The Engineer

The Stack Is Compromised at Every Layer Simultaneously

This week delivered critical vulnerabilities at every consecutive layer of a standard cloud-native stack: ingress, GitOps controller, AI gateway, config server, cache, and kernel. The chaining potential is what makes this ugly, not any single CVE.

Traefik bypass reaches an internal service → Spring Cloud Config traversal reads cloud credentials → those credentials reach the data lake → Apache Polaris credential-broadening expands access → data leaves. That is one viable path. There are shorter ones.

NGINX: 18-Year Unauthenticated RCE

The rewrite module runs in roughly 90%+ of production NGINX configs. Anyone who has written rewrite ^/old-path /new-path or used try_files is affected. The bug is pre-auth — it executes before your application's middleware, rate limiting, or input validation ever see the request. Defense in depth does not help when the first hop is already compromised. Eighteen years undetected means every fork, every vendored copy, every appliance shipping pinned NGINX from 2014 is in scope. Check the binaries, not just the package manager.

Traefik: CVSS 10.0 Authentication Bypass

A perfect ten means the scoring rubric ran out of knobs to turn. ForwardAuth, BasicAuth, and all auth middleware configurations are decorative right now. Every internal service behind Traefik is effectively internet-facing with no authentication. This is an architecture flaw in how middleware chains evaluate, not a buffer overflow — pointing to a design issue that may recur.

Argo CD: Plaintext Kubernetes Secret Extraction

CVE-2026-42880 (CVSS 9.6) in versions 3.2.0-3.2.11 and 3.3.0-3.3.9 lets any authenticated user read plaintext Kubernetes secrets. Argo CD typically runs with cluster-admin RBAC. That means database passwords, cloud credentials, TLS private keys are all reachable by a junior dev with Argo CD read access. Patching is necessary but not sufficient — rotate every secret Argo CD could reach.

LiteLLM: Active Exploitation (CISA KEV)

CVE-2026-42208 went from disclosure to active exploitation in 4 hours. That number constrains any reasonable patching SLA. LiteLLM gateways typically store API keys for OpenAI, Anthropic, and local models. Assume stored keys are compromised if running versions 1.81.16-1.83.7.

The Compound Risk

Layer the Linux kernel Copy Fail LPE (CVE-2026-31431) on top and any application-level foothold escalates to root — invisibly. Copy Fail modifies in-memory file contents without touching disk, meaning AIDE, Tripwire, dm-verity, and container image verification all see nothing. Every distro since 2017 is affected. Multi-tenant Kubernetes clusters and shared CI runners are highest risk.

The Implicit Subsidy Is Dead

Anthropic moved programmatic Claude usage to dollar-equivalent API rates. The 70-90% implicit discount that anyone routing Claude through Cline, OpenCode, Zed, or a custom harness had been quietly enjoying is gone. The $200/month plan now buys exactly $200 of API credit for programmatic work. Heavy users were previously pulling $700-2000+ of API-equivalent value off the same plan.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost, which is the one engineers are expected to not notice until the finance review lands.

The Mechanism

The discount was never a published SKU. It was a byproduct of how native clients were billed, and third-party harnesses rode the same rail. Starting June 15, third-party usage through Zed, Conductor, Openclaw, and T3 Code gets a separate credit pool equal to plan value. After that pool drains, you are on API rates. A team of 10 engineers on Pro plans running Claude through Zed eight hours a day sees its bill move 3-5x.

Opus 4.7 Compounds the Problem

Separately, Opus 4.7 tripled image-processing costs with no announced performance justification. If vision sits on the hot path (document processing, visual QA, multimodal RAG), the pipeline math from last quarter no longer holds. The fix is routing. Haiku or Sonnet for the first pass. Opus only on the cases that actually need it.

The Capacity Story Behind the Pricing

Anthropic planned for 10x growth and got 80x. Claude Code features were silently nerfed for paid users. Corporate accounts were banned without warning. The 220K GPU Colossus 1 lease from xAI/SpaceX signals relief is coming, but the precedent is now in the record: when demand exceeds supply, the product degrades without disclosure.

OpenAI's Counter-Play

Two months of free Codex for any enterprise that switches inside 30 days. Window closes July 13. Even a no-switch outcome leaves you with comparison data on representative workloads. Run it now.

Cost Attribution Is No Longer Optional

ServiceNow burned through its entire annual Anthropic budget by May. The CDIO assigned dedicated headcount to watch usage through external tooling because Anthropic provides no per-user, per-feature token consumption data and no SLAs. Minimum viable response: tag every call at the gateway with team, feature, and request ID; log input and output token counts per call; aggregate by tag; enforce circuit breakers.

The Capability Jump Is Discrete, Not Gradual

UK AISI confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber achieved 'full network takeover' in controlled hacking tests. The previous generation topped out at 'advanced persistence': foothold without domain control. That is a discrete jump, not a curve. Mythos cleared both of AISI's hardest challenges. AISI is now building harder benchmarks because the current ones are saturated.

If you're running security architecture reviews with threat models that assume human-speed attacker behavior — reconnaissance over days, lateral movement over hours — those assumptions are now invalid for your highest-capability adversaries.

Converging Evidence

What This Breaks

The working assumption of 30-90 days from CVE publication to widespread exploitation is stale for anything an AI can chain. The LiteLLM 4-hour disclosure-to-exploitation window is the new reference point, not the exception. Mean-time-to-patch measured in weeks is an order of magnitude too slow for internet-facing services.

The Harness Insight

Mozilla's 271 bugs came from years of fuzzing infrastructure built up incrementally (ASAN, coverage feedback, triage pipelines). The model sits at the top and gets the credit. The harness is the real asset. DepthFirst's Open Defense Initiative found 12 memory corruption bugs in FFmpeg for $1K compute where Anthropic's Mythos missed them at $10K. Model selection matters less than target-specific decomposition.

The Defense Architecture

When the adversary operates at machine speed, detection-to-response must also operate at machine speed. First-line containment (network segmentation, credential scoping, anomaly-triggered isolation) needs to fire without human approval. The Foxconn case study is what the human-speed alternative looks like: 20 months of dwell time before detection, 8TB exfiltrated, factory operations disrupted.

The Majority Case Flipped

Vercel's AI Gateway numbers (200K+ teams, 7 months of production traffic) settle the argument: 59% of token volume is now agentic. Chat completions are the minority case. An architecture that assumes single turn in, single turn out, stateless between calls is optimizing for 41% of the workload. We learned this the slow way after a naive retry policy compounded a six-step agent into thirty-eight calls in staging.

The Routing Pattern Is Now Standard

Production teams bifurcate on two axes. Anthropic captures 61% of spend on Opus for complex reasoning chains. Google captures 38% of token volume on Flash for cheap high-throughput work. Spend and volume are separate budgets on the same invoice. Conflate them and you optimize the wrong one. Minimum viable router: token count under 500 plus task type of classification goes to Flash, everything else to Opus. We started single-model and the bill made the decision for us.

Architectural Convergence on Durable Execution

The last week made the convergence visible. Cline shipped a rebuilt SDK with agent teams and scheduled jobs. LangChain launched Managed Deep Agents on SmithDB with 12-15x faster nested trace access. Cursor extended cloud agents to a full dev environment lifecycle. Duet Agent proposed state-machine orchestration for month-long jobs. The shared answer is Temporal-style durable execution: explicit state machines, checkpoints, hierarchical decomposition, observable intermediate state. Our first attempt bolted recovery onto a chat loop with a Redis dict. It survived two outages then lost a job mid-tool-call. Rewrite, not patch.

Chat-loop agents cannot hold state across real work. Retrofitting recovery onto a stateless prompt loop is a rewrite, not a patch. Build on the durable execution pattern now.

Claude Code /goal: Powerful but Unbudgeted

The /goal command runs multi-turn sessions to completion with a Haiku evaluator that only reads conversation transcripts. It cannot stat files, run tests, or check git status. No built-in token budget, so runaway sessions are the default failure mode. The fix is not exotic: wrap invocations in a wall-clock timeout and a token meter you control. Cap at the cost of one engineer-hour. If the agent cannot finish under that, you want to know before it spends ten. We caught ours at $46 of Opus on a duplicate-detection task that should have been twelve cents.

MCP Token Overhead: 30% Waste

Raw MCP without a knowledge graph layer costs 30% more tokens per the Glean benchmark. Each tool call re-tokenizes the system prompt, re-sends the tool schema, re-streams context the previous hop already paid for. At 59% agentic volume that is the cost structure, not a rounding error. The fix: pass trace IDs on MCP envelopes, deduplicate system prompt payloads across hops, cache the prefix KV. Two headers and a middleware.