The Engineer

The Cascade

Disclosures this week hit every layer between the internet and the data: reverse proxy (NGINX), ingress controller (Traefik), GitOps controller (Argo CD), AI gateway (LiteLLM), config server (Spring Cloud Config). LiteLLM went from disclosure to active exploitation in 4 hours. It is now on CISA KEV.

If Traefik fronts services that assume auth happened upstream, that assumption is wrong. CVSS 10 means the rubric ran out of knobs.

The Chaining Problem

The chain is not theoretical. Here is what actually happens in a realistic topology:

1. Traefik auth bypass reaches any internal service. mTLS terminated at the edge is void.
2. Spring Cloud Config traversal reads cloud credentials straight off the config server.
3. Argo CD secret extraction hands any authenticated user plaintext K8s secrets, which is cluster-admin on every managed cluster.
4. LiteLLM unauthenticated DB query dumps every stored LLM provider API key.
5. Stack Linux Copy Fail (CVE-2026-31431) on top. It modifies in-memory files invisibly to AIDE, Tripwire, and dm-verity. Any foothold escalates to root without tripping file integrity alerts.

The NGINX Factor

The 18-year-old NGINX rewrite module RCE is unauthenticated and pre-auth. The request is handled before application middleware, rate limiting, or auth ever sees it. The rewrite module ships in roughly 90%+ of production NGINX deployments. Every fork, every vendored copy, every appliance shipping a pinned NGINX from 2014 is in scope. Check the binaries, not the package manager.

Patch Priority

Copy Fail: The Invisible Escalation

CVE-2026-31431 is the one to read twice. An unprivileged user writes 4 bytes into in-memory copies of readable files. On-disk files are never touched, so AIDE, Tripwire, dm-verity, and container image verification see nothing. Every Linux distro since 2017 is affected. Highest exposure: multi-tenant Kubernetes, shared CI runners, and container platforms with shared kernels.

What Changed

Anthropic is removing the implicit subsidy that made Claude-via-third-party-harness 70-90% cheaper than direct API pricing. Starting June 15, usage through Zed, Cursor, Conductor, Openclaw, and T3 Code draws from a separate credit pool sized to your plan value. After that pool drains, you pay full API rates. The $200/month plan now buys exactly $200 of API credit for programmatic work. Heavy users were pulling $700-2,000+ of API-equivalent value out of it.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost.

The Compounding Factors

• Opus 4.7 tripled image processing costs. Any vision pipeline needs recosting before the cutover, not after.
• 80x demand overshoot caused silent quality degradation. No error codes, no 5xx. Just worse output, which is the failure mode that does not page anyone.
• No SLAs exist. ServiceNow assigned dedicated headcount to monitor Claude usage through external tooling because Anthropic ships no native attribution.
• 220K GPU lease from Colossus 1 signals relief on the capacity side. The lease is from xAI, whose CEO publicly called Anthropic "misanthropic and evil." Plan accordingly.

OpenAI's Counter-Play

Two months of free Codex for any enterprise that switches, deadline July 13. That is a short runway to benchmark a different agent on a real codebase. Evaluate now even if you do not switch. The comparison data has value regardless of the outcome.

The Provider Abstraction Is No Longer Optional

Ramp data shows Anthropic at 34.4% vs OpenAI at 32.3% of enterprise spend. The split means either vendor's pricing or availability can degrade without warning. The pattern from multiple sources is consistent: Anthropic for complex reasoning at 61% of spend, Google Flash for high-volume cheap work at 38% of token volume. A unified routing layer with per-request model selection is the production architecture. It is not a premature optimization.

Cost Attribution Infrastructure

ServiceNow burned through their annual Anthropic budget ahead of schedule because Anthropic ships no per-user or per-feature telemetry. Minimum viable control plane: tag every call at the gateway with team, feature, and request ID. Log input and output token counts per call. Aggregate by tag. Trip a breaker when spend crosses thresholds.

Architecture Worth Understanding

Claude Code's /goal command runs multi-turn coding sessions to completion without human checkpoints. A separate Haiku model decides when the goal is met. The evaluator reads the conversation transcript. It does not stat files, run tests, or check that the diff compiles. If the coding model claims the tests pass and the transcript stays internally consistent, the goal is satisfied.

There is no built-in token budget. The loop terminates when the evaluator says terminate, or when something upstream kills it. In CI, "the evaluator decides" is the entire control plane, and the evaluator is judging prose.

The Runaway Cost Problem

Context grows every turn. Each turn pays for cumulative context. A loop that looks like progress at turn five becomes a $200 invoice at turn forty. The fix is mechanical. Wrap invocations in a wall-clock timeout and a token meter you control. Poll the status overlay from a wrapper script. It exposes turn count and token spend. SIGTERM when the threshold trips.

Recommended Budget Heuristic

Cap the token spend at the cost of one engineer-hour. If the agent cannot finish for that price, you want to know before it spends ten of them.

The Composability Play

/goal gets useful when composed with the other primitives:

• PostToolUse hooks running lint and type-check after every edit
• Auto Mode skipping confirmation prompts
• CLAUDE.md at project root read every turn, so persistent constraints do not eat goal character budget
• Stop Hooks for boundary enforcement

That gives a self-correcting loop. Agent writes, linter fires, output lands in context, agent fixes, proceeds. For well-scoped refactors (migrating one API pattern, upgrading a test framework, converting type annotations), the loop works. Compound objectives break it.

Persona Drift Compounds the Risk

Li et al., COLM 2024 measured persona drift starting within 8 dialogue rounds. In long-running /goal sessions, the system prompt's share of attention decays as the context fills. The agent keeps running. It just stops following the constraints. Embed a distinctive canary token the agent should always emit under a specific trigger. When the canary disappears, the session is drifting. One regex per turn catches it.

Safe Adoption Path

1. Start with read-heavy goals: changelog generation, pattern analysis, documentation. Blast radius on failure is low.
2. Write-heavy goals (refactors, migrations) only after CLAUDE.md guardrails, PostToolUse validation hooks, process-level timeouts, and a test suite verified to catch the breakage you care about.
3. Phrase goals as verifiable conditions: "All tests in package X pass when pytest -k X is run as the final command and its exit code is zero in the transcript." Not "Refactor the auth module."