← Education
Writing · November 2026

What I'd teach now that agents write the code

Don Balanzat

This fall I made three short interactive lessons: Ask Once, on dynamic programming, Back Up, on backtracking, and The Untrusted Page, on agent security. I designed these lessons, set the learning goals and checked every claim; AI coding agents wrote the code from specs I directed and approved.

Working that way, I have come to think someone learning to code still needs two things. The first is a sense of how systems fit together, and enough curiosity about how a technology works to follow what an agent did and decide whether to trust it. The second is judgment about what good and success mean for the thing being built. Part of that judgment goes into tests, and part of it is how the finished thing feels to use.

The first need shows in a July 2025 story. Jason Lemkin, the founder of SaaStr, was testing Replit's AI coding agent. During a code freeze it deleted his production database, then told him a rollback would not work. He got the data back anyway. Someone who cannot picture how a database and its backups fit together has no reason to doubt a report like that. I would teach people to decide what they need to see before believing a claim, then go and look.

For the same reason, I think classic algorithms are more worth teaching now, because a beginner will review far more code than they write, and it is hard to review an idea you have never traced. In Back Up the learner paints a small map with a thumb, hits a dead end, and backs up before building the search in Python. The lesson turns on one line, the undo that takes a paint off when the rest of the map fails. Without it, the function says a map the learner just finished has no solution, yet on an easier ordering it finishes anyway, so a quick test would pass it. An independent review I ran on the build found that its editor let a learner drop the undo inside an if, where it never runs, and the end-to-end test had passed only because its script pressed Backspace for the learner.

Ask Once does the same for dynamic programming. The learner draws a courier's routes across a grid, finds the rule that makes counting them cheap, and assembles it as a short recursive Python function. It gets the right answer, 70 routes, and asks 139 questions on a grid of 25 corners. If the learner then stores answers in a memo but never checks it first, the answers stay right and all the work still happens. Only when the function checks before it computes does the count fall to 33. A test that looked only at the answer would pass all three versions, so the lesson's checks count the calls as well.

System design matters most where an agent reads the outside world and takes in your request and a stranger's text as one stream. In 2025 researchers at Aim Security showed that one email could make Microsoft 365 Copilot leak private data with no click from the user. Microsoft fixed the flaw, and there is no evidence it was exploited in the wild. In October 2025 Milad Nasr, Nicholas Carlini and colleagues broke twelve recently published defenses against jailbreaks and prompt injection, with attack success above 90 percent against most. Simon Willison calls the dangerous design the lethal trifecta, where one agent has private data, untrusted content, and a way to send data out.

The Untrusted Page has the learner build that design, plant one line in a web page it reads, and watch the assistant forward an invoice to a stranger. Then they rewire it until no outside text can reach a block that acts. Building it also tested my spec. The brief I approved gave two wrong answers on the final question the same feedback, "safe, but you gave up a skill." When an agent built the engine from that brief and ran it, one of them turned out to be unsafe, because calendar invites still reached the part that could delete files. I would rather learn that from a run than from a learner.

The second need, judgment, is harder to teach, and the cost of lacking it already shows. In January 2026 the curl project ended its bug bounty after its founder, Daniel Stenberg, described a flood of AI slop reports and the serious mental toll of sorting through them. A plausible report costs almost nothing to produce now, and judging it still takes someone who knows the code. Feel is harder to test. My earlier lessons in physics (Observatory) and geometry passed their tests and still asked too much of a learner at once, so both now have a step-by-step path through every lesson.

In my lessons the learner does a thing before the lesson names it. Back Up uses the word backtracking only after the learner has done it twice, once with a thumb and once in Python. I taught university physics labs for years, and I still trust the order a good lab follows: measure first, explain after. At Zillow, where I lead AI enablement, the agent training I built checks by telemetry that people actually ran the workflow instead of asking whether they did. I hold my lessons to that standard too.

Sources

Play the lessons →