New solutions to old bottlenecks: Nearform recaps AI Native DevCon London 2026 (Part 1)

(This is Part 1 of a 2-part article)

Across over 40 talks at this year’s AI Native DevCon, by speakers from Anthropic, OpenAI, Meta, GitHub, NVIDIA and Nearform, there was one inevitable conclusion: code generation is no longer the constraint.

Specification, verification, review and organisational design are the new centers of gravity in software development. The questions we’re asking are no longer about “if” but “how”: how do we specify what we want, verify what we get, and restructure teams and platforms around a workforce that now includes agents?

Patrick Debois put it most succinctly from the main stage: “We’re not building the thing. We’re building the thing that builds the thing.”

This is something we explore every day at Nearform. Here, we’ve pulled together some of the key insights from the event, in two parts - first, the big themes from two days of talks, and second, looking ahead at how to apply these ideas to the real world.

Katie Roberts, Technical Director at Nearform, took the stage with: Stop Maintaining, Start Evolving: Applying AI-Native Practices to Brownfield Codebases.

While much of the AI coding conversation assumes a blank slate, Katie tackled the reality most enterprises live with: 60-70% of enterprise software is brownfield.

Her argument: AI-native engineering absolutely works on legacy systems - but only if you stop treating the codebase as a ball of mud and start treating it like a city, with districts, history and load-bearing infrastructure you modify at your own risk. As she warned the room: “AI will confidently hallucinate about your code.”

Katie laid out three deliberate methodologies for AI-assisted legacy evolution, each matched to a different pathology:

• Pseudo-greenfield - branch off and treat it as greenfield. Fast early progress, painful merge.
• Strangler fig - replace whole system architectures alongside itself, with no downtime, the pattern proven at Uber, Netflix and the BBC.
• Branch by abstraction - work from inside the live system, behind an abstraction interface and feature flags. Like replacing a kidney from the inside.

Katie added color by sharing two specific examples from projects we’ve worked on recently at Nearform:

• Six months of scope shipped in eight weeks. Using a pseudo-greenfield approach, our team reverse-engineered product requirements in weeks instead of months, cut codebase mapping from two weeks to hours and delivered at roughly four times the pace of competitor estimates.
• A complex internal architecture change unblocked the upgrade of components on a tightly coupled distributed monolith, using branch by abstraction. The team built a planning skill that decomposed work by component, and a multi-agent developer flow - orchestrator, ADR check, test scaffolding, implementation, quality gates, self-review, then human review. The first manual upgrade took months. With the agentic flow, velocity compounded, as every iteration added reusable skills to the library meaning that subsequent component upgrades using the AI flow take days, if not hours.

That flywheel - each piece of work leaving behind skills that make the next piece faster - was the clearest demonstration of what ‘AI-native’ means in enterprise delivery.

If 2024 was prompt engineering, and 2025 was context engineering, this event made it official: 2026 is the year of harness engineering - the deliberate design of everything around the model: autonomy boundaries, context, tool scope, feedback loops and verification.

• Ryan Lopopolo from OpenAI defined the discipline in Harness Engineering: How to Build Software When Humans Steer and Agents Execute: humans own direction, agents own execution, and the five design surfaces in between are first-class engineering work.
• The practitioner panel From Pipelines to Prompts (Stephane Jourdan, Simon Rohrer of Saxo Bank, Pini Reznik) put a number on it: “If you spend about as much time engineering your harness as you do on the actual functional output, you will get really good quality stuff.” Their other warning: this shift is bigger than cloud, because it touches every department - not just engineering.
• Marc Sloan extended the harness beyond code: product goals, design constraints and acceptance criteria are context too, and agents need them packaged explicitly - “product intent must be explicit, not implied.”

Tessl, a Nearform partner, had founder Guy Podjarny on stage for the event’s defining keynote, Skills are the new Code. His observation: skill counts on GitHub went from roughly zero to ~2 million in months - and almost none of them are engineered. His thesis: “Context is the new code. It is the place in which you program the model” - and because skills are code, they need code’s disciplines: static analysis, evals, security testing, dependency management and observability. Humans, he argued, are moving from the SDLC to the Context Development Lifecycle.

This was a theme echoed almost everywhere:

• Macey Baker & Baruch Sadogursky (Tessl) - Don’t Write Prompts, Write Software: turn repeated agent work into rules, skills, scripts, hooks and evals - maintained like any other artifact.
• Lamis Mukta (Anthropic) - Learning While You Sleep: Beyond Memory to Dreaming - one of the most forward-looking talks of the event. Beyond filesystem-style agent memory, Lamis proposed ‘dreaming’: an asynchronous, out-of-band process that reviews many agent transcripts at once, spots cross-session patterns and proposes fleet-wide memory updates. “Intelligence alone is not going to compound” without this context layer.
• Peter Wilson & Davide Eynard (Mozilla.ai) - cq - Stack Overflow for Agents: answered that question with running code. cq lets agents share ‘knowledge units’ - lessons learned the hard way while fixing a problem - locally first (a private SQLite store by default), then across a team, then into a moderated public commons with human-in-the-loop review and confidence scoring. The goal: stop every agent rediscovering the same fix, and let a lesson learned by one agent be useful to all of them - “do we want these tools in the hands of one single corporation, or in the hands of many people?”

Some of the most-discussed sessions weren’t about technology at all. The pattern across all of them matches what we argued in our webinar, Copilot isn’t a strategy: individual productivity gains don’t industrialise themselves - the operating model has to change.

• Ian Thomas (Meta) - AI Native Engineering: how Horizon grew an AI-tooling community 40x to 500+ engineers and weekly usage into the mid-90s percent - bottom-up credibility first, top-down support after, measured with a 6-dimension maturity model instead of vanity metrics.
• Daniel Jones & Tomasz Maj - More Software, Faster: Odevo’s AI Native Transformation: a 94% adoption rate and an eight-year platform rewritten to parity in three weeks. Their success metric is the one we’d steal: “How many more bold things are you doing?”
• Christopher Batey - Building Product Teams in the Age of AI: “AI is an amplifier” - it makes your strengths faster and your weaknesses worse. His fixes: ADRs before implementation, one complex cognitive task per engineer at a time, and “let’s not delegate systems thinking to agents.”

• Joseph Katsioloudes (GitHub Security Lab) - Code Security Reinvented: with one AppSec specialist per 100 developers, AI as a reasoning layer on top of deterministic detection is how security scales - MCP for capability, skills for process, agentic workflows for automation.
• Liran Tal - Your AI Agent Installed Malware Because a SKILL.md Told It To: the sobering counterpoint to the skills enthusiasm. The ToxicSkills research he cited found 37% of nearly 4,000 audited skills contained malware or other security weaknesses - including a “security scanner” skill that was itself malware. Live on stage: a malicious skill steering a coding agent into rogue actions, a prompt injection leaking secrets over email, and credit card numbers passing straight through LLM context. His point: agent skills are a software supply chain - they need a threat model and auditing, just like early npm did.