Sept 30, 2026 · AI & DevOps · Ruby vs Python
Slop Grenades & Dots: The Same Week AI Agents Got Braver and Ruby’s Maintainer Got Warier
On Sept 29, OpenAI shipped Dots — always-on agents that claim bugs in Slack, investigate them, and open pull requests with nobody watching. Five days earlier in Austin, Rails’ chief maintainer Aaron Patterson stood on stage and warned engineers about exactly that: 2,000-line AI-generated pull requests he calls “slop grenades.” Try both sides below before you decide who’s right.
OpenAI’s new Dots (announced at DevDay, Sept 29 2026) work independently between conversations — they pick up tasks in Slack, write and test code, and open PRs on their own. Step through a realistic run, then decide whether to approve its work.
This is a realistic AI-generated Ruby PR — a rate limiter, 24 lines, looks clean at a glance. Aaron Patterson’s “As-If Rule” argument: a compiler proves its optimizations preserve behavior; an AI model just predicts plausible-looking tokens. Somewhere in here are 3 bugs that would ship if nobody reads the diff. Click the lines you don’t trust, then check your work.
What backs up “hand-review still matters”
Aaron Patterson polled a room of hundreds of engineers at Rails World: who’s received a 2,000-line, unreviewed AI-generated PR? Two or three hands went up. His point wasn’t “don’t use AI” — it’s that generation is now free and review is still the bottleneck.
Same Rack request loop. ZJIT’s higher-level IR cut allocations from ~1,000 to 8 — a number Patterson used to argue Ruby’s runtime, not just AI tooling, is where 2026’s real engineering is happening. Ruby 4.1 adds Ractors for true parallel execution with isolated GC; Ruby 4.0’s interpreter inlining made method calls ~70% faster on allocation-heavy code.
What backs up “let the agents run”
OpenAI’s Codex Security Cloud (also shipped Sept 29) scans repos on demand, investigates findings itself, and prepares fixes — no human triage needed to start the work. Codex Cloud now persists tasks across laptop, phone, and browser, with the same tool access in every environment.
Before you approve an autonomous agent’s PR
A practical checklist, synthesized from both talks — copy it into your PR template.
- Is the diff small enough that a human actually read every line — not skimmed it?
- Does it touch anything with side effects across a network boundary (payments, auth, rate limits, currency)?
- Did the agent’s own tests exercise the new branch, or just confirm the old ones still pass?
- Would you bet your on-call week that this preserves behavior the way a compiler’s As-If Rule would — or are you trusting English?
- If it’s wrong, how many minutes to notice vs. how many minutes it just saved you?