The Engineer

Three independent criticals in one patch cycle

Three unrelated critical CVEs landed the same week. NGINX's rewrite module carries an unauthenticated RCE that has sat in the code path for 18 years. Traefik's authentication middleware scored a CVSS 10.0 bypass. Argo CD's authorization hands out plaintext Kubernetes secrets at CVSS 9.6. This is coincidence, not coordination, which is the worse reading. Any two of these chain into full cluster compromise.

NGINX: the first hop is already owned

The rewrite module is not optional. It ships in 90%+ of production deployments. Anyone using rewrite, try_files, or URL manipulation runs it. The RCE is unauthenticated and executes before the application's auth middleware, rate limiting, or input validation sees the request. Defense in depth does not help when the outermost layer is the one that fell. Every fork, vendored copy, and appliance pinned to NGINX from any point in the last 18 years is in scope. Check the binaries, not the package manager.

Traefik: auth middleware is decorative

CVE-2026-35051 and CVE-2026-39858 both score 10.0. The CVSS rubric does not go higher. ForwardAuth, BasicAuth, and any auth middleware configuration is bypassed entirely. Every internal service behind Traefik is effectively internet-facing with no authentication until patched. The flaw is in how the middleware chain is evaluated, not a buffer overflow. That points at architecture, not a memory bug.

Argo CD: the secrets are readable

CVE-2026-42880 affects versions 3.2.0-3.2.11 and 3.3.0-3.3.9. Any authenticated user can extract plaintext Kubernetes secrets, and Argo CD typically runs with cluster-admin RBAC. Database passwords, cloud credentials, TLS private keys, and inter-service tokens are reachable by anyone with basic Argo CD access. Patching is necessary and insufficient. Rotate every secret Argo CD could reach.

The chain that matters

Traefik bypass to internal Argo CD API to plaintext K8s secrets to cluster ownership. Total required privileges: none.

Add LiteLLM (on CISA KEV, exploited in the wild within 4 hours of disclosure, versions 1.81.16-1.83.7) and Spring Cloud Config (directory traversal, CVSS 9.1, reads cloud credentials from the config server), and the realistic attack paths multiply. The Foxconn incident this week, with 8TB exfiltrated and factories disrupted, is what this looks like when the patch existed and was not applied in time.

Patch order

1. NGINX. Remote, unauthenticated, internet-facing. PoC expected within days.
2. Traefik. Same reasoning. If patching requires downtime, put a WAF in front temporarily.
3. Argo CD. Usually internal. After patching, rotate every accessible secret.
4. LiteLLM. If running versions 1.81.16-1.83.7, take it offline now and rotate all stored LLM API keys.
5. Linux kernels. Schedule this week for Copy Fail, which is invisible to every file integrity tool.

The implicit subsidy is dead

Anthropic moved Claude's programmatic usage to dollar-equivalent API rates. If your harness is Cline, OpenCode, Zed, or anything you wrote yourself, you were paying 10-30% of list. That arbitrage is over. The $200/month plan now buys $200 of API credit. Heavy users were pulling $700-2000+ of API-equivalent value off the same SKU.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost.

The Mechanism

The discount was never a published SKU. It was a side effect of how native clients got billed. Third-party harnesses rode the same rail. Remove the rail, harnesses pay list price. The code on your side did not change. Starting June 15, third-party tools get separate credit pools sized to plan value, then fall through to full API rates. The 50% rate limit bump for two months is the goodwill buffer.

Compounding Factor: 80x Capacity Overshoot

Anthropic planned for 10x growth and got 80x. The shortfall surfaced as silent product degradation. Not error codes. Not a degraded-mode header. Unannounced feature removal and account bans. Claude Code users on paid plans had features nerfed with no notice. In SRE terms: upstream degrading without returning 5xx. Monitoring does not catch it. Fallbacks do not fire.

The Counter-Play

OpenAI is offering two months free Codex for enterprise teams that switch within 30 days, window closing July 13. That is a short runway to benchmark a different agent against a real codebase. Ramp puts the split at Anthropic 34.4%, OpenAI 32.3%. Neither vendor owns the floor.

What This Means Architecturally

The 220K GPU Colossus 1 lease says relief is on the way. The precedent says the vendor degrades without disclosure when supply is tight. Both of these can be true at once. ServiceNow burned through their annual Anthropic budget by May. If their controls did not catch it, assume yours will not either.

The Token Accounting Fix

Strip the harness on one representative workload. Log input tokens, output tokens, and tool-call fanout. Compare harness overhead against the direct API path. That delta, not the headline price change, is the number that decides whether to optimize the harness, switch providers, or accept the new cost structure.

The majority case flipped without a migration

Vercel's AI Gateway shipped seven months of production data across 200K+ teams. Agentic workloads are 59% of token volume now. Chat completions are the minority case. A request handler tuned for single-turn is tuned for 41% of the traffic.

Why the math changed

Agent traffic breaks every assumption the single-shot path was built around:

• Cost attribution: one user action fans out to 10-50 API calls. Per-request billing hides the unit economics.
• Failure handling: a tool call that fails at step 7 of 12 needs state recovery, not a retry.
• Provider routing: the same run wants Opus for planning and Flash for extraction. Pick one provider, eat both costs.
• Token waste: raw MCP without context dedup costs 30% more tokens on the Glean benchmark. System prompts and tool schemas re-serialize on every hop.

What the routing data actually shows

The split: Anthropic takes 61% of dollar spend (Opus, planning) while Google takes 38% of token volume (Flash, throughput). Production teams bifurcate cost and quality inside the same agent run. Single-provider stacks leave both knobs untouched.

The model abstraction layer is now the cost-optimization surface. Calling Opus for classification is burning money. The working pattern is task-complexity assessment → model selection → execution.

Convergence on durable execution

Three teams shipped the same shape this week. Cline SDK (agent teams, subagents, cron, checkpoints), LangChain Managed Agents on SmithDB (12-15x faster nested traces via DataFusion + Vortex), and Cursor cloud agents (full dev environment lifecycle with rollback). It rhymes with Temporal-style durable execution: explicit state machines, checkpoints, hierarchical decomposition, observable intermediate state. I tried bolting recovery onto a stateless prompt loop last quarter. It was a rewrite, not a patch.

The production reference: Abridge

Abridge runs 80M+ clinical conversations on Kafka → Temporal → CRDTs, with a model constellation routing cheap models for triage and expensive models for reasoning. The stack is boring distributed-systems primitives, not novel AI frameworks. Boring is what survives a pager rotation.

The 30% token tax

MCP gives the agent tool connectivity. It does not give the agent any opinion about which context matters. An agent with 20 tools pulling results from 5 stuffs 60-70% irrelevant context into the prompt on every turn. The fix: pass a trace/span ID on the MCP envelope, let the gateway dedupe system prompt and schema payloads across hops, cache prefix KV. Two headers and a middleware. Savings land on the first billing cycle. Above $5K/month on agentic calls, the context pruning layer pays back in weeks.