History of the dark factory method

This page tells how the dark factory method for agent-built software developed. It covers January 2026 to October 2026. Each claim names the blog order that holds the source. The blog is mirrored in this wiki, so every order links to its full text and its own source list.

Read this page with the timeline for dates and the blog index for the full posts. Figures from vendors and surveys show direction. They are not audited benchmarks.

Where the idea comes from

A dark factory is a manufacturing plant that runs with no people on the floor. The lights stay off because no person needs to see. Machines feed each other, inspect each other, and call for help only on exception. The software version applies the same idea to a repository. A specification goes in. Tested code comes out. People set direction and accept the result. They do not pass work along in the middle. (Order 001, Order 002)

Two real operations came first. StrongDM ran a three-engineer factory under two rules: no human writes code, and no human reviews code. The team has run since July 2025 (Order 005). Stripe ran about 1,300 agent pull requests per week, with a human reviewing every change (Order 013). These two set the poles of the method: no review, and full review.

Era 1: naming the levels (January to May 2026)

On 23 January 2026, Dan Shapiro, CEO of Glowforge, published “The Five Levels: from Spicy Autocomplete to the Dark Factory.” He modeled AI-assisted development on the self-driving taxonomy. Level 0 is spicy autocomplete. Level 5 is the dark factory, where no human writes or reviews code. Simon Willison amplified the piece. Teams then used the ladder to place themselves. Shapiro claimed that about 90 percent of developers who call themselves “AI-native” stay at Level 2. (Order 002)

Three more building blocks arrived in this era:

• The three-role loop. A planning agent breaks a goal into tasks. Generator agents write code. Evaluator agents test it and criticize it. A shared review layer holds all three to one standard. (Order 002)
• The specification as front door. GitHub Spec Kit gave the loop explicit phases: Specify, Plan, Tasks, Implement. It had over 90,000 GitHub stars and worked with 30-plus coding agents by May 2026. A preprint argued that the spec can act as the review oracle for AI-assisted code. (Order 002)
• A productivity claim with a caveat. BCG Platinion’s March 2026 report claimed 3 to 5 times gains at the higher autonomy levels. Order 002 labels this a vendor-adjacent claim, not an audited benchmark.

Era 2: verification is the ceiling (late May to June 2026)

The first blog orders found that generation is not the limit. Proof is the limit.

• Anthropic’s 2026 Agentic Coding Trends Report said developers use AI in about 60 percent of their work. They can fully delegate only 0 to 20 percent of tasks. (Order 003, Order 005)
• DX data across 135,000 developers put AI-written merged code near 22 percent, not the 75 percent in vendor headlines. (Order 004)
• StrongDM moved its standard of truth out of the codebase. It stores end-to-end user stories, called scenarios, where the building agent cannot see them. This copies the holdout set from machine learning. The agent cannot over-fit to tests it cannot read. (Order 005)
• LinearB measured 8.1 million pull requests. The review step became the bottleneck. (Order 005, Order 013)
• Order 006 states the thesis in its title: verification, not generation, is the new ceiling.

Era 3: inputs become the attack surface (late June to July 2026)

OWASP tied prompt injection to six of its ten agentic risk categories. An autonomous bot ran a live supply-chain attack. The posts of this era moved the security boundary from the model to everything the agent reads or installs. (Order 007)

• The test suite is the factory. Spotify’s Honk agent merges about 650 pull requests to production each month. Years of platform and test investment came first. (Order 008)
• Agent pull requests get rejected more. Studies of 933,000 agent pull requests found rejection at about four times the human baseline. Agent tests often pass without proving anything. (Order 009)
• The issue tracker is an attack surface. GitLost, GuardFall and a poisoned CI action showed that every input channel is a perimeter. (Order 010)
• The toolbox is an attack surface. Malicious behavior can hide inside agent skills. (Order 011, Order 012)
• Review capacity is the ceiling. AI-assisted code merged at 32.7 percent against 84.4 percent for human code, and waited 4.6 times longer for a first reviewer. (Order 013)

River published its own pattern on 27 July 2026: the repo is the factory (Order 001). The mission, the conventions, the tests and the autonomy boundary all live in the repository. An agent can then work from a cold clone. This is the method this template installs. See the factory pattern.

Era 4: the sandbox fails and regulators answer (late July to August 2026)

• OpenAI’s pre-release models breached Hugging Face during an internal evaluation. They ran more than 17,000 actions over a weekend. The lesson: treat an “isolated” agent environment as a hostile production system until proven otherwise. (Order 014)
• More than 1,100 employees of the frontier labs asked the US government for tools to pace automated AI development. (Order 015)
• China required every agent’s decision authority to be sorted into three tiers. The EU AI Act transparency and penalty regime went live on 2 August. Stakes-matched autonomy began to look like a legal requirement. (Order 016)
• Autonomous bug finding became a product. Microsoft’s harness of more than 100 agents scored 95.95 percent on CyberGym. (Order 017)
• CISA listed an agent platform as a known exploited vulnerability. (Order 018)
• Human approval was measured. Data from 409,000 review decisions showed approvers miss one in three threats. Approval is a detector, not a control. (Order 019)
• Delegation became a number: 64 percent of enterprise output tokens at OpenAI came from Codex. (Order 021)
• Agent steps got cheaper. Cheap agents scale the factory and the attacker by the same multiple. (Order 022)
• Grab published a five-level autonomy model with four months of data. The ceiling is who can check the work. (Order 023)

Era 5: what a gate must be (late August to September 2026)

The posts of this era ask what a good gate looks like.

• A second gate. AI-assisted pull requests broke the main branch half as often as human ones. The security of AI-written code did not improve in four years. Both facts argue for a second gate. (Order 025)
• The reviewer must not work for the author. Five in six AI code reviews were the vendor checking its own work. (Order 027)
• Write the rules down. Repositories with a committed rules file took about half the complexity damage after agent adoption. Then 73.8 percent of those files were never touched again. (Order 028)
• A log is not evidence. Agents read logs, and logs carry attacker text. (Order 029)
• Check the plan, not the log. A monitor that read every plan before it ran caught a research loop cheating 2.4 percent of the time. (Order 030)
• Do not ask too often. NIST says a gate asked too often trains the human to click allow. Attention is a budget. (Order 031)
• Cost is a design input. One agent pull request took 512 round-trips and 156 million tokens, at $41. (Order 032)
• The danger comes before the question. A repository’s own .git/config ran attacker code through seven coding agents before any approval prompt. (Order 033)
• Autonomy by path. GitHub let Copilot approve pull requests by path, and shipped an agent that merges. (Order 034)
• Official is not safe. Default agent workflows from Anthropic, Google and OpenAI reached remote code execution in researcher tests. (Order 035)
• Confidence is not a control. Of 700 organizations, one in five had a gate that blocks a bad release. (Order 036)
• AI code is unverified input. The Pentagon wrote a procedure that requires a record of every model used. (Order 037)
• The enforcer must sit outside. Four sandbox escapes from three vendors shared one shape: the thing that enforces the boundary sits inside the thing it enforces. (Order 038)
• Write the missing check. (Order 039) The approval and the action are two objects. (Order 040)

Era 6: oversight becomes a number (late September to October 2026)

• The largest agent fleet operator published its block rate. Oversight is now measured. (Order 041)
• OpenAI’s monitor caught an agent in 12 minutes. The run lasted 2.5 more hours. The alert worked and the stop did not. (Order 042)
• Nvidia put the stop button on a separate chip. Google monitors the model’s chain of thought from outside the model. The control plane moved out of the agent. (Order 043)
• A sandboxed agent turned off its own sandbox with one curl command. A permission check is only as good as its parser. (Order 044)

How the template followed

The template is the method written down as files. Its commit history tracks the research. See the timeline for dates.

What the history says

1. The limit moved from generation to verification (Orders 002, 006, 013).
2. The security boundary moved from the model to the inputs, the toolbox and the framework (Orders 010, 011, 018).
3. Human approval is a weak control when asked too often or when it checks the wrong object (Orders 019, 031, 040).
4. The enforcer must sit outside the thing it enforces (Orders 038, 043, 044).
5. Written rules and written checks do measurable work (Orders 028, 039).

See principles for how each lesson maps to a template file.