The Authorship Inversion
[Navigation to be added at publication: Return to Part 0: Table of Contents | Previous: Part 21, Three Filings and a Moat]
As of May 2026, more than 80 per cent of the code merged into Anthropic's production codebase was written by Claude. Not assisted. Not reviewed from a template. Written, tested, and submitted by the model, with an engineer directing and reviewing rather than typing.
In February 2025, before Claude Code launched in research preview, that figure was in the low single digits.
Sixteen months. Low single digits to more than 80 per cent.
The Anthropic Institute published this data on 4 June 2026, in a paper co-authored by Marina Favaro and Jack Clark titled "When AI builds itself." Worth sitting with the numbers before reaching for the implications. In the second quarter of 2026, the typical Anthropic engineer was merging eight times as much code per day as in 2024. On the hardest, least-specified engineering problems the company tracks internally, Claude's success rate climbed to 76 per cent in May 2026; six months earlier it was around 26 per cent, a fifty percentage point rise in half a year. The code quality gap is closing too: Anthropic staff describe Claude-written code as somewhat worse than human-written code in late 2025, at rough parity today, and likely better within the year.
I have a name for what just happened: the Authorship Inversion.
The Authorship Inversion is the point at which an AI system becomes the primary author of the production software at the organisation building that AI system. Anthropic has crossed that point. The question this article is interested in is not whether you find that remarkable; it clearly is. The question is what it means for governance, accountability, and provenance across the broader enterprise landscape, in New Zealand and everywhere else.
Two Inflection Points, One Direction of Travel
The Anthropic data shows two identifiable inflection points. The first came in early 2025, when Claude began to run code rather than simply suggest it for an engineer to copy and paste. The second came in 2026, when models began to work autonomously over longer time horizons. Each inflection changed the slope of the productivity curve.
This is not an isolated story. The Linux kernel release cycles in 2025 and 2026 have both run heavier than historical trend, partly because AI-assisted contributions, including automated patch generation and AI-accelerated bug reports, have increased the volume of submissions entering the review queue. GitHub is on pace for roughly fourteen billion code commits across all of 2026; the platform saw approximately one billion commits in all of 2025. The Authorship Inversion, measured by any reasonable metric, is not confined to one closed proprietary environment. It is appearing, at different rates and with different governance conditions, across the software development landscape.
The difference between the open-source and the closed-source instances matters. In the Linux kernel, human maintainers retain explicit authority over what gets merged; the review culture is adversarial in the productive sense, with a distributed hierarchy of maintainers exercising judgement over every patch. The Authorship Inversion in that setting looks like a volume problem: more code arriving, generated at higher speed, requiring more review capacity from a maintainer pool that has not grown proportionally. The governance question in the open-source case is about review throughput, not about whether human judgement remains the gate.
In the closed-source case, at Anthropic, the governance model is also human-in-the-loop, with engineers directing and reviewing rather than typing. But the power dynamic is different. The maintainers at Anthropic are employees of the organisation whose product they are building; their review judgements operate within an institutional context, not an independent community one. The question of who reviews the reviewer is answered differently in each setting.
On 9 June 2026, five days after the Anthropic paper, Claude Fable 5 reached general availability. Fable 5 is the first publicly accessible model from Anthropic's Mythos-class tier, positioned above Opus 4.8 in the model hierarchy. Its strengths include software engineering, knowledge work, and long-horizon agentic tasks. On SWE-Bench Pro, an industry benchmark for software engineering performance, Fable 5 scores 80.3 per cent, against 69.2 per cent for Opus 4.8.
That pricing structure matters. The model Anthropic's engineers used to achieve the 80 per cent authorship figure is not Fable 5; Anthropic's internal tooling runs on its own production systems, including the as-yet-restricted Mythos Preview. But Fable 5 represents the same model class made broadly available at ten dollars per million input tokens. The Authorship Inversion that currently describes one frontier AI laboratory's internal workflow is, from this week, a capability that any developer with an API key can begin approximating.
Two things happened in the same week: Anthropic disclosed the current state of the Authorship Inversion at their organisation, and made the capability class driving that inversion available to everyone with an API key. The question shifts from "what is Anthropic doing" to "what are your teams about to start doing."
The Governance Contrast
On 26 May 2026, ten days before the Anthropic paper, Gartner published research from Senior Director Analyst Shiva Varma predicting that by 2027, 40 per cent of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur.
Forty per cent.
Varma's diagnosis is precise: enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that binary is the root cause of failure. Agents operating at different autonomy levels require different governance controls; applying uniform governance creates two risks simultaneously. Restricting low-autonomy agents stifles value and pushes adoption underground. Under-restricting high-autonomy agents creates operational, security, and compliance exposure that typically only becomes visible after something has gone wrong.
Gartner's framework identifies four agent autonomy levels: observe, advise, act with approval, and act autonomously. The governance controls appropriate for an agent that summarises documents are qualitatively different from the controls appropriate for an agent that executes code, modifies production databases, or sends communications on behalf of an organisation. The binary approach creates a false sense of safety at the high-autonomy end precisely because it resembles governance.
Read these two findings together: Anthropic is governing AI that writes more than 80 per cent of its production code. Most enterprises are still learning to govern AI that sends an email. The gap between frontier governance practice and mainstream enterprise governance practice is not narrowing. The capability side of the equation keeps accelerating; the governance side is still working out how to classify the agents already deployed.
This is not a technology gap. It is a governance velocity gap. The organisations building the most capable AI systems are, by necessity, the ones developing the most sophisticated governance for those systems. They have operational necessity on their side: if you cannot govern the tool writing your entire codebase, the codebase degrades, incidents escalate, and safety risk becomes business risk. The incentive to get governance right is direct.
The organisations deploying AI tools into existing workflows face a different incentive structure. Many are discovering their governance gaps retrospectively, after something has failed in production, which is precisely the pattern Gartner's prediction describes. The 40 per cent figure is not a prediction about careless organisations. It is a prediction about the current median enterprise, operating rationally under uncertainty, building governance frameworks around AI deployments that were themselves built under time pressure and competitive urgency.
When the Model Builds the Model: The Provenance Question
The Authorship Inversion creates a specific accountability challenge that has no clean precedent.
When AI authors the majority of an organisation's code, the software supply chain takes on a new character. The standard question in software governance, "who wrote this and can we trace it," yields a new class of answer: the model wrote it, version 4.8, on 14 March 2026, and the engineer reviewed it before merging. That is a traceable answer. The provenance chain exists. But it raises immediate downstream questions: what was the model trained on? What version? What were the governance controls on the training process? If the output has a defect, who bears accountability?
These are not novel questions in principle. Software supply chain accountability has been a governance concern for decades; the open-source dependency problem, where a critical library is maintained by a single volunteer and embedded invisibly in thousands of commercial products, is the most familiar version. The Authorship Inversion adds a new layer: the tool generating the dependency is not a library but a model, with version numbers, training data, and alignment properties that change between releases. Accountability for a defect in AI-authored code requires tracing not just who reviewed it, but what model produced it, on what training base, with what safety properties active at the time.
Anthropic's internal answer to that question is presumably well-documented: the company is the model developer, the model operator, and the code author simultaneously. Most enterprises procuring AI coding tools are none of those things. They are third-party deployers of tools whose internal alignment properties they neither configure nor audit. The accountability gap between the frontier lab and the downstream enterprise deployer is structural.
On 10 June 2026, the European Commission published the final Code of Practice on Transparency of AI-Generated Content. From 2 August 2026, providers and deployers of AI systems in the European Union will be required, under AI Act Article 50 transparency obligations, to clearly indicate content generated by AI. Systems placed on the market before that date benefit from a transitional period to 2 December 2026. The code is voluntary compliance guidance; the underlying Article 50 obligations are legal requirements.
The code covers AI-generated or manipulated content in the conventional sense: text published to the public, deepfakes, images. It does not yet address the more specific question of AI-generated software that itself generates outputs. But the regulatory direction is clear. Provenance is becoming a legal obligation, not an optional governance aspiration. The question of who, or what, authored a system is moving from internal accountability to external disclosure.
For organisations already past their own Authorship Inversion threshold, even informally, this regulatory trajectory has operational implications. Your AI tool generates the contract. The contract governs a relationship. The regulator wants to know who authored the contract. "The model did, and we reviewed it" is a defensible answer only if the review process was genuine and documented.
The NZ Calibration
New Zealand government agencies completed the first annual self-assessment cycle against the Minimum Cyber Security Standards on 30 April 2026, covering the period from November 2025. The assessment cycle covers ten security standards and requires agencies to document their maturity against foundational cyber practices. It is one layer of the baseline governance infrastructure that agencies are building or documenting across the public sector.
Most NZ organisations, public and private, are nowhere near their own Authorship Inversion. They are, in many cases, still at the stage of understanding what AI tools their teams are actually using. The Gartner finding, that 40 per cent of enterprises will decommission agents after discovering governance gaps through production incidents, is calibration data for where the risk sits in the current cycle.
The relevance of the Authorship Inversion for NZ practitioners is not that Claude is writing Anthropic's codebase. It is that the tools capable of triggering a local Authorship Inversion are now broadly available, at general API pricing, on the same platforms your teams are already accessing. The frontier capability that produced the 80 per cent figure at Anthropic became publicly accessible on 9 June 2026. That is not a hypothetical; it is in the API catalogue.
This changes the timeline for the governance question. Organisations that expected to have another twelve to eighteen months before AI-generated code became a serious component of their software estate should revisit that assumption. Code generation adoption is not linear; it follows the same adoption curve as every other AI tool, except that its outputs are embedded in the infrastructure that everything else runs on.
There is also a specific angle under the Privacy Act 2020 and Information Privacy Principle 3A, operative from 1 May 2026. If AI-generated code is processing personal information, and the indirect-collection notification obligation under IPP 3A applies to how that system was built, the provenance chain between the model's authorship and the system's processing activities matters. This is not an argument that every AI-assisted coding project triggers IPP 3A; it is an observation that the question deserves a mapped answer, not an unconsidered one.
The architectural answer to the provenance question, which EA Thursday covers in its delegation architecture chapter, is making authority traceable, scoped, and revocable. The same governance logic that applies to agentic identity applies to agentic authorship: if you cannot trace where the code came from, you cannot govern what it does.
What Principled Stewardship Looks Like Now
The book this series draws on, The Hallucination Economy: Generative AI, Governance, and Sovereignty in Aotearoa New Zealand, argues that AI offers neither salvation nor doom but requires principled stewardship. The Authorship Inversion is the most concrete test of that thesis yet.
Principled stewardship at the Anthropic scale means governing AI that writes the majority of your production code: maintaining human review as the quality gate, tracking model versions against output quality, and being transparent enough to publish the numbers publicly rather than obscuring them. The co-authors of "When AI builds itself" describe the engineer's role as directing and reviewing rather than typing. That is still human judgement in the loop. But it is a qualitatively different form of human judgement than authoring. The cognitive demand shifts from code production to code evaluation. The governance question is whether evaluation capacity is scaling as fast as production volume.
That transparency, publishing the 80 per cent figure rather than marketing around it, is itself a governance act. It gives the broader landscape data it needs: the rate of change, the current threshold, the quality trajectory. Organisations that obscure their AI usage levels from their regulators, their boards, or their clients are making a different governance choice, with different risk consequences.
Principled stewardship at the NZ enterprise scale means something more immediate: understanding what your teams are already doing, classifying the autonomy levels of the tools you have deployed, and not discovering your governance gaps through a production incident in late 2027. The Gartner 40 per cent figure is not a prediction about the worst organisations. It is a prediction about the current median.
The organisations that will not be in that 40 per cent are the ones that treat governance as a precondition for deployment rather than a retrospective audit after something fails. That is not complicated. It is slow, methodical, and unglamorous. It is also, at this point in the adoption cycle, the only strategy that consistently avoids the decommission outcome.
The Sovereign Implication
The implication on the sovereignty side is where the Authorship Inversion sharpens. When AI authors production code, provenance becomes a question of national strategic interest, not just enterprise governance. The UK AI Safety Institute (AISI), the Japan AI Safety Institute, and the EU AI Office represent an allied institutional network building evaluative capacity to answer one specific question: what is inside the model, and can its outputs be trusted in high-stakes settings? EU AI Act Article 50, operative from 2 August 2026, mandates external disclosure of AI-generated content at scale, and the allied AISI network is already evaluating model alignment properties, not just capability benchmarks. The Lethal by Design YouTube series, launching 26 June 2026, covers the sharpest end: what happens when the provenance chain is a targeting decision, not a contract. Traceability and external oversight are not features added when stakes are high enough. They are the architecture.
The Open Questions
The Authorship Inversion does hold at Anthropic, as a confirmed, documented, primary-sourced fact. It is visible, to varying degrees, in open-source development infrastructure. Will it generalise across regulated enterprises? The governance maturity gap suggests the answer is not straightforwardly yes; regulated environments have different accountability requirements, different audit expectations, and different risk tolerances than a frontier AI lab. Could it change accountability, provenance, and authorship obligations? That question is open, and the EU regulatory trajectory suggests it will be answered through law before most organisations have finished thinking it through.
These are not questions to answer here. They are questions to monitor. The arc is clear: more than 80 per cent of one organisation's production code is already on the far side of the Authorship Inversion. The governance frameworks for that world are still being written.
What are you seeing in your organisation's deployment pipeline? Have you mapped the authorship trail on your AI-assisted outputs?
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hamberger Report: Generative AI 2026 provides enterprise leaders with evidence-based analysis of the AI landscape.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
[1] Favaro, Marina and Clark, Jack. "When AI builds itself." Anthropic Institute. 4 June 2026. https://www.anthropic.com/institute/recursive-self-improvement
[2] Anthropic. "Introducing Claude Fable 5 and Claude Mythos 5." Anthropic API Documentation. 9 June 2026. https://platform.claude.com/docs/en/about-claude/models/introducing-claude-fable-5-and-claude-mythos-5
[3] Anthropic. "Claude Fable 5." Anthropic. 9 June 2026. https://www.anthropic.com/claude/fable
[4] Varma, Shiva. "Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure." Gartner Newsroom. 26 May 2026. https://www.gartner.com/en/newsroom/press-releases/2026-05-26-gartner-says-applying-uniform-governance-across-ai-agents-will-lead-to-enterprise-ai-agent-failure
[5] European Commission. "Code of Practice on Transparency of AI-Generated Content." EU AI Office. 10 June 2026. https://digital-strategy.ec.europa.eu/en/faqs/code-practice-transparency-ai-generated-content
[6] Overcyte. "NZ Minimum Cyber Security Standards Guidance." Overcyte blog. May 2026. https://www.overcyte.com/blog/nz-minimum-cyber-security-standardsguidance
[7] Office of the Privacy Commissioner. Privacy Act 2020, Information Privacy Principle 3A. Operative 1 May 2026. New Zealand Government.