BugLens Journal
Engineering notes on AI code review, agentic systems, and the infrastructure behind BugLens.
Multi-agent orchestration patterns that actually work in production
Most teams start with a single agent, hit the limits of what one context window can do, and reach for multi-agent systems. Then they discover a new set of failure modes they were not expecting. Here is what the production data says about which patterns hold up.
AI-assisted code leaks secrets at twice the rate of human code
In 2025, developers added 28.65 million new hardcoded secrets to public GitHub commits — a 34% jump from the year before. AI-assisted commits leaked secrets at twice the rate of human-written code. The Moltbook breach in February 2026 showed exactly what happens next
securityPrompt injection in AI coding agents: what the 2026 attacks actually look like
An attacker sent an email with hidden instructions. The recipient asked Copilot to summarize their inbox. Copilot silently exfiltrated sensitive documents. No clicks required. This is indirect prompt injection and it is now the most common attack vector against AI coding agents.
securityWhy AI coding agents keep shipping OWASP Top 10 vulnerabilities
Veracode tested over 100 large language models on security-sensitive coding tasks. 45% of the AI-generated code samples introduced OWASP Top 10 vulnerabilities. The number is not improving. Here is why.
securityMCP server security in 2026: tool poisoning, rug pulls, and what postmark-mcp revealed
The postmark-mcp package shipped fifteen clean versions before adding a single line that blind-carbon-copied every outgoing email to an attacker. 300 organizations had it running before it was taken down. This is the MCP security problem nobody audited.
securitySlopsquatting: when your AI coding agent installs the attacker's package
In January 2026, a hallucinated npm package called react-codeshift spread to 237 repositories via AI-generated code. Nobody planted it. The AI invented the name, agents kept referencing it, and attackers were ready the moment someone registered it.
securityGitHub Copilot agent mode vs Claude Code: which one actually ships safer code?
Everyone asks which AI coding agent is better. The more useful question is which one ships safer code, and whether either can answer that without an external review layer.
securityVibe coding has a security problem. Here is the data.
In early 2026, a researcher made a free Moltbook account and found 1.5 million API tokens exposed in plain JavaScript. The creator built the whole platform with AI and wrote zero code. This is what the data says about where vibe coding security stands today.
infrastructureQdrant vs Pinecone vs Weaviate: Which Vector Database Should Power Your RAG App?
Evaluated three vector databases before picking Qdrant. Latency, cost, hybrid search, DX compared.
deep diveWhen AI Looks Smarter Than It Thinks: The Hidden Cost of LLM Overreliance
LLMs sound confident and fast, but imitation without true understanding creates real risks for teams.
mcpMCP in 2026: The USB-C Moment for AI Agents
MCP went from a niche spec to the universal AI integration layer. Here's what it means for agents.
ragHow BugLens Uses RAG to Make AI Code Review Actually Useful
Generic LLM reviews are noise. BugLens embeds your team docs and past PRs via Qdrant.
architectureWhy I Chose LangGraph Over LangChain for Multi-Agent Orchestration
After building BugLens's 3-agent pipeline I learned why state graphs beat linear chains. Full decision inside.