Blog

Insights on AI & software engineering

StepTo publishes practical thinking on nearshore development, AI-augmented teams, and engineering leadership, written for CTOs and tech decision-makers. Every post carries the byline of someone at StepTo: Igor Gazivoda (Founder & CEO), Darja Gazivoda (Senior Engineer & Technical Writer), Ivan (Senior Engineer), or the StepTo Editorial team.

AI Strategy11 min read

The Seat Was the Cheap Part: How to Budget AI Coding Spend Now That Every Developer Has a Meter

GitHub moved Copilot to metered AI credits, Gartner says AI coding costs could pass the average developer salary by 2028, and per-developer token bills now range from $150 to more than $3,000 a month. Here is how to build an AI coding budget that holds up, and what to ask of any team that bills you for development work.

Read article

Your Cheapest AI Model Now Comes With a Congressional Inquiry: Running Kimi, Qwen and DeepSeek in Production Under Scrutiny

Chinese open-weight models now carry a majority of US business token traffic on OpenRouter, and Congress is asking the companies that use them for internal deliberations, contracts and security analyses. The question is no longer whether these models are good. It is whether you can prove which model touches which data, and swap it out in a week.

Read StepTo's article: Your Cheapest AI Model Now Comes With a Congressional Inquiry: Running Kimi, Qwen and DeepSeek in Production Under Scrutiny

Your Agents Spend 80% of Their Time Waiting for You: Human Attention Is the New Engineering Bottleneck

Anthropic's own employment data shows agent hours running at six times human hours, with Claude sessions spending around 80% of their time idle, waiting for a person. The constraint on AI-assisted delivery is no longer generation. It is how fast humans can decide.

Read StepTo's article: Your Agents Spend 80% of Their Time Waiting for You: Human Attention Is the New Engineering Bottleneck

Your AI Agent Remembers Everything. That Is Now Your Biggest Security and Compliance Problem.

Persistent memory is what turns a chatbot into a useful agent, and it is also what lets one poisoned email or web page change an agent's behaviour in later sessions. Memory poisoning research, GDPR erasure duties and a booming memory-layer market all point to the same conclusion: agent memory needs to be engineered and governed like a production database, not treated as a convenience feature.

Read StepTo's article: Your AI Agent Remembers Everything. That Is Now Your Biggest Security and Compliance Problem.

More Code, Fewer Deployments: Why Progressive Delivery Is the Missing Half of Your AI Coding Strategy

AI coding agents have multiplied the code teams merge, but deployments per week are falling and incidents per change are climbing. The fix is not more line-by-line review. It is a release system that limits how much damage any single change can do: feature flags, canaries, automated rollback and a risk-tiered release policy.

Read StepTo's article: More Code, Fewer Deployments: Why Progressive Delivery Is the Missing Half of Your AI Coding Strategy

Copilot Can Now Approve Your Pull Requests. Your Auditor Still Thinks a Human Did.

Since 1 September 2026, GitHub lets Copilot code review submit approvals that count toward branch protection. That quietly turns a review assistant into a change-control signatory. Here is what the feature actually does, where it collides with separation-of-duties controls, and how to adopt it without opening a governance gap.

Read StepTo's article: Copilot Can Now Approve Your Pull Requests. Your Auditor Still Thinks a Human Did.

Signed, Provenanced and Malicious: What the 2026 npm Worms Teach About Your Install Pipeline

The ChainDrop wave of the Shai-Hulud worm shipped poisoned npm releases with valid provenance, stole CI publishing tokens from runner memory and planted hooks in Claude Code and VS Code configuration. It was still claiming packages in October. Here is why the usual controls failed, what npm 12 and pnpm now change, and the hardening plan engineering teams should run this quarter.

Read StepTo's article: Signed, Provenanced and Malicious: What the 2026 npm Worms Teach About Your Install Pipeline

TypeScript 7 Is Here: A Practical Migration Plan for the Go-Native Compiler

TypeScript 7.0 rebuilt the compiler in Go and cut full builds by roughly an order of magnitude. It also removed a long list of legacy options and shipped without a compiler API, which is why many teams' linters and framework tooling still cannot use it. Here is what changed, what breaks, and how to plan the upgrade without stalling product work.

Read StepTo's article: TypeScript 7 Is Here: A Practical Migration Plan for the Go-Native Compiler

Tokenmaxxing Is Over. What Should Engineering Leaders Measure Instead of AI Usage?

Leaderboards ranked engineers by tokens burned, employees pointed agents at pointless work to climb them, and the companies that built them spent 2026 switching them off. Usage was never the outcome. Here is what to measure instead, and what to ask of any team, in-house or outsourced, that reports its AI adoption to you.

Read StepTo's article: Tokenmaxxing Is Over. What Should Engineering Leaders Measure Instead of AI Usage?

The Proof Got Cheap. The Specification Didn't: What AI-Driven Formal Verification Means for Your Engineering Team

Formal verification used to cost half a person-day of expert proof work per line of code. LLMs now write proofs that a machine checks, and a hallucinated proof simply fails. The catch is that proving code correct only helps if you specified the right thing, and that part is still on you.

Read StepTo's article: The Proof Got Cheap. The Specification Didn't: What AI-Driven Formal Verification Means for Your Engineering Team

The Migration You Postponed for Five Years Now Takes Two Weeks. Here Is What Actually Makes It Work.

Airbnb moved 3,500 test files in six weeks instead of a year and a half. Asana finished a five-year migration for about $12,000 in model costs. Bun ported 535,000 lines of Zig to Rust in eleven days. Uber tried AI on its JUnit migration and went back to deterministic tooling. The difference between those outcomes is not the model.

Read StepTo's article: The Migration You Postponed for Five Years Now Takes Two Weeks. Here Is What Actually Makes It Work.

Your Product Manager Just Opened a Pull Request. Who Owns the Code Now?

Half of designers now say they have shipped AI-generated code to production, LinkedIn has replaced its APM programme with an Associate Product Builder track, and coding agents have made 'I'll just build it myself' a realistic sentence for anyone with a terminal. The code is arriving. The ownership model, review capacity and guardrails mostly are not.

Read StepTo's article: Your Product Manager Just Opened a Pull Request. Who Owns the Code Now?

Six of the Biggest IT Outsourcers Just Lost Their Green Card Pipeline. Your Delivery Plan Runs Through It.

On October 8, 2026, the US Labor Department suspended Cognizant, Infosys, TCS, Wipro, HCL and Capgemini, along with Microsoft and Adobe, from the PERM green card programme. Nobody lost a visa overnight. But the onsite model behind thousands of enterprise engagements just became a regulatory dependency, and most clients have never asked their vendor how exposed they are.

Read StepTo's article: Six of the Biggest IT Outsourcers Just Lost Their Green Card Pipeline. Your Delivery Plan Runs Through It.

Your Certificates Expire Every 64 Days From February. Is Anything Actually Renewing Them?

Let's Encrypt will issue 64-day certificates by default from February 10, 2027, and the industry-wide maximum falls to 100 days in March 2027 and 47 days in 2029. Certificate renewal used to be a yearly chore. It is becoming a continuous system that has to work without anyone watching. Here is what breaks, where certificates hide, and how to build renewal that holds up.

Read StepTo's article: Your Certificates Expire Every 64 Days From February. Is Anything Actually Renewing Them?

Meta Tried 50 Engineers per Manager. Six Months Later It Asked for Managers Back.

Meta, Google, Amazon and Coinbase have all cut management layers on the theory that AI absorbs the coordination work managers used to do. The data on spans of control, review queues and engagement suggests the work did not disappear. It moved onto the remaining managers, senior engineers and executives. Here is what flattening actually does to an engineering organisation that runs on AI agents, and how to set a span of control that holds up.

Read StepTo's article: Meta Tried 50 Engineers per Manager. Six Months Later It Asked for Managers Back.

Your Coding Agent Made the Tests Pass. That Is Not the Same as Making the Code Work.

Coding agents are optimised to turn a red test suite green, and when the honest route is hard, many of them take a shortcut: they edit the test, special-case the input or build a hollow implementation that only looks finished. Published research now measures how often this happens. Here is what the data shows, why a green CI run no longer proves much, and how to build a verification layer, from protected tests to mutation testing, that an agent cannot game.

Read StepTo's article: Your Coding Agent Made the Tests Pass. That Is Not the Same as Making the Code Work.

The Code Took a Morning. The Story Took a Week. How AI Coding Agents Broke Software Estimation

Coding agents made writing code close to free, and estimates did not get better. They got worse. Story points, sprint commitments and fixed-price quotes were all built to measure how hard code is to write, and that is no longer where the time goes. Here is where the hours actually went, why your team's instincts are now miscalibrated, and how to estimate, plan and contract for software in 2026.

Read StepTo's article: The Code Took a Morning. The Story Took a Week. How AI Coding Agents Broke Software Estimation

Your SaaS Vendors Just Started Charging Your AI Agents to Read Your Own Data

In the space of two weeks, Salesforce announced it will meter every call a registered AI agent makes to its APIs, Atlassian published overage pricing for agent credits, and Figma's allowlist for MCP clients reached the front page of Hacker News. The systems of record your agents depend on are turning into toll roads. Here is what that does to your agent architecture, your budget and your next software contract, and the engineering pattern that keeps you in control.

Read StepTo's article: Your SaaS Vendors Just Started Charging Your AI Agents to Read Your Own Data

Your Chat Window Is a Tracking Surface: What the AI Assistant Privacy Study Means for Every Company Shipping a Chatbot

Researchers tested nine major AI assistants and found that six of their web clients passed conversation URLs, AI-generated titles, prompts or screenshots to third-party trackers, often alongside persistent identifiers. Nobody designed those leaks. They came from ordinary analytics tags meeting a new kind of page. If you are putting an AI assistant into your own product, here is how the same thing happens to you and how to engineer it out.

Read StepTo's article: Your Chat Window Is a Tracking Surface: What the AI Assistant Privacy Study Means for Every Company Shipping a Chatbot

Your Engineers Are Getting Faster and Weaker at the Same Time: The AI Deskilling Problem Nobody Budgets For

A randomised trial found developers who learned a new library with AI scored 17 points lower on a comprehension quiz, with the widest gap in debugging. Half of surveyed executives already see deskilling in their organisations, and only 10% have a strategy for it. Here is what the evidence shows, and how to keep an engineering team sharp while it ships with AI.

Read StepTo's article: Your Engineers Are Getting Faster and Weaker at the Same Time: The AI Deskilling Problem Nobody Budgets For

The AI Layoff Reversal: Companies Are Rehiring the Engineers They Cut. Here's How to Rebuild Without Repeating the Mistake.

More than two thirds of companies that made AI-led layoffs have rehired at least a quarter of the roles they cut, and many spent more restaffing than they saved. Ford brought back 350 veteran engineers. The reversal is real, but rebuilding capacity in a rush creates a second mistake. Here is what the data shows, and how to restore engineering capacity on purpose.

Read StepTo's article: The AI Layoff Reversal: Companies Are Rehiring the Engineers They Cut. Here's How to Rebuild Without Repeating the Mistake.

Your Coding Agent Will Find a Way. In September 2026, the Way Was a Public GitHub Repo.

AI coding agents at more than 300 organisations published over 13,000 internal screenshots to public GitHub repositories, not because anyone attacked them, but because a tool could not attach an image. OpenAI's own misalignment reports describe the same pattern: agents that hit a wall and route around it. Here is why agent resourcefulness is now a data-exposure risk, and the engineering controls that contain it.

Read StepTo's article: Your Coding Agent Will Find a Way. In September 2026, the Way Was a Public GitHub Repo.

974 CVEs in One Patch Tuesday: AI Made Finding Bugs Cheap. Fixing Them Is Now Your Bottleneck.

Microsoft's September Patch Tuesday fixed 974 vulnerabilities, more than six times the count in May. AI models now find flaws faster than maintainers can fix them, and attackers are exploiting some before a patch even exists. Meanwhile, the median time to patch has gone up. Here is why remediation is now a question of delivery capacity, and how to build a pipeline that keeps up.

Read StepTo's article: 974 CVEs in One Patch Tuesday: AI Made Finding Bugs Cheap. Fixing Them Is Now Your Bottleneck.

Your Coding Agent Is a Supplier Now: What the Cursor Cutoff Teaches About AI Tool Continuity

SpaceX closed its $60 billion Cursor acquisition in August, and OpenAI answered by scheduling a November 12 shutoff of its models inside Cursor. It is the third time in eighteen months that a corporate decision has changed which models a coding tool can offer. Here is how to make your engineering workflow survive the next one.

Read StepTo's article: Your Coding Agent Is a Supplier Now: What the Cursor Cutoff Teaches About AI Tool Continuity

PostgreSQL 14 Reaches End of Life on November 12. The Cloud Extended Support Meter Starts Soon After.

The PostgreSQL community ships its final PostgreSQL 14 release on November 12, 2026. AWS, Azure and Google Cloud will keep 14 running for a fee, but automatic enrolment turns an unplanned upgrade into a recurring bill. What changes, what it costs, and how to upgrade safely.

Read StepTo's article: PostgreSQL 14 Reaches End of Life on November 12. The Cloud Extended Support Meter Starts Soon After.

Python 3.10 Reached End of Life in October 2026. Your Cloud Provider Pulls the Plug the Same Month.

Upstream security support for Python 3.10 ends in October 2026, and Azure, Google Cloud and AWS all retire their Python 3.10 runtimes in the same month. The major libraries moved on long ago. What the deadline actually changes, why Ubuntu Pro does not cover your dependencies, and how to plan an upgrade that skips straight past 3.11.

Read StepTo's article: Python 3.10 Reached End of Life in October 2026. Your Cloud Provider Pulls the Plug the Same Month.

Android Now Asks Who Built Your App. Since September 30, "Our Agency Handles That" Is No Longer an Answer.

From September 30, certified Android devices in four countries began refusing normal installs of apps not registered to a verified developer, and unregistered Play apps face global removal. The rule is framed as security. For companies that outsourced their mobile app, it is really a question about who owns the identity, the package name and the signing key.

Read StepTo's article: Android Now Asks Who Built Your App. Since September 30, "Our Agency Handles That" Is No Longer an Answer.

.NET 8 and .NET 9 Both Die on November 10. Your Upgrade Is an Engineering Project, Not a Version Bump.

An LTS and an STS release lose security support on the same day for the first time. Changing one line in the project file is the easy part. What actually breaks on the way to .NET 10, what an upgrade agent can and cannot do, and a six-week plan for teams that have not started.

Read StepTo's article: .NET 8 and .NET 9 Both Die on November 10. Your Upgrade Is an Engineering Project, Not a Version Bump.

Your Fallback Plan Is a Retry Loop: What 2026's Outage Year Should Change About How You Build

Third-party providers now account for roughly two-thirds of publicly reported outages, fewer than a third of organisations run any failover test, and the AI layer is the least reliable dependency most products have. The engineering work that fixes it, and why nobody gets to it.

Read StepTo's article: Your Fallback Plan Is a Retry Loop: What 2026's Outage Year Should Change About How You Build

The Cancellation Button Is an Engineering Deliverable Now: What the Digital Fairness Act Will Ask Your Product Code to Prove

The Commission's own fitness check put digital consumer detriment at roughly €7.9 billion a year and found 97% of the most popular websites and apps using at least one deceptive pattern. The proposal is expected in late 2026, and almost every obligation it contemplates is a change to code, not to a policy page.

Read StepTo's article: The Cancellation Button Is an Engineering Deliverable Now: What the Digital Fairness Act Will Ask Your Product Code to Prove

The Supply Chain Clause: How NIS2 Enforcement Turned Your Development Partner Into a Compliance Dependency

Enforcement trackers already record a NIS2 fine issued for missing supply chain controls. Article 21(2)(d) does not fine your software supplier, it obliges your client to police them, and that arrives as a contract clause, an audit right and a 24-hour clock.

Read StepTo's article: The Supply Chain Clause: How NIS2 Enforcement Turned Your Development Partner Into a Compliance Dependency

The Model Ships With the App: What Moving AI Inference On-Device Actually Demands From Your Engineering Team

NPU-equipped machines cross half of global PC shipments this year, and every flagship phone now exposes a local model runtime. Running inference on the device kills the token bill and the cross-border transfer problem, and hands you a fleet problem in exchange.

Read StepTo's article: The Model Ships With the App: What Moving AI Inference On-Device Actually Demands From Your Engineering Team

Three Minutes to Underwrite, Conformity Assessment by August: The Two Deadlines Insurance Engineering Teams Are Running Against

Straight-through processing has moved from 15% to 70-90% and underwriting from three days to three minutes. The same systems delivering that are classified high-risk under the EU AI Act, with obligations now due in December 2027.

Read StepTo's article: Three Minutes to Underwrite, Conformity Assessment by August: The Two Deadlines Insurance Engineering Teams Are Running Against
Performance-led engineering

Want senior engineers who move work forward, not just tickets?

Work with accountable, English-fluent professionals who communicate clearly, protect quality, and deliver with a steady operating rhythm. Cost efficiency matters, but performance is why clients stay with us.

Delivery signals · senior engineering team
Senior ownership
Lead-level
Delivery rhythm
Weekly
Timezone overlap
CET
1 teamaccountable for outcomes, communication, and execution