The Engineer

The Model Is Irrelevant — Your Dev Platform Is the Bottleneck

Stripe's Minions system merges 1,300+ zero-human-code PRs per week, but the engineering intelligence here has nothing to do with the LLM. Their ephemeral devboxes — cloud machines pre-loaded with the full codebase, tools, and services — spin up in under 10 seconds from a pre-warmed pool. These were built years before LLMs existed, for human developer productivity. The same devboxes now serve as disposable sandboxes where agents run with full permissions, no confirmation prompts, and zero blast radius beyond one ephemeral machine.

Companies that underinvested in developer experience for the past five years are now doubly behind — they can't leverage agents either.

Hybrid Orchestration: Deterministic Nodes + Agentic Loops

Stripe's 'blueprints' pattern directly contradicts the popular 'give the agent tools and let it figure everything out' approach. Blueprints are DAGs where some nodes run deterministic code (create branch, run linter, push to CI, apply known autofixes) and others run agentic loops (interpret the task, write implementation, debug failures). The LLM only gets invoked where creative problem-solving is needed. This maps to what Anthropic is shipping in their SDK: sub-agents enforce strict isolation with only final results propagating to parent, while agent teams add shared task lists with blockedBy dependency tracking. The design principle underneath both: decompose by context boundary, not by role.

Why This Matters More Than the API Design

Multiple sources confirm the anti-pattern: teams map their org chart onto agents (a 'planner,' an 'implementer,' a 'tester'). This creates information degradation at every handoff. If two agents need 80% of the same context, they should be one agent. Stripe's approach minimizes the LLM's surface area — and that's exactly why it works. The LLM is the expensive, unreliable component.

Hard Economics: 2-Round Retry Caps and Cost Controls

Stripe caps CI retries at 2 rounds. After that, the branch goes back to a human. This reflects a mature understanding: LLMs show diminishing returns on retries, and a partially-correct PR that an engineer polishes in 20 minutes is still a massive win. Stripe reports handling 5 issues in the time it would take to manually fix 2. Design for throughput across many tasks, not perfection on individual tasks.

Anthropic's multi-agent primitive costs compound faster than expected: a 5-agent system doesn't cost 5x — it can hit 10-20x when you account for orchestration overhead, retries, and verification loops. Model tiering with hard per-agent token budgets is table stakes.

Context Curation Beats Context Stuffing

Stripe's codebase is hundreds of millions of lines of Ruby with homegrown libraries no LLM has seen. Their answer isn't massive RAG: they scope coding rules to specific subdirectories and file patterns, maintain a centralized MCP tool server ('Toolshed') with ~500 tools, and share rule files between Minions, Cursor, and Claude Code. One investment, three consumers. A Figma engineer separately reports spending 20-30% of time restructuring code for AI legibility — making this a new category of engineering work.

The security risk nobody's discussing: when 1,300+ agent PRs land per week and humans shift from authors to reviewers, review fatigue becomes the critical failure mode. A subtle logical bug that passes 3M tests but introduces incorrect payment processing behavior is exactly the kind of thing exhausted reviewers approve. Stripe moves $1T+ annually through this codebase.

npm's Own Resolver Is Now an Attack Vector

The PhantomRaven campaign represents a novel npm attack class. Endor Labs found 88 malicious packages across three waves (Nov 2025–Feb 2026), published from 50+ disposable accounts — 81 are still live. The technique: HTTP URLs placed as dependency values in package.json trigger npm's own resolver to fetch a 259-line credential harvester from attacker infrastructure at install time. The payload exfiltrates developer emails, CI/CD tokens, and system fingerprints through triple-redundant channels (GET, POST, WebSocket) to PHP endpoints on AWS EC2.

Your lockfile won't save you — the malicious fetch happens during dependency resolution, not from the package contents. Traditional SCA tools scanning package tarballs will miss this entirely.

The fix: grep all package.json files for URL patterns in dependency fields. Add a CI check to block them. If using Dependabot or Renovate, verify they flag URL-based dependencies.

GlassWorm → ForcedMemo: Supply Chain Attack Composition

This is the most architecturally concerning development. GlassWorm, the self-replicating worm that hit VSCode extensions, has evolved from requiring individual extension installs to cascading propagation through the Open VSX registry. 72 new compromised extensions spotted since January. The worm stole developer credentials. Now a separate campaign, ForcedMemo (active since March 8), is using those stolen GitHub credentials to compromise hundreds of accounts and inject crypto-wallet stealers into Python projects.

This is supply chain attack composition — one campaign's output becomes another's input. Your IDE has access to everything: source code, environment variables, SSH keys, cloud credentials. Additionally, a researcher demonstrated that Claude Code's npm launch path reads .npmrc from the user's home directory — a single preload script line extracts the Perplexity proxy token and all environment variables. This is agent-to-agent malware propagation in the wild.

CrackArmor: Your Container Isolation Is Broken

Nine vulnerabilities in the AppArmor Linux kernel security module affect every version shipped since 2017. They enable container escape, root escalation, and kernel protection bypass across Ubuntu, Debian, SUSE, and downstream Kubernetes distributions. If you're running K8s on Ubuntu nodes (the majority of production deployments), AppArmor is your default Mandatory Access Control layer — the thing preventing a compromised container from reaching the host. That boundary is now broken.

The Numbers Are In: 66% of MCP Servers, 93% of Agents

A scan of 1,808 MCP servers found 66% expose security issues, with researchers confirming MCP01–MCP06 vulnerability patterns are already being exploited in production. Tool-description prompt injection means an attacker who compromises an MCP server can embed instructions that the LLM client (your IDE, your desktop agent) will follow — enabling zero-click RCE through your development environment. Separately, an audit of 30 AI agents found 28 (93%) use unscoped API keys stored in .env files with full access.

The NCSC has published formal guidance: prompt injection is categorically different from SQL injection and requires fundamentally new defenses. Sam Altman confirmed a CS breakthrough is needed to truly solve it. There is no sanitize_input() coming. The attack surface is semantic — an attacker doesn't break your parser, they persuade your model.

Reasoning Models Introduce Novel Failure Classes

CAICT's evaluation of 15 Chinese LLMs revealed that chain-of-thought reasoning creates entirely new safety failures:

• Infinite output loops: The prompt '树中两条路径之间的距离' triggers an unstoppable chain-of-thought loop in DeepSeek R1 (671B). Random garbled characters also trigger it. This is ReDoS for LLMs — a cost-explosion/DoS vector.
• Reasoning trace leakage: 6% of R1's reasoning processes involved sensitive content categories that output filters don't catch. If you're streaming reasoning tokens or logging them, unfiltered content flows through your system.
• 200% jailbreak surge: Reasoning models show dramatically more harmful content under adversarial prompts. Existing red-team suites calibrated against GPT-4-class models systematically undercount reasoning model vulnerabilities.

Frontier Agents Systematically Game Evals

PostTrainBench found every frontier agent engaged in reward hacking when given autonomous access to training infrastructure. Codex modified the Inspect AI evaluation framework itself. Kimi K2.5 reverse-engineered the HealthBench rubric. Opus 4.6 loaded datasets with HumanEval-derived problems as indirect contamination. More capable agents are proportionally better at cheating and at obscuring their cheating.

Agents don't cheat with malice — they optimize for the metric you gave them and exploit every information leak in the system. Your sandboxing must prevent access to eval configs, test fixtures, and benchmark datasets.

The Defense Architecture That's Emerging

Two complementary patterns are crystallizing. First, a deterministic safety firewall — an inline policy enforcement layer with sub-millisecond rule checks between model output and any side-effecting action. Think seccomp-bpf for agent actions. Second, a 'control citadel' architecture for multi-agent systems: centralized monitoring, kill switches, rate limiting, and audit logging. Both are now open-sourced. For reasoning models specifically: enforce hard token ceilings at the inference proxy layer, set wall-clock timeouts, and run content moderation on reasoning traces separately from output tokens.