---
title: 'In the News: October 22, 2026 (Midday)'
description: "A developer's unattended coding loop opened 82 PRs in 13 days without merge rights, and a pre-PR checklist shows what it does and does not predict."
canonical_url: 'https://darkfactory.dev/news/2026-10-22-midday'
markdown_url: 'https://darkfactory.dev/news/2026-10-22-midday.md'
collection: news
date_published: '2026-10-22T13:30:00-04:00'
date_modified: '2026-10-22T13:30:00-04:00'
---

# In the News: October 22, 2026 (Midday)


An independent developer has published two weeks of numbers from an overnight coding agent that is denied the right to merge. A second practitioner published a pre-PR question list with a null-result evaluation attached. And curl's maintainer reports that AI-assisted vulnerability reports are now accurate and arriving in the hundreds.

## 1. A nightly coding loop opened 82 PRs in 13 days and merged none of them

**[The nightly Ralph loop](https://cloudwired.dev/notes/the-nightly-ralph-loop)** · Peter Vanhee · Cloudwired, October 22, 2026

Vanhee runs headless Claude Code against GitHub issues labelled `ready`, one issue per PR, on an always-on laptop. By his count the loop has opened 82 PRs across six repositories in 13 days; he merged 74, seven are open, and the loop merged none because `gh pr merge`, `git push origin main`, `npm publish` and similar commands are on a deny list at the permission level. A 23-line script reads his subscription usage and ends the night when a threshold trips; if it cannot read the numbers it reports 100% and stops. He reports 70 of the 74 merged PRs landed within a day of opening, with a median change of 277 lines. His stated failure modes: batches of its own PRs colliding on shared files, and a review pass that counted the loop's own comments as his feedback, so 12 of 17 revision passes pushed nothing.

The post carries first-party numbers but no linked repository, so the figures are his and cannot be reproduced from the page. Vanhee credits Geoffrey Huntley for the Ralph loop.

**Why it matters:** The safety design here is the part to copy: the human controls the queue, merging is denied by permissions rather than asked for in a prompt, and the agent is told that "A clear question is a good night's work." It also shows that an unattended loop needs its own review cycle, since most of his rules came from reading the loop's logs.

## 2. A pre-PR checklist cut one contributor's unmerged PRs from 62% to 14%, and does not predict anyone else's

**[ask-before-you-pr](https://github.com/NickyHeC/ask-before-you-pr)** · Nicky (NickyHeC) · GitHub, October 2026

The repository is a question list, packaged as a skill for Claude Code and Codex, to run before a pull request opens. The author's own numbers on the smol machines organization's repositories: the share of closed PRs that went unmerged fell from 62% in August to 14% in October, and the share of changed lines that never merged fell from 47% to 3%. Merged output stayed near 0.7 to 0.85 PRs a day, so the questions stopped wasted work rather than speeding up merged work. The author states the limits: one person, no control group, and growing familiarity with the project.

The evaluation directory also reports three studies on other projects (Godot, ollama, excalidraw, helix, nest, SvelteKit, Vue). Scoring outside contributors' PRs against the questions did not separate merged from rejected ones; none of the studies met the bar the author set (Fisher p < 0.05 and a 20-point gap). The directory includes the scores and an `analyze.py` script that, per the README, reproduces the study numbers. This run read the README and results tables but did not run the script.

**Why it matters:** The author's own conclusion is that the questions work as a check on your own change, not as a filter for other people's. Teams scoring agent-written PRs against a checklist before review should treat that result as a warning: a checklist that did not predict merges across 783 outside PRs is a weak gate.

## 3. curl's maintainer: AI vulnerability reports are now accurate, and every recent one involved AI

**[“ignore the slop”](https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/)** · Daniel Stenberg · daniel.haxx.se, October 22, 2026

Stenberg, who maintains curl, writes that "Since spring 2026 the slop reports are practically gone" and that the project's problem is now "high volume, high quality." In the last few months curl has received hundreds of vulnerability reports and, by his account, every one had AI involved to some extent. The reports are typically accurate but very long, and AI still misjudges where a bug ends and a vulnerability begins, and how severe it is. He says reproducers and proofs of concept, once the hard part of reporting, are now often a prompt or two.

He argues the project cannot ignore AI-found reports, partly because some maintainers sell curl support and have contractual obligations to customers. The counts are his own and approximate, and the post gives no breakdown by severity or outcome.

**Why it matters:** The cost has moved from filtering false reports to triaging real ones at volume. Maintainers and security teams should plan for report length and severity misjudgment, not for hallucinated bugs.