# Week 12: Ask me anything

> The final lecture, run as an AMA from the questions you posted to the Ed megathread

start the **recording**

---

# Welcome

---

# Week 12

## Ask me anything

---

## today's beats

two reminders for the final project: images and your README

your questions from the
[Ed megathread](https://edstem.org/au/courses/37070/discussion/3667961)

some final meditations on the final project

questions from the floor

---

## images: bring your own **key**

the course's image credit has run out, so strproxy no longer generates images

placeholders first, then a free tier (Hugging Face, Pollinations) or a
pay-per-image host (fal.ai, Replicate)

keep the token out of your repo, and the spend is yours:
[generating images](https://comp.anu.edu.au/courses/comp4020-agentic-coding-studio/topics/generating-images/)

---

## Ben uses… a styled image skill

every image on this site/decks: house style from `CLAUDE.md`, a few reference
images, the prompt plus a style suffix, then check it looks ok

have your agent build something similar

---

## the house style, in `CLAUDE.md`

```md
## Image generation style

Prompt suffix: three-colour risograph print in the ANU palette:
a warm ANU gold (#be830e) as the dominant ink with teal-blue
(#0085ad) and burnt copper (#be4e0e) as accent inks, ...

Reference images: src/assets/generated/

Style guide: src/assets/generated/STYLE.md
```

[Replicate's model list](https://replicate.com/explore): models differ a lot on
the same prompt

---

## your **README**

one page with two jobs, published in full at `/readme/`:

**the argument**: what good means for your app, with sources (400--600 words)

**usage instructions**: markers arrive with only the URL and start here, so
everything a newcomer needs goes on this page

---

# your questions

---

## maintaining an app your agents built

(agent changes pass the tests but add duplication and complexity: what catches
that?)

**writing code is cheap, owning it isn't**:
[Willison](https://simonwillison.net/guides/agentic-engineering-patterns/code-is-cheap/)
and the [HN thread](https://news.ycombinator.com/item?id=47125374)

**each change looks fine on its own**: the agent sees the diff, not the design
([HN](https://news.ycombinator.com/item?id=46765460))

**refactoring is a task too**: ask for a deduplication pass, with the tests
underneath ([HN](https://news.ycombinator.com/item?id=47865661))

---

## Ben's reflection

agents are just as good at maintenance as at hacking out greenfield prototypes;
it's up to **you** to decide where the time and effort go

---

## your own engineering judgement

(if the agents out-code you, where should your learning go?)

**Kent Beck**: "It's the first derivative of your productivity that we're
looking for"
([May](https://newsletter.kentbeck.com/p/hey-n00b-we-didnt-hire-you-to-complete))

**Ankur Sethi** retypes every change his agent proposes: "I value comprehension
over productivity"
([August](https://ankursethi.com/blog/prevent-cognitive-debt-by-manually-retyping-llm-generated-code/))

**Felix Rieseberg** dropped coding interviews from his Anthropic team: "Hunger
beats tenure"
([this week](https://felixrieseberg.com/hunger-beats-tenure-advice-for-junior-engineers/))

---

## Ben's reflection

the agents _will_ get better; who knows when they'll plateau?

the best way to practise and develop your engineering judgement is to make stuff
and show it to others (hey, like in this course!)

---

## the black-boxing of code

(should we still read the code?)

**the agent writes it**: Spotify's best developers, since December
([TechCrunch](https://techcrunch.com/2026/02/12/spotify-says-its-best-developers-havent-written-a-line-of-code-since-december-thanks-to-ai/));
Claude Code's lead, 100%
([Fortune](https://fortune.com/2026/01/29/100-percent-of-code-at-anthropic-and-openai-is-now-ai-written-boris-cherny-roon/))

**nobody reads it**: StrongDM's [software factory](https://factory.strongdm.ai/)
bans human review (February); Delinea bought StrongDM in March, and the
factory's [model log](https://factory.strongdm.ai/weather-report) last changed
in September

**in between**: Willison no longer reviews
[every line](https://simonwillison.net/2026/May/6/vibe-coding-and-agentic-engineering/),
but is still accountable for all of it

---

## Ben's reflection

I'm at (pretty much) 100% for code, although writing not so much (don't lose
your voice!)

you should still be able to whiteboard the system architecture

---

## Ben's reflection

for anything medium-sized or bigger: one session to talk it through, weigh the
trade-offs and write the plan to a markdown file

then a fresh session: "review this plan"; it always catches something

beyond that, you don't need to get much fancier

---

## how my thinking shifted this semester

**vaguer provocations, thinner starter repos**: working out what to build, and
what the harness needs, is most of the job

**more ambitious software**: Dan Luu, this week:
[We should be more ambitious with the software we build](https://danluu.com/ambitious/)

> people are implicitly carrying around a pre-agentic cost model

---

## security, when anyone can ship

**PHP2Shell** (21 October): two unauthenticated remote code execution bugs, CVSS
9.2, exploited in the wild
([Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote));
PHP 5.4--7.3 get no fix

**found with AI**: Calif, OpenAI and Wiz reported them; PHP now scans its own
code with Claude Mythos
([PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/))

**Node.js** (same day): ten CVEs, the worst found by OpenAI Codex Security
([release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases))

---

## vulnzero

> As bad as things have gotten in the past 4 days, they are going to get a lot
> worse before they get better … (We need to hold on for \~18 months.)

(Jason Clinton, Anthropic's deputy CISO, 22 October;
[reported here](https://officechai.com/ai/things-will-get-worse-before-they-get-better-anthropic-deputy-chief-information-security-officer-on-recent-cyber-incidents/))

and after 18 months: "vulnzero", with small, cheap models stopping software from
shipping security bugs at all

---

## Ben's reflection

overall the security situation will get **better** (maybe not vulnzero? who
knows)

make security one of the things you explicitly consider in your design and
development work

---

## final meditations on the final project

the marker looks for one idea of good in the README, `CLAUDE.md`, `spec/` and
the app

the median answer (a chat room with the nouns swapped) marks down

when the agent gets something wrong, show the fix landing in `CLAUDE.md` or
`spec/`

---

## how the final project is **marked**

the final project is worth 40%, as much as A1 and A2 combined

COMP4020: process 50%, app 25%, response 25%

COMP8020: process 35%, app 20%, response 20%, research note 25%

it's marked against the same bands as A1 and A2, but on a much bigger thing, so
high marks are hard to get
([details](https://comp.anu.edu.au/courses/comp4020-agentic-coding-studio/assessments/final-project/#how-its-marked))

---

## after the **course**

your repos in the course GitHub organisation stay where they are

you've got at least a month after the course finishes to move anything you want
to keep

---

## the **research project**

the study uses data you already generate: commits, telemetry, work, marks

**to opt in**: Canvas, Start here module,
[Research participation (voluntary)](https://canvas.anu.edu.au/courses/9938/pages/research-participation-voluntary),
then the two-minute consent form

a Data Custodian holds the responses; I can't see yours until after final grades

yes, no or ignoring it changes nothing about your marks, and you can change your
answer until the data is de-identified

---

## an **interview** with Anthropic

(separate from the research project)

Anthropic would like to interview students about this course

if you're up for it, tell me after the lecture or DM me on Ed

---

## deadline radar

**noon Monday 9 November**: the final project is due

**11am--3pm Wednesday 11 November**: the final project showcase in the Birch
building (optional)

(part of the School of Cybernetics'
[Cybernetics Showcase](https://events.humanitix.com/cybernetics-showcase-111126);
free, but register)

---

# any last questions?

---

# Thank you

## see you at the showcase

Source: <https://comp.anu.edu.au/courses/comp4020-agentic-coding-studio/lectures/week-12/>\
Licence: [CC-BY-NC-SA-4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/)\
Cite as: Swift, B. (2026). _COMP4020/COMP8020 Agentic Coding Studio_ [Course materials]. ANU School of Computing. https://doi.org/10.5281/zenodo.21395760