The Engineer

The Compound Attack Chain

Six critical CVEs landed in the same cycle, and they sit on consecutive layers of a normal cloud-native stack. That is not six bugs. That is a kill chain where each compromised layer is the foothold for the next.

Realistic path: Traefik bypass reaches internal service → Spring Cloud Config traversal reads cloud credentials → Argo CD API extracts K8s secrets → own the cluster. Layer the kernel LPE and any foothold escalates to root.

The Specifics

Why This Week Is Different

PraisonAI went from advisory to working exploit in 4 hours. Two readings fit the data: attackers were pre-positioned and waiting for CVE validation, or there is a weaponization pipeline turning advisories into exploits in under four hours. Either way, "patch critical within 30 days" is an order of magnitude too slow for anything internet-facing. Google researchers and AISI testing both confirm AI-assisted exploit generation works. The disclosure-to-weaponization gap is hours.

Patch Order

1. Traefik — internet-facing, CVSS 10.0, auth is completely void. If patching requires downtime, put a WAF in front as emergency measure.
2. NGINX — pre-auth RCE at the TLS termination point. The rewrite module is in ~90% of configs. Check vendored copies and appliance firmware, not just package managers.
3. Argo CD — patch to 3.2.12+ or 3.3.10+. The patch is not the fix. Rotate every secret Argo CD could reach. If External Secrets Operator isn't deployed, this is the forcing function.
4. LiteLLM — upgrade and rotate all stored LLM provider API keys. Assume prompt logs and keys are compromised.
5. Spring Cloud Config — add network policies ensuring config server is only reachable from app services.
6. Kernel (Copy Fail) — prioritize multi-tenant hosts, CI runners, and container platforms. This LPE is invisible to AIDE, Tripwire, dm-verity, and container image verification because it modifies in-memory copies without touching disk.

The Copy Fail Stealth Factor

Copy Fail is the one to read carefully. Any unprivileged user can write 4 bytes into the in-memory copy of any readable file. The on-disk bytes do not change. Every major distro since 2017 is affected. A container process can patch host binaries in memory and escalate without tripping a single file integrity check. For container platforms sharing a kernel, the container boundary is not a boundary.

What Changed

Anthropic repriced programmatic Claude usage to dollar-equivalent API rates. The implicit subsidy that made Claude-through-a-third-party-harness the cheap option is gone. Run Claude through Cline, Zed, OpenCode, or a custom SDK wrapper and the effective cost-per-token jumps 3-10x overnight.

The $200/month plan now buys exactly $200 of API credit for programmatic work, where heavy users on the old unlimited-ish subscription were pulling $700-2000+ of API-equivalent value.

Margin over growth. This only pencils out if the goal is showing sustainable unit economics to public-market investors by October.

The Capacity Context

Anthropic planned for 10x growth and got 80x. The capacity math doesn't close. The product is where you can read it:

• Claude Code features quietly trimmed with no changelog entry
• Corporate accounts banned without warning
• A 7-day trial attached to paid plans, undisclosed
• Opus 4.7 tripled image processing costs without a performance story to match

Relief is in transit. 220,000 GPUs in an H100/H200/GB200 mix from Colossus 1 are being onboarded. The precedent still stands: when demand exceeds supply, the product degrades without disclosure. Treat that as a property of the vendor, not an incident.

The Counter-Play

OpenAI offered two months free Codex to any enterprise switching within 30 days, promo closes July 13. Anthropic responded by doubling the 5-hour Claude Code limit and removing peak-hour throttling. Both are time-boxed. Both are worth burning some traffic through to collect data.

The Engineering Response

The reports agree on the shape, disagree on the urgency. ServiceNow burned through its annual Anthropic budget ahead of schedule with dedicated headcount watching the meter. The vendor offers no SLAs and no per-feature usage telemetry. The operational surface they've left blank is the surface you have to instrument yourself, in your code, before the bill arrives.

The Vercel routing data across 200K+ teams reads the same way the math does: Anthropic for complex reasoning (61% of spend), Google/open-source for bulk work (38% of volume). Multi-provider isn't a posture here. It's what the cost curve demands.

The Workload Mix Flipped

Vercel's AI Gateway data covers 200K+ teams over 7 months of production traffic. Agentic workloads are 59% of token volume. Request-response chat is the minority case now. A gateway still tuned for single-turn stateless requests is optimizing for 41% of its traffic.

Cost follows directly. Raw MCP without context-aware routing burns 30% more tokens than knowledge-graph-aware assembly per Glean's benchmark. At 59% agentic share, that 30% is the line item that dominates the bill.

Durable Execution Is the Consensus Pattern

Four independent teams shipped the same architecture in one week:

• Cline SDK (@cline/sdk): open-source agent runtime with checkpoints, subagents, cron scheduling
• LangChain Managed Deep Agents: SmithDB on DataFusion + Vortex, 12-15x faster nested trace access
• Cursor cloud agents: full dev environment lifecycle with scoped egress and isolated secrets
• Abridge production stack: Kafka + Temporal + CRDTs processing 80M+ clinical conversations

Chat-loop agents cannot hold state across real work. The consensus is Temporal-style durable execution: explicit state machines, checkpoints, hierarchical decomposition. Build on that pattern now. Retrofitting recovery onto a stateless prompt loop is a rewrite, not a patch.

Claude Code /goal: Powerful Primitive, Dangerous Defaults

The new /goal command runs multi-turn sessions to completion. Here is what actually happens: the Haiku evaluator only reads the conversation transcript. It cannot stat a file, run tests, or check git. If the coding model claims tests pass and the transcript is internally consistent, the goal is satisfied. Whether the repo agrees is a separate question.

There is no built-in token budget. The loop terminates when the evaluator says terminate, or when something upstream kills the process. A runaway session at turn 40 produces a $200 invoice for context that grew cumulatively every turn.

The Wrapper You Need Before CI

1. Wall-clock timeout plus a token meter polling the CLI's usage events
2. SIGTERM when cumulative input tokens cross a threshold set at the cost of one engineer-hour
3. Cap per-tool retries. The default is generous and most real failures don't improve on attempt 4
4. Run against a scratch branch with a hard file allowlist. A runaway session that can't touch main is a story, not an incident

Security Architecture for Agents

Three teams shipped agent sandboxing this week. OpenAI: Windows sandboxing with DPAPI, ACLs, write-restricted tokens. Perplexity: Firecracker microVMs with VPC-level separation. Microsoft MDASH: 100+ specialized agents in scan/debate/exploit stages. Containers alone won't cut it. The pattern is VM-level isolation, scoped permissions per tool, and prompt injection defense as first-class concerns. A coding agent with repo access is an insider threat. Architect accordingly.