already did, not a reason to start over.

When the agent grades its own homework

Here is the failure that should worry you. AI now writes the code and the tests that are supposed to check the code. The tests pass green. Coverage looks perfect. And the test only confirms the code matches its own assumptions, not that it matches the requirement.

The numbers are ugly. CodeRabbit's report on 470 real GitHub pull requests found AI-assisted PRs carry roughly 1.7 times more issues than human-written code. Veracode found 45% of AI-generated code introduces a security flaw. IOActive tested 27 models across 730 prompts and found nearly a third of samples fully exploitable.

The fix is one rule: never let the thing that made the artifact also approve it. Generate tests from the ticket, not the code, then diff them. Use mutation testing to ask "would this test fail if the code were wrong?" instead of trusting coverage. Put hard gates on any PR an agent touched. This is QA work, and it belongs on your roadmap, not in someone's spare time.

The second curve nobody watches

Speed goes up. Understanding goes down. And the dashboard only shows you the first one. Chaabani Anis tells the story of a team that rolled out a coding assistant: more commits, more PRs, happier developers, and a senior who could no longer rewrite a module they just shipped.

The data backs the anxiety. Developers using AI daily produce about four times more code, but value delivered grows only around 12%. A Faros AI study of 22,000 developers found PRs bloating 51%, review times up fivefold, and 31% more changes merged with no review at all. The one step that never sped up is human review, and it is now the whole bottleneck.

So stop steering AI by usage rate. Licenses and acceptance rate can climb while the system rots. The DORA 2025 report is blunt that the biggest returns come from foundations like platform, workflows, and review capacity, not from the tool itself. Ask your leads to quote real numbers on reviewed changes and recovery time. If the answer is a feeling, you are assuming, not steering.

The purchase happening over your head

While you were picking models, the cloud providers rewrote the buying map. Superblocks signed a multi-year deal with AWS to embed its vibe-coding tool inside customers' private clouds. Apps spin up Amazon Aurora databases and run through Bedrock. Data never leaves the account. Rogue business-user apps fall under IT's control.

The strategy behind it matters more than the deal. Hyperscalers want enterprises to buy the harness, the orchestration, and the security from them, not from the frontier labs. Satya Nadella has been telling customers to run multiple models to cut cost and dodge lock-in, and to distrust the labs for orchestration because they may study your business and later compete with it. Open models already made up 29% of traffic through Vercel's AI gateway last month.

Superblocks CEO Brad Menezes puts the pressure plainly: "any enterprise that is betting on a single model provider, that executive will be fired." Whether or not that lands, plan for multi-model. If your product or internal tooling assumes one lab forever, you are building on sand.

The deep cut

The practical payoff hides in one word: model-agnostic. If your harness is glued to one model's quirks, every switch costs you a rebuild, and every price hike from a lab is a gun to your head. If your instructions, source files, guardrails, and checks live in your own repo and GitHub, a model that breaks or gets expensive is a swap, not a crisis. A model that gets better is free upside.

So the move on Monday is not "which model." It is: write down your context, your rules, and your quality checks as artifacts your team owns, and test that setup every time the model changes. That is the asset that compounds. The model is the rental. The harness is the thing you keep.

Three questions for your team

1. If our best model doubled in price tomorrow, could we swap it out this week without rebuilding our setup, or are we locked in?
2. On our last ten AI-touched PRs, how many had tests generated from the requirement instead of the code, and how many merged with no real review?
3. We can quote our commit and PR volume. Can we also quote our reviewed-change rate and recovery time, or are we steering by the reassuring curve?