Malicious packages on npm, PyPI, and Ruby exfiltrate wallets, delete projects, and exploit AI tools—threatening developers and CI/CD pipelines.

LLM agents make bad pairs because they code faster than humans think. I'll admit, I've had a lot of fun using GitHub Copilot's agent mode in VS Code (https://justin.searls.co/tubes/2025-04-19-17h46m37s/) this month. It's invigorating to watch it effortlessly write a working method on the first try. It's a relief when the agent unblocks me by reaching for a framework API I didn't even know existed. It's motivating to pair with someone even more tirelessly committed to my goal than I am. In fact, pairing with top LLMs evokes many memories of pairing with top human programmers. The worst memories. Memories of my pair grabbing the keyboard and—in total and unhelpful silence—hammering out code faster than I could ever hope to read it. Memories of slowly, inevitably becoming disengaged after expending all my mental energy in a futile attempt to keep up. Memories of my pair hitting a roadblock and finally looking to me for help, only to catch me off guard and without a clue as to what had been going on in the preceding minutes, hours, or days. Memories of gradually realizing my pair had been building the wrong thing all along and then suddenly realizing the task now fell to me to remediate a boatload of incidental complexity in order to hit a deadline. So yes, pairing with an AI agent can be uncannily similar to pairing with an expert programmer. ## The path forward (#the-path-forward) What should we do instead? Two things: 1. The same thing I did with human pair programmers who wanted to take the ball and run with it: I let them have it. In a perfect world, pairing might lead to a better solution, but there's no point in forcing it when both parties aren't bought in. Instead, I'd break the work down into discrete sub-components for my colleague to build independently. I would then review those pieces as pull requests. Translating that advice to LLM-based tools: give up on editor-based agentic pairing in favor of asynchronous workflows like GitHub's new Coding Agent (https://github.blog/news-insights/product-news/github-copilot-meet-the-new-coding-agent/), whose work you can also review via pull request 2. Continue to practice pair-programming with your editor, but throttle down from the semi-autonomous "Agent" mode to the turn-based "Edit" or "Ask" modes. You'll go slower, and that's the point. Also, just like pairing with humans, try to establish a rigorously consistent workflow as opposed to only reaching for AI for troubleshooting. I've found that ping-pong pairing (https://martinfowler.com/articles/on-pair-programming.html#PingPong) with an AI in Edit mode (where the LLM can propose individual edits but you must manually accept them) strikes the best balance between accelerated productivity and continuous quality control Give people a few more months with agents and I think (hope) others will arrive at similar conclusions about their suitability as pair programmers. My advice to the AI tool-makers would be to introduce features to make pairing with an AI agent more qualitatively similar to pairing with a human. Agentic pair programmers are not inherently bad, but their lightning-fast speed has the unintended consequence of undercutting any opportunity for collaborating with us mere mortals. If an agent were designed to type at a slower pace, pause and discuss periodically, and frankly expect more of us as equal partners, that could make for a hell of a product offering. Just imagining it now, any of these features would make agent-based pairing much more effective: • Let users set how many lines-per-minute of code—or words-per-minute of prose—the agent outputs • Allow users to pause the agent to ask a clarifying question or push back on its direction without derailing the entire activity or train of thought • Expand beyond the chat metaphor by adding UI primitives that mirror the work to be done. Enable users to pin the current working session to a particular GitHub issue. Integrate a built-in to-do list to tick off before the feature is complete. That sort of thing • Design agents to act with less self-confidence and more self-doubt. They should frequently stop to converse: validate why we're building this, solicit advice on the best approach, and express concern when we're going in the wrong direction • Introduce advanced voice chat to better emulate human-to-human pairing, which would allow the user both to keep their eyes on the code (instead of darting back and forth between an editor and a chat sidebar) and to light up the parts of the brain that find mouth-words more engaging than text Anyway, that's how I see it from where I'm sitting the morning of Friday, May 30th, 2025. Who knows where these tools will be in a week or month or year, but I'm fairly confident you could find worse advice on meeting this moment. As always, if you have thoughts, e-mail 'em ([email protected]).

Break bad habits, master Vim motions. Contribute to m4xshen/hardtime.nvim development by creating an account on GitHub.

AI coding tools boost productivity but may sacrifice the flow state and deep satisfaction developers experience when writing code by hand. What are we losing?

Tapbots will still work on Ivory for Mastodon, too.

Google will probably close this loophole soon enough.