I think it’s really interesting that at the same time postgres is delayed because agents are finding so many more vulnerabilities than normal reviewers, we have people crying that the same code those agents review is slop.
There is a big difference between having agent review a codebase that several people know very well and have a good understanding of, and a vibecoded project where knowledge of the codebase is basically nil. This is especially true for safety critical software where oversight in the codebase can have dramatic consequence. How can a contributor fix a vulnerable subsystem if he does not even know that the subsystem exist ? This means being entirely reliant on agent to be able to find those flaws and to code without them.
Sure, but that’s like saying you need to be able to rely on a hammer to be able to hit a nail so you can stop using rocks instead.