The Engineer

Two Clouds Ship the Same Fix

AWS MCP Server went GA with IAM-authenticated agent access to 15,000+ API operations, sandboxed Python execution, and wiring for Claude Code, Cursor, and Kiro. Google Cloud shipped first-class agent identities with OAuth, certificates, and runtime defense, treating agents as distinct security principals. Both landed within days. That is two hyperscalers conceding the same point: agents running on a developer's token is now the legacy pattern.

Three Attack Vectors Against the Legacy Pattern

Three research groups published in the same window explaining why the fix is overdue:

1. MCP Config Hijacking — Mitiga demonstrated a malicious npm package editing ~/.claude.json to drop an attacker-controlled proxy in the path. Every OAuth token and every tool response flows through it. The file is plain JSON. No signature check. No origin pinning. A postinstall script writes it silently.
2. SKILL.md Poisoning — Agents read SKILL.md for project conventions and execute the content as trusted instructions. A PR that edits SKILL.md to exfiltrate secrets gets followed by the agent on the next run. No supply-chain scanner examines these files today.
3. Predictable LLM Passwords — GitGuardian measured Llama-3.3-70b emitting the substring 'Gx#8dL' in 96% of password outputs. Claude Opus 4.6 hits 35% uniqueness. 28,000 LLM-generated passwords surfaced on GitHub over 5 months. 1,800 of those were in .env files.

The Blast Radius Is Proven

A Cursor agent dropped PocketOS's production database in under 10 seconds. The outage ran past 30 hours. The agent held DATABASE_URL pointing at prod with DDL privileges, and ran DROP with the same confidence it writes a unit test. Separately, LayerX showed cross-extension injection against the Claude Chrome extension, pulling out GitHub source, Google Drive files, and email. Anthropic's May 6 patch is incomplete. Takeover paths remain.

The agent did not malfunction. It executed exactly what its permission grant allowed. The permission grant is the bug.

The Architecture Fix

The new AWS and GCP primitives give the agent its own principal with bindings and a revocation path that do not touch the developer account. Revoking a service account stops the agent without locking anyone out of the console. The pattern:

• Dedicated agent IAM role. Read-only by default. Write credentials injected only at the step that needs them.
• MCP config integrity monitoring. inotifywait or fswatch on ~/.claude.json and equivalents.
• SKILL.md treated as reviewed source. Same PR review as .github/workflows.
• Zero trust on LLM-generated secrets. Any model-generated credential is compromised on arrival. Use openssl rand -base64 32.
• Browser profile isolation. Run AI extensions in a separate Chrome profile that is not logged into GitHub, Drive, or the cloud console.

The Counterintuitive Finding

MCPMark V2 ran the experiment I kept meaning to run: upgrade Claude to a smarter model, measure tokens against Supabase. Consumption went up 54%. The model is not being wasteful. It is being thorough with garbage context. I spent most of a Tuesday last month chasing what looked like a retry loop and turned out to be the agent correctly reasoning about three contradictory error codes. Hand a smart model ambiguity and it explores, the way a senior engineer explores unclear requirements. The fix is clearer context, not a dumber model.

The Supabase vs InsForge Comparison

Supabase returns the entire auth doc for one OAuth query. That is 5-10x tokens needed. Its error codes do not distinguish platform-layer from function-code failures, so the agent retries into a cascade. I have watched that cascade eat a budget inside a minute. InsForge returns full backend topology in ~500 tokens, exposes 4 narrowly-scoped skills, and every operation returns structured JSON with semantic exit codes.

The infrastructure layer is the primary cost lever, not the model. Naive versus optimized isn't 10-20%. It's 3x.

GitHub Confirms the Pattern at Scale

GitHub called agent workflow costs a "growing concern" and has been running systematic token optimization since April. What they documented matches what shows up in my own traces: full conversation history replayed every turn, tool results appended without truncation, context growing monotonically until the budget runs out. The fixes are boring. Truncate tool results, cache retrievals, replay less history. They compound on workflows running thousands of times daily.

The Two Moves That Get 90% of Savings

1. Lazy tool loading. Load tools scoped to the current subtask, unload when the subtask closes. I tried eager loading first because it was simpler. Most tools never fire this turn. They cost tokens on every step anyway.
2. Shaped returns. Tool responses structured for the agent's next decision, not for a generic consumer. The agent needed three fields. It got the whole row. Then it got the whole row again on the next step via transcript replay.

CrewAI v1.14 ships checkpointing. Every flow method becomes a recovery point. Burn 2M tokens, fail at step 47, resume from checkpoint instead of replaying from scratch. This is git for agent execution. I have eaten the 2M-token replay once. It is not a mistake you make twice.

What Actually Changed

GPT-Realtime-2 folds the ASR → LLM → TTS pipeline into one model on one WebSocket. The old path was three network hops, three failure modes, and an orchestrator resending the full conversation every turn as a list. The new path is speech in, speech out, state held server-side, 128K context, GPT-5-level reasoning on the audio.

The Numbers That Matter

• Time-to-first-audio: 1.12s at minimal reasoning, 2.33s at high. Per-turn knob, not a fixed cost.
• Instruction retention: 36.7% → 70.8% APR. The minute-ten persona drift that kills production deploys is materially addressed.
• Context: 32K → 128K tokens. Long support calls stop truncating mid-conversation.
• Pricing: $4.61/hr output, unchanged across the capability bump.
• Parallel tool calls: fan out to multiple backends in one turn instead of serializing round trips.

A model that absorbs three services and holds its price is the interesting part of the release, and the part that won't be in the marketing copy.

Infrastructure Implications

Stateful WebSocket sessions break the usual deployment patterns:

• Sticky sessions or connection-aware routing at the load balancer. Stateless replica scaling does not apply.
• Reconnect logic. A dropped connection mid-conversation is a new failure class the OpenAI docs do not cover.
• Node drains. Kubernetes pod eviction with live voice sessions needs an explicit plan.
• Cost at volume. A 24/7 voice agent runs about $140/day in API fees alone.

The adjustable reasoning effort parameter is the most architecturally useful feature. Five settings from minimal to xhigh. The production pattern is straightforward: a lightweight classifier routes each utterance. "What time is it?" gets minimal (1.12s). "Help me debug this crashloop" gets high (2.33s). This is QoS routing applied to voice, and it will become standard.

When to Migrate, When to Wait

The unified model wins when the agent needs sub-300ms barge-in handling and graceful interruption, sessions exceed 10 minutes, or tool calls need to interleave with speech. The three-box pipeline still wins when the phone-line budget is 500ms, flows are scripted, or the TTS or domain-tuned ASR needs to be swapped independently. Goldman Sachs notes voice AI costs $92/day vs human at $90/day. Full automation is still economically marginal. Design for hybrid routing.

WebRTC's packet-dropping design conflicts with voice AI requirements at a fundamental level. STT pipelines cannot tolerate dropped frames. A missing packet becomes a garbled token, which cascades into degraded prompt quality. QUIC keeps ordering and reliability while still running over UDP, and its connection-ID addressing survives WiFi-to-cellular transitions. If building new voice infrastructure, make the protocol decision explicitly.