Are AI coding agents reliable enough to ship to production in 2026?

Are AI coding agents safe to ship to production yet?

For narrow, well-scoped tasks behind tests and human review, yes — Forge showed an 8B model going from 53% to 99% on agentic tasks with the right guardrails. For autonomous, long-horizon work without checkpoints, no. Daniel Kahneman would call this a System 1 problem: agents look confident long before they are correct.

The trigger for this question was a strange week on Hacker News. Inside seventy-two hours we got the Forge launch claiming an 8-billion-parameter model could hit 99% on agentic tasks with the right guardrails, the Apache Burr release pitched as the framework for “reliable AI agents,” a story about an AI agent bankrupting its operator while trying to scan DN42, another about an autonomous agent running amok inside Fedora, and a security write-up showing a one-cent bank transfer could compromise a production banking AI assistant. The pendulum keeps swinging from “ship it” to “never ship it” in the same news cycle, and it is making honest answers hard. So here is mine, from someone who has shipped AI-assisted code to paying users and also burned a weekend cleaning up after an agent that lost the plot.

The short version is that reliability is not a property of the model. It is a property of the system around the model. Forge’s headline number — an 8B base model going from 53% to 99% on agentic benchmarks — is striking precisely because the model did not change. The jump came from deterministic guardrails: schema validation on every tool call, retry on failure, hard caps on loops, human checkpoints at structural decisions. That should be the only reaction worth having. The interesting unit of trust is the harness, not the brain.

Daniel Kahneman’s framework from Thinking, Fast and Slow is the cleanest lens I have found for what is actually going wrong. Modern coding agents are extraordinarily good at System 1 — pattern recognition, plausible code completion, confident next-step generation. They are weak, exactly the way humans are weak, at System 2 — checking their own work, noticing what is missing, knowing when to stop. Kahneman’s WYSIATI principle (“what you see is all there is”) describes the agent failure mode word for word. The DN42 story is a textbook case: the agent saw a scanning task, generated a plausible script, executed it with confidence, and never modeled the cost surface it was driving toward. By the time the bill arrived, the System-2 check that any senior engineer would have done in three seconds — “wait, what does this cost at scale?” — had never happened.

So what does this mean for production? It means the same thing it has always meant when delegating to a junior with confident-but-uneven judgment. Narrow, well-scoped, well-tested, human-reviewed work: ship it. I write almost all my non-critical service code with Claude Code or Codex now, against a test suite I wrote myself, and review every diff before merge. The defect rate is no worse than my own, and the velocity is roughly three times higher. Anyone who claims otherwise either has not tried recent agents or is selling something.

Long-horizon, autonomous, blast-radius-unbounded work: do not ship it. This is the line the Fable controversy this week was really about. Security researchers were frustrated not because Anthropic added guardrails, but because the marketing implied autonomy the guardrails were specifically there to prevent. That gap — what the product page promises versus what the system actually permits — is where production incidents live. If you cannot answer the question “what is the worst thing this agent can do in the next five minutes if its reasoning goes off the rails?” with a bounded, survivable answer, the agent is not production-ready, no matter what the benchmark says.

The practical filter I use, borrowed loosely from Radically Human by Paul Daugherty and James Wilson at Accenture, is the “machine teaching” question. Have I taught this agent the specific constraints of the system it is touching — rate limits, cost caps, idempotency requirements, rollback paths — or am I assuming it figured them out from training data? Daugherty’s point in the book is that the highest-leverage AI deployments in real businesses are not the ones with the biggest models; they are the ones where domain experts have explicitly transferred their constraints into the agent’s scaffolding. Forge is doing exactly this at the framework level. Apache Burr is doing it at the orchestration level. Anthropic’s computer-use guardrails are doing it at the model level. They are all the same idea: encode the expert’s System 2 around the model’s System 1.

My honest summary: in mid-2026 I trust coding agents with production code under three conditions — the scope of any single autonomous run is bounded, every irreversible action requires my explicit approval, and a test or simulation exists that the agent must pass before merge. Inside those rails the productivity gain is real and durable. Outside them, the agent is a confident intern with root and an API key, and the news cycle is now full of what that costs.