AI-written code is a hidden IT crisis

Hi there, this is your daily ☕️ Devshot.

In today's Devshot:

🔒 AI-written code is a hidden IT crisis

🪟 PowerToys adds new Windows Hopper tool

⏱️ OpenAI restores 5-hour Codex limits

💾 New tool runs a 753B-parameter AI model on a single GPU

🖥️ JetBrains Junie now runs fully offline

🦆 DuckDB now runs Java table functions

Plus: 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.

🔒 AI-written code is a hidden IT crisis LINK

AI-generated code is quietly becoming an IT crisis, as tools like Claude Code and Codex let non-engineers ship apps and automations that no one fully understands, tracks, or maintains inside organizations moving fast under AI mandates.

A spring 2026 audit of a Node.js backend found ~60% AI-written code passing every security scan, yet auth middleware appeared implemented three inconsistent ways across scattered files, with nobody able to explain the decisions behind it.

Analysis of over 300,000 AI-generated commits found nearly one in four quality and security issues reached production, while IBM's 2026 study reports 77% of organizations say AI adoption is outpacing their governance capabilities.

🪟 PowerToys adds new Windows Hopper tool LINK

PowerToys v0.101 ships Windows Hopper, a new tool that lets you switch between multiple windows of the same application, such as several File Explorer instances, using a configurable Alt + backtick shortcut.

The release streamlines updates with a Stable/Insider channel toggle under Settings > General, clearer step-by-step tracking during installs, and distinct labeling of preview builds, with managed-device previews controllable by the organization.

Command Palette gains an off-by-default compact mode, better ranking and cached Window Walker results, while Quick Accent and Mouse Jump move to WinUI 3 and PowerDisplay adds linked brightness across multiple monitors.

⏱️ OpenAI restores 5-hour Codex limits LINK

⏱️ OpenAI reinstated a five-hour usage cap on Codex and ChatGPT Work for Plus subscribers today, ending several weeks during which only a weekly limit applied to the now-unified platforms.

Once users hit either the five-hour or weekly ceiling, they can wait for a reset or buy extra credits, with OpenAI occasionally granting free resets and banked resets via promotions and referrals.

Engineering lead Tibo Sottiaux said the cap smooths compute load and stops casual Plus users burning through weekly usage by accident; Pro $100 and $200 tiers stay uncapped for the coming months.

💾 New tool runs a 753B-parameter AI model on a single GPU LINK

FreeToken, a new open-source MoE serving engine from UC Berkeley and UT Austin researchers, runs the 753B-parameter GLM-5.2 model on a single workstation GPU by streaming computation across GPU, CPU, memory, and interconnect.

The engine scales down to consumer hardware too, serving a 35B model at interactive speeds on an 8GB laptop GPU and sustaining ~80 tokens per second on Qwen3.6-35B-A3B with an RTX 5090.

Licensed Apache-2.0 on GitHub and PyPI as freetoken v0.1.2, it exposes OpenAI- and Anthropic-compatible endpoints, targets Linux x86_64 with NVIDIA GPUs, and keeps data local for privacy-sensitive teams.

🖥️ JetBrains Junie now runs fully offline LINK

JetBrains launched Junie Local, a free version of its coding agent that runs entirely on a developer's own machine, keeping prompts, source, and diffs off any external model provider with no internet connection required.

Running /local inside Junie downloads a preselected, pretuned Qwen3.6-27B model at 4-bit via an mlx-vlm engine, starting a local server and switching over automatically without any Ollama or LM Studio setup.

The setup demands a steep hardware floor, macOS 26, an M5 chip or newer, 64 GB of unified memory, and a ~20 GB download, with JetBrains optimizing for prefill speed and targeting long, mechanical refactors and migrations.

🦆 DuckDB now runs Java table functions LINK

DuckDB's Java client can now register table functions written in pure Java, letting you expose any JVM-reachable data source as a SQL table function and query it alongside local Parquet and CSV files in one statement.

Previously a custom source meant shipping a C++ extension with a complex toolchain and the risk of a native crash segfaulting the JVM; a pure-Java function is now an ordinary Maven dependency, and Kotlin, Scala, or Clojure work too.

Registration uses the DuckDBFunctions.tableFunction() builder, and implementations follow DuckDB's native lifecycle-bind, init, and apply-streaming rows into typed vectors 2048 at a time so results never fully materialize in memory.

Other news you might like

• Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer ImpactLINK

• Windows veteran's vibe-coded Task Manager now also runs on Mac and Linux — downloadable app is the result of a 107-page spec fed to Claude CodeLINK

• Microsoft: August updates break printing, PDF export in WPF appsLINK

• The 28-year fight over who owns Linux is nearly overLINK

• His headphones kept cutting out, so he read the AliExpress codeLINK

• Nuxt 4.5: Experimental SSR Streaming, Vite 8 and an Rsbuild-Powered Rspack BuilderLINK

🧰 Trending tools

AnySearch: queries multiple trusted sources in parallel for AI agents, returning filtered, de-duplicated results as structured data ready for use.LINK

Prefactor: an evaluation layer that scores agent runs in real time, catching quality regressions and drift before they hit production users.LINK

Humalike x Hermes: adds turn-taking, timing, and memory APIs so AI agents know when to speak, wait, or interrupt during conversations, ideal for game characters and roleplay.LINK

Coldtea.ai: automates QA and monitoring with AI agents that catch post-deployment bugs, flag issues, and generate actionable fix tasks for your teamLINK

Kane CLI: an agentic AI quality engineering platform that plans, authors, executes, and analyzes software tests across web, mobile, and enterprise apps on real devices.LINK

Openbase: helps developers choose npm and open-source packages by comparing popularity, maintenance activity, and reliability metrics alongside real user reviews.LINK

📚 Trending papers & reports

Testing tool for AI agents automatically flags not just dangerous failures but also cases where a decision-making agent settles for less-than-best choices, by pitting it against a rival trained on its own behavior.LINK

Copy-paste friction is a deliberate design tactic that lets AI coding tools stay helpful while making it harder to blindly paste generated code, nudging developers to actually review and edit before shipping.LINK

Fake software packages in AI code get reduced by grounding the model in real package lists, though hostile prompts can spike these dangerous invented dependencies by up to 45 points, exposing a real supply-chain risk.LINK

Manufacturing data trust stitches eleven factory systems into one queryable record that proves whether data was valid, where it came from, and how decisions used it, giving fully auditable factory decisions.LINK

Reusable agent skills quietly go stale after each software update, and even top AI agents catch only ~30 to ~70 percent of the outdated instructions when asked to refresh them, leaving agents acting on obsolete guidance.LINK

See you tomorrow for a new dose of ☕️ Devshot!