Why linting alone can’t govern agentic development

Linters have always been the quiet workhorses of software development: fast, local, unglamorous checks that catch typos, undefined variables, and formatting drift before they become someone else's problem. That job hasn't gone away. But a new piece from The New Stack makes a sharp case that it's no longer enough, now that AI agents are the ones doing a lot of the typing.

The core issue is scale and surface area. An agent can spit out code that looks clean, passes a linter, and reads like something a senior engineer wrote — and still be wrong in ways a syntax checker will never see. Think of an unvalidated value that quietly threads its way through several function calls before landing in a database query or an auth check. Or a conditional that seems fine on its own but silently makes an entire branch of logic unreachable. None of that shows up in a file-by-file scan. It shows up when you trace control flow and data flow across the whole system, which is a fundamentally different kind of verification than what linting was built for.

The piece also flags something easy to overlook: agents don't just write application code, they touch the entire supply chain. New dependencies, tweaked CI configs, pipeline changes, the occasional hardcoded secret — all of that can slip in alongside a feature that otherwise looks fine. The argument here is that the security perimeter has quietly expanded to include the tools and configs shaping how agents build software, not just the source files themselves. Teams that only gate on code review of the diff are missing where a lot of the actual risk now lives.

There's a longer-term cost too, and it's the kind that doesn't show up in a single pull request: duplicated logic, blurred ownership, architectural boundaries that erode a little with every agent-generated patch. Because agents can produce a lot of plausible-looking code very quickly, that kind of decay compounds faster than it used to. And there's a feedback loop worth noting — agents actually perform better in codebases that stay clean and well-structured, since a clearer architecture gives them a better map to work from. Let the mess pile up, and you're not just accumulating technical debt, you're degrading the very agents you're relying on to move fast.

The fix isn't abandoning linting, it's stacking it. Fast syntax and style checks stay in the tight inner loop where agents reason and iterate. Behavioral analysis, taint tracing, dependency scanning, secrets detection, and architectural review get applied as changes grow in scope, with human judgment still verifying outcomes rather than just approving tidy-looking diffs. The pitch, essentially, is that verification needs to scale with the agent's ambition, or the abundance of generated code just becomes an abundance of unexamined risk.