The Scientist

The Glue Layer Is the Target

The shared feature across this week's disclosures is that all of them hit the ML plumbing between models and production, not the models themselves. Three active exploits landed at once:

• LiteLLM (CVE-2026-42208): Unauthenticated SQL injection via a crafted Authorization header. Tencent found it, the patch shipped in April, live exploitation was confirmed in May. LiteLLM tends to hold routing configs, team quotas, prompt caches, and API keys for OpenAI/Anthropic/Bedrock. Compromise means owning the LLM cost center and the prompt IP.
• Ollama OOB Read: Critical unauthenticated out-of-bounds read on port 11434. Any network caller can read process memory, which in practice includes in-flight prompts, RAG context (often PII), environment-variable secrets, and model weights. No CVE assigned yet. A weaponized PoC within days is the base rate for this class.
• HuggingFace Trending Malware: A repo impersonating OpenAI's "Privacy Filter" reached #1 trending with 244K downloads before takedown. Payload was a Rust-based Windows infostealer with anti-analysis evasion, targeting HF tokens, W&B keys, and cloud credentials.

Why This Week Is Different

Individual vectors here are not new. What is new is simultaneous exploitation across three layers, each of which invalidates a different assumption ML teams have been quietly relying on:

The SkCC paper adds a useful prior: more than one-third of community-contributed agent skills carry vulnerabilities. If agents import skills from shared registries, the deployment inherits a 33%+ exploit-per-skill base rate. The thing this doesn't tell you is which skills, which is the part that would actually let you prioritize.

Trending rank, localhost binding, and proxy auth headers are all being treated as trust boundaries by teams whose threat models were written before any of these were load-bearing. None of the three is holding up this week.

The Cross-Source Pattern

Six independent sources flagged some subset of these vectors this week. The convergence is the signal. The attack surface has been probed across model registries, inference endpoints, and routing proxies in the same window. Whether coordinated or coincidental does not change the defensive response, which is the same either way.

Eight Sources, One Pattern

Eight independent sources this week described the same emerging architecture from different angles: Anthropic's Claude Code, Wix's 250-eval study, the SkCC paper, Pinterest's MCP deployment, and separate findings on memory degradation. They converge on one thesis: the model is the least interesting part of a production agent. The harness around it—context management, tool registries, prompt structure, memory strategy—is what moves the metric you actually care about.

The Architecture, Consolidated

Claude Code runs a "dumb loop, smart harness" pattern: a single-threaded master loop (assemble context → call model → execute tool → feed result back), with intelligence pushed into six surrounding layers. Three of those techniques transfer cleanly to other agent stacks:

1. Structured-extraction context compression at ~95% window capacity. Not summarization. Extraction of typed artifacts (file paths, stack traces, diffs). Summarization drops the deterministic tokens the model needs to resume work, which is the failure mode you will hit second-week in production.
2. Prompt cache reuse at ~10% of original cost. The architectural prerequisite is a stable prefix: system prompt, tool schemas, and repo context byte-stable at the head; user turn and tool results at the tail. Without the discipline, the cache hit rate is whatever the calling code happens to produce.
3. Git worktree isolation for parallel subagent writes. Cheap, kills the race conditions, and gives you a natural human-review gate on dirty worktrees.

Supporting Evidence From Other Sources

The Contradiction Worth Surfacing

The SkCC paper attributes 40% variance to formatting. Wix reports docs beating skills. These are in tension. If formatting swings results that much, docs are format-sensitive prose and the Wix result may be measuring how well Wix's docs happen to be formatted, not an inherent advantage of docs over skills. Correlation, not causation established. The cleanest read is to ablate formatting on both docs and skills on your own stack before committing either way.

The agent reliability ceiling is tool-definition staleness and harness design, not model quality. Six layers, maybe three load-bearing outside Anthropic's stack—steal those three.

The Bet, Made Explicit

Anthropic committed $1.8B to Akamai for edge inference on RTX Pro GPUs at CDN POPs and an estimated $200B to Google Cloud for training and bulk inference in the same window. Read this as architectural conviction, not hedging: two workload classes need two serving substrates.

• Answer inference (user-facing chat, IDE completions): latency-bound, rewards raw speed. Cerebras WSE-3 reports 21 PB/s memory bandwidth against H100's 3.35 TB/s. That is a 6,000x ceiling on the memory-bound decode step. The thing this number doesn't tell you is how much of real chat traffic is actually decode-bound once you account for prefill and routing overhead.
• Agentic inference (autonomous loops, batch eval, multi-step reasoning): cost-bound, rewards $/token on commodity DRAM. No human is waiting. The binding constraint is KV cache capacity and tool-call latency, not time-to-first-token.

Hardware Economics by Regime

Nvidia's Dynamo framework formalizes the split by disaggregating prefill from decode onto different hardware profiles. Reported gain: 2-4x goodput on long-context workloads. That range assumes clean request-shape distributions. On mixed production traffic, plan for the low end and treat anything above it as upside.

What This Changes

Ben Thompson's claim: by year-end, teams running more than 10K requests/day will run two serving stacks, and the ones that don't will pay 30-50% more per token than necessary. I would commit to that directionally. Half of 30-50% is still worth the engineering. If the penalty lands at 10%, dual-stack does not pay for itself. The SpaceX handoff of 220K+ GPUs (Colossus 1) to Anthropic suggests training-class clusters are becoming fungible with inference, which puts previously training-allocated capacity into the inference market.

The geopolitical footnote: if agentic inference runs well on older-node silicon plus commodity DRAM, export controls lose most of their bite for the largest compute market.

If agents don't need to be fast, the inference bill shouldn't look like it does. The stack that served ChatGPT will not serve a million autonomous Claude Code sessions at the same unit economics.