Nobody Can Say What Their AI Coding Agents Actually Did Today

Enterprises are spending heavily on AI coding agents with essentially zero visibility into their actual behavior: what they tried, what failed silently, what got redone three times before landing. Alibaba Cloud's response, an open-source observability tool called LoongSuite Pilot, treats the gap as a tooling problem. It probably is one, but the fact that the tooling didn't exist until spend was already high enough to notice is the more interesting fact.

The benchmarks measuring the agents have their own problem

The visibility gap gets worse once you ask how these agents' improvements are even being measured. A new paper on automatic harness evolution, the practice of letting an agent iteratively improve its own scaffolding, found that many of the reported gains look like overfitting to the public test set rather than genuine capability improvement. In head-to-head experiments, simple test-time scaling methods matched or beat evolved harnesses, and the evolved harnesses showed limited generalization to tasks they hadn't been tuned against. That's a serious finding for an industry that routinely cites harness-evolution benchmarks to justify agent purchases: if the number moving up doesn't reflect the capability buyers think it reflects, the ROI conversation enterprises are already struggling to have gets even harder to have honestly.

And the code these agents write isn't being checked by default

Alibaba's separate move to add in-session code review, catching vulnerabilities before they land in a repository rather than relying on the coding model to avoid writing them, only makes sense as a product if the default state of AI-generated code is unreviewed. That's the quiet admission buried in the announcement: the industry's coding agents have been shipping code into production repositories without a security gate as standard practice, and vendors are only now building the guardrail as an opt-in add-on rather than table stakes.

Three problems, one root cause

Spend without visibility, capability gains that may be measurement artifacts, and code shipped without default review are three distinct problems on paper. In practice they share a root cause: AI coding agents were adopted fast enough that the infrastructure to observe, evaluate, and secure them is being built after the fact, in response to problems that already surfaced, rather than before. That's not unusual for a new technology category. Web applications went through the same lag before security scanning became standard, and cloud infrastructure went through it before observability platforms matured. What's unusual is the speed: coding agents went from novelty to significant enterprise line-item in roughly two years, faster than the tooling ecosystem needed to keep pace.

The practical implication for any team running these agents today is that none of the numbers they're currently trusting, spend efficiency, benchmark-reported capability gains, code quality, should be taken at face value without the observability and review layers these three stories describe. The agents got fast. The measurement of what they're actually doing is still catching up.