The Engineer

The Attack Chain That Wasn't Hypothetical

Five critical vulnerabilities disclosed this week line up against a standard cloud-native deployment path: ingress → routing → config → deployment → kernel. The chain is not theoretical. Each bug is independently critical. Together they walk from the internet to cluster-admin without a detour.

If NGINX is terminating TLS in front of an application, the application's own auth does not help. The request is handled before the app sees it.

The Stack, From Outside In

Why This Week Is Different

The NGINX bug lived in the rewrite module for 18 years. The rewrite module ships in roughly 90%+ of production NGINX deployments. "We don't use that feature" is not a valid deprioritization. Anyone who has ever written rewrite or try_files is exposed. It's pre-auth, so defense-in-depth behind NGINX buys nothing.

Traefik scored CVSS 10.0, which means the rubric ran out of knobs. If ForwardAuth, BasicAuth, or any auth middleware sits on Traefik, those controls are decorative right now. Every internal service behind it is effectively internet-facing with no auth.

The Argo CD flaw is the quieter and worse of the pair for most threat models. The controller typically holds cluster-admin on every cluster it deploys to. Any authenticated user on Argo CD 3.2.0-3.2.11 or 3.3.0-3.3.9 can read every secret the controller touches: database passwords, cloud credentials, TLS private keys.

The Compound Path

The realistic chain: Traefik bypass reaches an internal service. Spring Cloud Config traversal reads cloud credentials. Those credentials reach Argo CD. Extract K8s secrets. Own the cluster. Shorter path: Traefik bypass → internal Argo CD API → extract secrets → done. Layer the Linux kernel LPE on top and any container foothold escalates to host root.

LiteLLM on CISA KEV means exploitation is observed in the wild, not theoretical. It was weaponized within 4 hours of disclosure. If you run LiteLLM between 1.81.16 and 1.83.7, assume stored API keys and prompt logs are compromised. Rotate accordingly.

The Mechanism

Anthropic repriced programmatic usage at dollar-equivalent API rates. The $200/month plan now buys exactly $200 of API credit. Heavy users on the old implicit-unlimited subscription were pulling $700-2,000+ of API-equivalent value. The discount was never a published SKU. It was a side effect of how native clients were billed, and third-party harnesses (Cline, Zed, OpenCode, custom SDKs) rode the same rail. The rail closes June 15.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost.

Why It's Happening Now

Anthropic planned for 10x growth and got 80x. The evidence is in the product: Claude Code degraded silently, corporate accounts were banned without warning, and the $20/month plan quietly became a 7-day trial for some subscribers. None of it was announced up front. In SRE terms, this is an upstream service degrading without returning 5xx. Monitoring does not catch it. Fallbacks do not fire.

The 220,000 GPU Colossus 1 lease (H100/H200/GB200 mix from xAI) should bring relief. The catch is in the counterparty. The hardware is leased from a company whose CEO has publicly called Anthropic "misanthropic and evil." Leases can be terminated. Probability low. It belongs in a 12-month plan anyway.

The Counter-Play

OpenAI offered two months of free Codex to any enterprise that switches within 30 days. The promo expires July 13. Ramp data puts Anthropic at 34.4% of businesses against OpenAI at 32.3%, the first lead change in the series. OpenAI is trying to flip it before it sets. The useful read here is the free benchmark window: run Codex against a real workload at zero cost, regardless of whether the migration ultimately happens.

Opus 4.7 Vision Costs Tripled

Separately, Opus 4.7 tripled image processing costs with no announced performance justification. If vision sits on the hot path, last quarter's pipeline math is dead. The fix is routing: Haiku or Sonnet for first pass, Opus only on cases that actually need it.

The Architectural Response

Anthropic offers no SLAs, no native per-feature telemetry, and no contractual response time commitments. ServiceNow, a $9B+ revenue company, burned through its entire annual Anthropic budget by May and assigned dedicated headcount to watch usage through external tooling. If ServiceNow cannot manage this passively, a smaller team will not either.

1. Tag every API call at the gateway with team, feature, and request ID
2. Log input/output token counts per call, not per day
3. Implement per-team budget breakers that trip before month-end
4. Keep one alternative provider warm enough that switching is a config change

The Production Data

Vercel published seven months of AI Gateway telemetry across 200K+ teams. The headline number: 59% of all token volume is now agentic. Multi-turn sessions, tool calls, retries, reasoning chains that fan out to dozens of API calls before anything user-visible lands. That is the majority case. An architecture that still assumes chat — one turn in, one turn out, no state between calls — is tuned for the minority workload.

The provider mix is the second signal. Anthropic captures 61% of dollar spend, mostly Opus on hard reasoning. Google captures 38% of token volume, mostly Flash on cheap throughput. Two different budgets, one invoice. Conflate them and you optimize the wrong one.

Agentic traffic does not behave like chat traffic. A chat request is one model, one prompt, one response. An agent run is a loop: plan → tools → summarize → escalate → retry. The gateway sees the leaves, not the tree.

Claude Code /goal: Autonomy Without Guardrails

Claude Code's /goal command runs multi-turn coding sessions to completion with no human checkpoints. Two design decisions are worth reading carefully:

• The Haiku evaluator only reads the conversation transcript. It cannot ls the working directory, run git diff, or execute tests. If the coding model says the migration ran and the tests pass, and the transcript is internally consistent, the goal is satisfied. Whether the repo is in that state is a separate question.
• No built-in token budget. The loop terminates when the evaluator says terminate, or when something upstream kills it. In CI, "the evaluator decides" is the entire control plane.

The failure mode is a $200 invoice at turn forty that looked like progress at turn five.

The Fix Is Not Clever

Wrap invocations in a process-level token meter. Poll the status overlay; it exposes turn count and token spend. SIGTERM when cumulative input tokens cross a threshold priced at one engineer-hour. Run against scratch branches with hard file allowlists. Phrase goals as verifiable external conditions: "All tests in package X pass when pytest -k X runs as the final command and its exit code is zero in the transcript." Not "refactor the auth module."

The Infrastructure Pattern That's Converging

One week of shipping: Cline rebuilt the SDK with agent teams and scheduled jobs. LangChain launched Managed Deep Agents on SmithDB, claiming 12-15x faster nested trace access. Cursor extended cloud agents with full dev environment lifecycle. ServiceNow exposed Action Fabric through MCP servers. The consensus architecture is Temporal-style durable execution: explicit state machines, checkpoints, hierarchical decomposition, observable intermediate state.

The token waste is quantified. Raw MCP without a knowledge graph layer costs 30% more tokens on Glean's benchmark. At 59% of volume agentic and spend above $5K/month, a context pruning layer pays back in weeks. Pass a trace/span ID on the MCP envelope and let the gateway dedupe system prompt payloads across hops in the same graph.