The Engineer

The Convergent Attack Path You're Probably Exposed To

Unit 42 documented a 282% year-over-year increase in Kubernetes service account token theft operations, with 78% targeting IT sector organizations. The critical finding isn't the percentage — it's the convergence. Both Lazarus Group (operating as Slow Pisces, targeting crypto exchange infrastructure via overprivileged CI/CD service account tokens) and opportunistic attackers exploiting React2Shell (CVE-2025-55182, weaponized within 48 hours of disclosure) are executing the identical post-exploitation workflow:

1. Compromise a workload (via deserialization, SSRF, or supply chain)
2. Enumerate the runtime environment
3. Extract the token at /var/run/secrets/kubernetes.io/serviceaccount/token
4. Test RBAC scope
5. Pivot to the cloud control plane

When a North Korean APT and script kiddies running public exploits converge on the same attack path, that path is your highest-priority hardening target.

Dgraph's CVSS 10.0: One Missed Route, Full Compromise

Dgraph CVE-2026-34976 (CVSS 10.0, no patch available through v25.3.0) exists because the restoreTenant admin mutation was accidentally omitted from the authentication middleware mapping. One missed route. The exploitation paths are devastating: database overwrite via malicious backup injection, SSRF against internal services, local file probing, and — completing the circle — theft of Kubernetes service account tokens. The instructive lesson applies to every API server using middleware-based auth: if you don't have a test that enumerates all registered routes and asserts admin endpoints reject unauthenticated requests, you have the same class of exposure.

AI Infrastructure Is the New Soft Underbelly

This is a separate firefight but the same theme: Flowise CVE-2025-59528 (severity 10, unauthenticated RCE) is under active exploitation right now. Patched last September — any unpatched instance is compromised. Blink found 63% of 135,000 internet-exposed OpenClaw instances running without authentication. ComfyUI backends are being hijacked for cryptomining. These tools were built for developer experimentation and shipped without auth by default.

Meanwhile, Horizon3 reports that Claude found CVE-2026-34197 in Apache ActiveMQ — an authenticated RCE affecting every version released in the past 13 years — in approximately 10 minutes. The AI-accelerated discovery rate means your patch queue is about to spike, and AI deployment tools are the softest targets.

If your ML platform team has been spinning up orchestration tools without running them through the same security review as your production services, that gap is now being actively exploited.

The Dual-Model Pattern That's Production-Ready

DHH went from zero AI tooling to agent-first in 6 months and landed on a workflow that's the most production-realistic pattern described publicly. tmux with three panes: left runs a fast model (Gemini 2.5) for iteration, right runs a powerful model (Opus 4.5) for complex reasoning, center is NeoVim with Lazygit for diff review. The human's job shifts from writing code to reviewing diffs and routing tasks by complexity. This dual-model pattern works regardless of editor — the principle is model-routing by task type, not tool-specific.

The architecturally consequential signal: DHH is building CLIs for all 37signals products — not for humans, but because CLI interfaces let agents chain tools together. The workflow: agent checks Sentry via CLI, writes a fix, posts a PR via GitHub CLI, reports to Basecamp via CLI. Every internal tool that only has a web UI is effectively invisible to agent workflows. CLI with JSON output is dramatically more agent-friendly than REST APIs that burn context tokens on auth and response parsing.

70K LOC, Zero Hand-Written Code: CI Gates Are Everything

Luca Rossi's Tolaria project — 70,000 lines of code, 3,000 tests, 85% coverage, 9.5/10 CodeScene health score in ~7 weeks without writing a single line — offers the most data-rich case study for AI-first development. The most important finding is buried in one sentence: 'The highest leverage parts are still the CI gates on code health and test coverage.'

Without CI gates enforcing structural health metrics, every study shows AI-generated code quality degrades monotonically with codebase size. The gates work as a ratchet — health improved from 9.3 to 9.5 while the codebase grew 2.5x. The 40+ Architecture Decision Records serve a similar function: they're the human-authored constraint system that prevents contradictory design decisions as the project grows.

In a world where AI writes all your code, your CI pipeline isn't just a safety net — it's your entire quality assurance strategy.

Key caveat

Both the code and the tests are AI-generated, creating a circular confidence problem. 85% coverage where AI validates AI needs mutation testing and security audits before you call it production-grade. Also, a greenfield single-user PKM app is close to the ideal case — no distributed systems, no multi-tenancy, no legacy integration.

Governance Accelerates Deployment, Not Blocks It

Databricks' 2026 State of AI Agents report (20K+ org telemetry) quantifies what these case studies demonstrate: companies with AI governance frameworks ship 12x more projects to production. Governance means standardized eval suites, model registries, deployment gates, and rollback procedures — exactly the CI gate pattern that kept Tolaria's code health on track. Multi-agent systems grew 327% in four months across their enterprise base, making agent orchestration an imminent architecture concern for most teams.

The .claude/ skills ecosystem adds another dimension: skills combine instructions, file templates, tool configs, and validation loops — closer to Ansible roles than prompt templates. The cc-DevOps skill implements generator-validator loops for Terraform and K8s configs, essentially encoding senior engineer workflows as portable agent configuration. But skills don't port to Cursor or Copilot, so adoption deepens Anthropic dependency.

GLM-5.1: The Frontier Is Open-Source Now

Z.ai's GLM-5.1 scored 58.4 on SWE-Bench Pro under MIT license, beating both GPT-5.4 and Claude Opus 4.6 (53.4). This is not an incremental improvement — it's the first time an open-source model tops every proprietary frontier model on the most respected coding benchmark. The model also demonstrated 8-hour autonomous sessions sustaining 1,700 tool calls without strategy drift, building a complete Linux desktop web app (file browser, terminal, games) without human intervention.

The 744B MoE architecture means serving cost depends on active parameter count per forward pass. If it follows typical MoE patterns (10-25% activation), you're looking at 75-190B active parameters — challenging but feasible on a single 8xH100 node with quantization. The model card details haven't been released yet, so validate serving requirements before committing hardware.

The best coding model on the hardest coding benchmark is now MIT-licensed. If you're paying per-token API rates for code generation, the cost-benefit calculus just shifted hard.

Gemma 4: Frontier-Adjacent on a Single GPU

Google DeepMind's Gemma 4 26B MoE activates only 3.8B parameters from 26B total — a 14.6% activation ratio using 128 experts with 8 active per token plus a shared expert. Both the 26B and 31B variants fit in a single H100's 80GB memory (48GB and 58.3GB BF16). Native function calling, structured JSON output, and system-level instruction handling are built into training, not bolted on via prompting.

The practical deployment nuance: MoE models are memory-bandwidth-bound, not compute-bound. Your serving infrastructure (vLLM, TGI) needs to properly exploit sparsity — naive implementations won't deliver the theoretical speedup. Verify MoE kernel support before benchmarking. The edge models (E2B/E4B) add another dimension: a 4B-effective model running offline on Raspberry Pi at 52% on coding tasks enables privacy-preserving inference patterns that weren't possible before.

Cursor's Warp Decode: MoE Serving Gets 1.8x Faster

Cursor published a novel inference kernel that reorganizes MoE computation around output neurons instead of experts. Traditional MoE dispatch creates imbalanced workloads because expert popularity varies wildly. Warp decode gives every warp (32-thread unit) a contiguous output dimension chunk, producing 1.8x throughput on Blackwell GPUs with better numerical accuracy. The accuracy improvement suggests expert-centric accumulation was introducing errors in a pathological order — this isn't just a scheduling optimization.

The Combined Picture

The inference cost curve has shifted meaningfully. If you're paying per-token API costs for workloads that could run on your own GPUs, benchmark GLM-5.1 and Gemma 4 against your actual codebase this month — not on synthetic benchmarks, on real PRs from the last 30 days.