The Engineer

The MCP Rug Pull Is a Design Flaw, Not a Bug

The Model Context Protocol — rapidly becoming the standard integration layer for AI agents — has no cryptographic integrity between the moment a user approves a tool and the moment the agent executes it. No versioning, no content hashing, no approval-time snapshots. A malicious MCP server presents a benign tool description ('read my calendar'), gets user approval, then silently rewrites the tool definition to 'exfiltrate all emails' before the agent invokes it. This is a textbook TOCTOU (time-of-check/time-of-use) vulnerability.

Neither Datadog nor LangSmith can detect the MCP rug pull — they log what was called, not whether it matched what was authorized.

The fix follows a pattern you already know from Git and Docker: SHA-256 hash the full tool definition (description, parameters, behavior) at approval time, verify the hash before every execution call, and log the hash chain in an append-only store. This should have been in the spec from day one, and the open question is whether Anthropic adds it before enterprises ship MCP systems under SOC 2 and EU AI Act Article 12 requirements.

AWS Bedrock: 8 Validated Privilege Escalation Paths From One IAM Identity

XM Cyber mapped eight distinct attack vectors that all originate from a single over-privileged IAM identity — and none require application redeployment:

1. Log redirection — redirect invocation logs to attacker's S3 bucket (exfiltrate prompts, cover tracks)
2. Knowledge Base credential theft — steal SaaS credentials from KB configs
3. Agent hijacking via bedrock:UpdateAgent
4. Lambda layer injection into inference pipeline
5. Flow rerouting of agent execution paths
6. Guardrail stripping via bedrock:UpdateGuardrail
7. Prompt template poisoning of shared templates
8. Model invocation logging manipulation

All execute through the AWS control plane, invisible to application monitoring. The fix is a focused IAM audit: enumerate every principal with bedrock:* or any of the eight specific actions, scope them to specific resources. This should take hours, not days.

Agent Identity Is Now an Infrastructure Primitive

At RSAC 2026, three major vendors and a standards body independently converged on the same architecture: Cisco's Duo Agentic Identity, Palo Alto's Prisma AIRS 3.0, and the Cloud Security Alliance's new CSAI nonprofit all landed on agents-as-first-class-identity-principals with full authz, audit trails, and runtime behavioral controls. Nvidia released NemoClaw as an open-source security layer for agents. When this many players converge simultaneously, it's a pattern solidifying, not hype.

Meanwhile, the GhostClaw npm supply chain attack specifically targeted OpenAI and Anthropic API tokens alongside traditional SSH keys — 178 developers compromised in one week. Your agents' credentials are now high-value targets in commodity malware.

If your agents authenticate via shared API keys or long-lived tokens, start designing migration to per-agent identity now — before it becomes a compliance requirement.

S3 Met Its SLAs and Still Failed

Netflix's live streaming migration is the most detailed public case study of adapting a VOD-optimized CDN for real-time delivery. The headline: S3 was working correctly and was still unacceptable. The 2-second segment budget — shared across encoding, packaging, origin write, CDN fill, and playback — cannot tolerate S3's tail latency. Write latency dropped from p50 113ms → 25ms after migrating to Cassandra with local-quorum writes.

Evaluate storage against your end-to-end time budget, not the vendor's SLA document.

Netflix defined an explicit 500ms-write-is-a-bug contract — the kind of SLO you should define before you discover the problem in production. If any path in your system has a hard time budget under 5 seconds, benchmark S3 p99 under your actual write patterns.

Write-Through Caching Eliminates Thundering Herd at 200Gbps

The 'Origin Storm' — dozens of CDN nodes simultaneously requesting the same segment — is a thundering herd problem. Netflix's solution: fill EVCache on every write, not on cache miss. Reads never touch Cassandra in the hot path. EVCache (Memcached-based) handles 200+ Gbps read throughput while Cassandra handles writes undisturbed. Physical separation goes further: separate EC2 stacks for publish vs. CDN traffic, separate storage clusters for reads vs. writes.

This is CQRS applied to infrastructure, not application code. If you have any workload where a single write is read by many consumers within seconds, this pattern eliminates an entire class of failure modes.

HTTP Cache-Control's 1-Second Granularity Is Broken

Standard HTTP Cache-Control operates at 1-second granularity. When your content segments are 2 seconds long, that's 50% of segment duration — you can't precisely control cached 404 expiry. Netflix patched nginx for millisecond-grain caching. At the live edge, they use long-polling — holding requests until segments are published, eliminating retry storms. Behind the live edge, they cache 404s with TTLs aligned to expected publish times. Two temporal zones, two strategies.

Redundancy as Quality Selection, Not Just Failover

Netflix runs two complete encoding pipelines across different AWS regions. The Origin doesn't just failover — it actively selects the best segment from either pipeline based on quality metadata (short segments, missing frames, timestamp discontinuities). The ops team can surgically mask one pipeline's output for specific time ranges. This reframes redundancy from binary failover to continuous quality optimization.

GPT-5.2's Subagent Delegation Is Actively Degrading Work

Multiple credible practitioners (Mikhail Parakhin, Jeremy Howard) report that GPT-5.2 Pro's eager subagent delegation produces what's being called 'slop theater' — the appearance of productivity with degraded output quality. The model parallelizes work across weaker subagents, creating the same anti-pattern as unbounded fork() vs. a well-designed thread pool. The naive assumption that 'more agents = more throughput' fails when subagents are less capable than the orchestrator.

The fix is constrained delegation: explicit quality gates between stages, token budgets per subtask, and fallback to serial execution when verification fails.

If you're building agent orchestration, this is the most important design lesson of the week. xAI shipped multi-agent debate in Grok 4.20 then retreated to more generic agents — the persona design space is unsettled.

Your Eval Ground Truth May Be Penalizing Correct Outputs

AssemblyAI discovered their speech-to-text model was being penalized for transcribing correctly — content that human labelers had missed in the ground truth. When models exceed the quality of your test labels, benchmarks become systematically biased against your best models. This inverts the traditional evaluation paradigm: you need audit processes that assume the model might be right and the label wrong.

Separately, Cursor's Composer 2 was revealed as a fine-tuned Kimi 2.5 with selectively reported benchmarks on their own CursorBench suite — a cautionary tale for anyone evaluating AI coding tools. Demand model provenance and independently reproducible methodology.

Three Production-Ready Fixes

1. Multi-Persona Prompt Chains

Sequencing PM → spec writer → implementer → reviewer personas in a single session is gaining real traction across Anthropic, OpenAI, and xAI. It works because it constrains the agent's attention window per step — single-responsibility principle applied to prompt engineering. Your 'reviewer' persona should encode YOUR team's code review standards, not a generic 'creative contrarian.'

2. Remove 'Expert' Framing From System Prompts

Research shows telling an LLM it's an 'expert' improves alignment tasks but degrades factual accuracy and coding output. If your Cursor rules or Claude system prompts include 'You are an expert software engineer,' you may be actively hurting code quality. This is cheap to A/B test — strip the expert framing and measure review rejection rate.

3. Pre-Built Codebase Search Indexes

Text search indexes provided to fast models create a qualitative difference in agentic coding workflows, with impact scaling with codebase size. Cursor's Instant Grep achieves millisecond regex over millions of files. The search index is your actual agent bottleneck — LLMs are fast enough; finding the right context is where latency lives.