A year on from the CISA and NSA memory-safety report, the adoption evidence is still provider roadmaps and practitioner judgement about C and C++ code that nobody proposes to rewrite wholesale.
Reality
- Evidence45
- Adoption35
- Hype gap+20
- Incentives70
- Confidence50
Before judging agent-written code, a dev.to author seeded a small C backup client with eight known behaviors and observed it with system-call traces, a loopback capture and a digest check to see which observer caught what.
Reality
- Evidence48
- Adoption
- Insufficient
- Hype gap−12
- Incentives20
- Confidence55
A C benchmark on Apple Silicon puts a plain loop reorder 6.3x over naive and the best tile size 11% behind that, which suggests the first move on a hot loop is a stride check rather than a blocking rewrite.
Reality
- Evidence55
- Adoption10
- Hype gap+10
- Incentives25
- Confidence58
A writeup of GrahaAPI says the classical math held up and the infrastructure did not: a C ephemeris keeping zodiac mode per thread returned dasha periods years off, under a clean HTTP 200 with no exception raised.
Reality
- Evidence30
- Adoption12
- Hype gap−10
- Incentives75
- Confidence45
UltraViolet Cyber's Zonifer chained a missing manager check with an inverted strncmp in Atsign's C sshnpd daemon. Atsign patched in four days, and the CVE that inventory tools would match on is still pending.
Publishers:uvcyber.com
Reality
- Evidence52
- Adoption20
- Hype gap+18
- Incentives75
- Confidence50
The average professional reports 47 percent of last month's code fully agent-generated, 38 percent assisted and 27 percent manual. Only 22 percent live above the 80 percent line.
Reality
- Evidence52
- Adoption68
- Hype gap+30
- Incentives62
- Confidence55
A dev.to walkthrough compiles the same vulnerable socket server with -z execstack and -z noexecstack. The code does not change, the linked image does, and the script reads the wrong file.
Reality
- Evidence71
- Adoption
- Insufficient
- Hype gap+14
- Incentives25
- Confidence64
The guidance is non-binding. It is also a named list a critical-infrastructure buyer can read back to a vendor, starting with memory-unsafe code and the published plan for getting out of it.
Reality
- Evidence74
- Adoption
- Insufficient
- Hype gap+12
- Incentives52
- Confidence64
A dev.to walkthrough lays out the POSIX recipe behind HDFS short-circuit reads and points it at java.lang.foreign. The supplied text stops before the Java arrives.
Reality
- Evidence48
- Adoption
- Insufficient
- Hype gap+22
- Incentives32
- Confidence54
A seven-year Rust developer rebuilt his JSONPath library in Zig. The costs he reports are IDE support, build files and folder depth, not memory management.
Reality
- Evidence32
- Adoption
- Insufficient
- Hype gap+12
- Incentives45
- Confidence38