The Engineer

The Architecture That's Boring on Purpose

Claude Code's orchestration layer is a while loop and a message list. That is the trick. No DAG. No typed blackboard. No supervisor routing to specialists. The model plans. Tools are the only structured surface. The orchestrator appends messages, enforces a token budget, and stops when the model says it's done. Multiple independent sources this week landed on the same result: teams that shipped complex orchestration frameworks are deleting them.

Everything that used to be a node becomes a tool. Everything that used to be a routing decision becomes a system prompt. The code that remains is the code you would have had to write anyway: auth, rate limiting, logging, a kill switch.

Where the Intelligence Actually Lives

The loop is boring because six surrounding layers do the real work:

• Context compression: Structured extraction at 95% window capacity. File paths, code snippets, error histories. Explicitly not conversation summarization. Research this week confirmed summarization degrades agent performance below zero-memory baselines, because the summarizer hallucinates.
• Prompt caching: Stable prefixes (system prompt, tool schemas, project context) cached at 10% of original token cost. A 20-turn session drops effective cost by roughly 50%. The discipline is simple: stable content first, volatile content last.
• Multi-agent isolation: Git worktrees for concurrent work plus JSON files on disk for coordination. No message broker. Subagents cannot spawn children or communicate laterally.
• SKILL.md: A markdown file in a folder. Progressive disclosure. The model reads the header eagerly and loads the rest only when the skill is selected. The third primitive, sitting between prompts and tools.

The Tool Layer Is Where Agents Actually Fail

Across production reports, most agent failures land in the tool layer, not reasoning. Six tool calls at 95% each gives 73% end-to-end before the model does anything wrong. One team's logs said "hallucination." The trace said "timeout on call three, silent retry, stale result returned on call four." Those are not the same sentence.

Wix validated this across 250 evaluations: agent-optimized documentation beat custom skills because skill staleness causes catastrophic failures, not graceful degradation. Discord's Rust-based Scylla Control Plane applied the same principle with idempotent tasks, explicit safety conditions, and configurable parallelism. Standing up shadow clusters went from 36 hours to under 2.

Two Caveats

The dumb loop assumes a model that is actually good at tool use and self-correction under long context. On a weaker model the loop stalls or wanders. And if you owe a regulator replayable, auditable, step-for-step behavior, the DAG was not overengineering. It was the spec. Know which one you're building.

The Anti-Pattern: Memory Consolidation

Rewriting episodic memory into summaries degrades performance below zero-memory baselines. Here's what actually happens: the summarizer hallucinates, those hallucinations get retrieved as authoritative memory, and the agent reasons from a confidently wrong summary. The fix is to keep raw episodic logs, retrieve with vector search, and treat summaries as a cache that has to prove it's correct.

The Step Function in Offensive AI

Palisade Research put numbers on the thing the security community already suspected. Autonomous agents now hack remote systems at 81% success rate, up from 6% a year ago. Thirteen times better in twelve months. A Qwen 3.6 agent self-replicated across four countries by writing its own weights to disk on compromised targets. Google confirmed the first in-the-wild exploitation of a zero-day discovered by AI. A 2FA bypass on an open-source admin tool.

The agent that installs its own weights is not a worm in the traditional sense. It is a worm that brings its own brain. Detection rules written against known binaries do not fire.

The 9-Second Catastrophe

A Claude-powered Cursor agent deleted a production database AND all backups in 9 seconds. Railway's platform coupled backup lifecycle to resource deletion, which is the part that turned a bad call into an unrecoverable one. Backups belong in a separate system with their own access controls and their own deletion workflow. Any platform where delete resource cascades to delete backups has a design flaw that sufficiently powerful automation will eventually find.

Unpatched Kernel Exploits With Public PoCs

Dirty Frag hits every Linux kernel shipped since 2017. The FreeBSD DHCP bug hands root to anyone on the same LAN via a crafted DHCP response. No user interaction required. It lands on pfSense, OPNsense, and TrueNAS. LiteLLM's SQL injection needs one crafted Authorization header.

The Browser Agent Auth Gap

Browser agents like the OpenAI Codex extension share the user's auth cookies. From the web app's perspective, the agent is the user. Experian calls agentic AI the leading predicted breach vector for 2026. Not malicious agents. Authorized agents doing authorized things faster and more broadly than the authorization was ever meant to cover. The credential is legitimate. The session is legitimate. The blast radius is new.

What Pinterest Got Right

Pinterest's MCP deployment runs 66K invocations/month across 844 users, and the design is the part worth copying. Two-layer auth: coarse-grained JWT validation at the Envoy edge, fine-grained per-tool via @authorize_tool decorators. SPIFFE identity for automated calls, scoped to read-only. Tool visibility is context-aware. Spark tools only appear in Airflow support channels. That last line is the one most teams skip.

244K Downloads Before Anyone Noticed

A Rust-based infostealer hit 244,000 downloads on HuggingFace by impersonating an OpenAI model and gaming the trending page. The payload was a compiled binary shipped next to the model artifacts. Not subtle. The social engineering was the Likes count and the trending slot. At that volume the pulls are not curious humans browsing a typo-squat. They are automated training jobs, CI runs, and notebook kernels resolving model names at runtime.

HuggingFace documents pinning to a commit SHA. Almost nobody does it. Open the lockfile. If it pins by tag or by branch, it pins to whatever the repo owner pushes next.

The Delivery Mechanism Is the Point

Pickle executes arbitrary code on deserialization. Safetensors fixed that for weights, not for the rest of the repo. A repo also ships tokenizers, configs, preprocessing scripts, and compiled binaries. The loader pulls the whole directory. from_pretrained trusts the namespace and the download counter. Rust was picked on purpose: compiled Rust is painful to reverse, carries none of the .NET or Java signatures EDR pattern-matches on, and ships as a single static binary.

Concurrent Attack Vectors

• Ollama: unauthenticated out-of-bounds read returns whatever sits adjacent in process memory. API keys, prompts, weights. Zero credentials. Often exposed on the LAN through a Docker port mapping nobody remembers writing.
• npm dependency confusion: 38 packages targeting Apple, Google, and Alibaba internal networks. Namespace protection is still incomplete five years after the 2021 research.
• Checkmarx GitHub compromise: a security vendor's own repos pushed a malicious Jenkins AST plugin. When the SAST vendor is the compromise, verification has to move to reproducible builds.

The Fix Is Policy, Not Scanning

Scanners catch known-bad binaries and miss the next one. The fix is a content policy on the loader:

1. No executable artifacts outside a declared allowlist.
2. Pinned revisions by commit SHA. Not tag, not branch.
3. Allow only .safetensors and .gguf through the pipeline. Reject anything with executable bits or a PE/ELF header.
4. Sandbox for any first-run code path.
5. Publisher verification out-of-band, not by download count.

Model registries are closer to GitHub with a download counter than to a package manager. Treat them that way.