---
title: 'In the News: November 3, 2026 (Extra)'
description: 'Electric Twin reports that an agent-reviewed software factory drew 1 pen-test finding against 7 for a human-reviewed product. The figures are self-reported.'
canonical_url: 'https://darkfactory.dev/news/2026-11-03-extra'
markdown_url: 'https://darkfactory.dev/news/2026-11-03-extra.md'
collection: news
date_published: '2026-11-03T10:05:00-05:00'
date_modified: '2026-11-03T10:05:00-05:00'
---

# In the News: November 3, 2026 (Extra)


Electric Twin published numbers from an agent-run software factory in which an agent review panel, not a person, clears most changes. Separately, Metaview describes moving every one of its product agents onto a single shared harness, with the agent loop running inside the sandbox.

## 1. Electric Twin says its agent-reviewed factory merged 564 PRs in 13 weeks and had 1 pen-test finding against 7 for a human-reviewed product

**[Electric Twin's software factory](https://www.electrictwin.com/blog/software-factory)** · Jordan Smith, software engineer, Electric Twin · Electric Twin blog, November 2, 2026

Smith writes that every code change at Electric Twin goes to an agent-run review panel, which escalates to an engineer when reviewers cannot agree or flag a serious risk. In the 60 days to September 22 the panel cleared 83% of reviews and referred 17%. Auto-merge was switched on September 10; 39% of backend merges have been automatic since, and the post puts the week of October 5 at 50%. The team's stated hypothesis was 80%. With one dedicated engineer, the factory merged 564 PRs in 13 weeks, a median of 27 a week and a peak of 145, excluding Dependabot updates. Areas the team calls "arches" still need human review regardless of the panel's verdict.

On security, the company says it put its two core products through the same independent penetration test. The post reports one vulnerability in the factory-built product and seven in the product built with human review of every change. The post does not name the tester or publish the report.

The most reusable part is a failure the team describes. A scheduled security scan ran green for a week; an engineer grew suspicious, ran a one-off audit, and confirmed real vulnerabilities. The team then required each check to show that it ran to completion, reported its own coverage against the full required scope, and confirmed the work matched the behavior the task required.

**Why it matters:** A green check that does not report what it covered looks the same as one that covered everything, and the post's own example shows a person catching what the automation missed. Treat the headline numbers as one company's claim: they come from a single pen test across two different products, and the report is not public.

## 2. Metaview says all of its agents now run on one shared harness, and a new agent takes under two hours to stand up

**[How we built one harness for every Metaview agent](https://www.metaview.ai/resources/blog/how-we-built-one-harness-for-every-metaview-agent)** · Isaac Mond, Metaview · Metaview blog, November 3, 2026

Metaview builds recruiting agents. Mond writes that its earliest agent ran on AWS Step Functions and later ones used LangGraph, the OpenAI Responses API and hand-rolled loops. They now share one harness built after Ramp's Inspect background agent: a Cloudflare Durable Object per session for state and streaming, a Modal Sandbox running OpenCode as the loop, and a broker on AWS Lambda that holds the credentials. The sandbox holds none, and the agent calls the broker with a short-lived session token. Mond says a new agent is now a prompt, some skills and a small config, down from several days to under two hours.

Two choices cut against common advice. The agent loop runs inside the sandbox, which Mond says goes against the popular approach of keeping the loop outside, and most tools ship as scripts the agent can chain and edit. Metaview also decided against a hosted agent platform, citing lock-in to one lab's models and limits on customizing the loop; the model is a config value, and the post names a one-line switch between Opus 5.5 and GPT-6.1 Sol. Evals judge outputs only: an orchestration agent drives real sessions, and one Sourcing prompt change was checked against over 1,000 real requests.

**Why it matters:** This is a worked answer to where credentials live when the loop runs next to the code it executes: in a broker, not the sandbox. It is a company's description of its own system. The post gives no public code and no measured results beyond setup time and the request count above.