The Engineer

The Compound Threat

One week. Critical CVEs on every layer of a standard cloud-native stack: ingress (NGINX, Traefik), GitOps controller (Argo CD), AI gateway (LiteLLM), config server (Spring Cloud Config), kernel (Copy Fail). No single one is the story. They chain.

Realistic attack path: Traefik auth bypass reaches an internal service → Spring Cloud Config traversal reads cloud credentials → those credentials reach Argo CD → Argo CD's missing authorization exposes plaintext K8s secrets for every cluster it manages → Copy Fail escalates to root without touching disk.

What Each Bug Actually Does

Why Copy Fail Is Different from Dirty Frag

Dirty Frag was covered last week. Copy Fail is a separate bug. Mechanism: any unprivileged user writes 4 bytes into the in-memory copy of any readable file. The on-disk file is never touched. AIDE, Tripwire, dm-verity, container image verification all read disk. They see nothing. Every Linux distro since 2017 is in scope. On a shared kernel, an attacker rewrites host system files without a single alert firing.

The NGINX Dwell Time Problem

Eighteen years in the codebase. The rewrite module isn't obscure. It is in virtually every NGINX config. Every fork, vendored copy, and appliance shipping pinned NGINX from 2014 is in scope. Check the binaries, not the package manager. A PoC will land on GitHub inside a week.

Patch Order

1. Traefik — internet-facing, CVSS 10, exploit surface is the entire request path
2. NGINX — internet-facing, unauthenticated, pre-auth execution
3. LiteLLM — already on KEV, actively exploited; if you cannot patch today, take it offline
4. Argo CD — usually internal, but patching is not sufficient: rotate every secret Argo CD could reach
5. Copy Fail — local access required; CI runners and shared container hosts first

What Actually Changed

Anthropic moved programmatic Claude usage to dollar-equivalent API rates. The 70-90% implicit discount when routing Claude through Cline, OpenCode, or a custom harness is gone. Effective cost per token is up 3-10x overnight. The $200/month plan now buys exactly $200 of API credit for programmatic work. Heavy users were pulling $700-2000+ of API-equivalent value out of that same plan.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost.

The Compound: Opus 4.7 Image Costs

Opus 4.7 separately tripled per-image token accounting. Any vision pipeline that fans out across a batch pays 3x for the same bytes. If vision sits on the hot path — document processing, visual QA, multimodal RAG — last quarter's cost model is wrong by a factor of three.

Why This Happened

Anthropic planned for 10x growth and got 80x. The capacity math broke. Claude Code users on paid plans had features silently nerfed. Corporate accounts were banned without warning. Some paid subscribers found out their Claude Code access was actually a 7-day trial, never disclosed as such. The 220K GPU lease from Colossus 1 (H100/H200/GB200 mix) is coming online. The behavior under load — degrade without disclosure — is now precedent.

The Counter-Play

OpenAI shipped a response the same week: two months of free Codex for any enterprise that switches inside 30 days. Deadline July 13. Short window, cheap experiment. Ramp puts Anthropic at 34.4% vs OpenAI at 32.3% of business customers. The lead change just landed and OpenAI is paying to flip it back.

The Decision Framework

• If the harness is thin and prompts are portable: run the Codex benchmark at zero cost. Even a no-switch outcome gives comparison data for the next negotiation.
• If the harness is tuned to Claude's tool-use quirks: porting is not two months of work. Price Claude Code lock-in against full API rates, not last quarter's bill.
• Regardless: implement per-request cost accounting in the routing layer. Build vision-capable fallbacks (Gemini 2.x, GPT-4o). At 34.4 vs 32.3, the multi-provider abstraction is no longer optional.

ServiceNow's Cautionary Tale

ServiceNow — a $9B+ revenue company — burned through its entire annual Anthropic budget by May. They assigned dedicated headcount to watch usage through external tooling they wrote themselves, because Anthropic ships no per-user or per-feature telemetry, no SLAs, and unpredictable pricing. If their controls did not catch this in time, default posture should be that nobody's will.

The Production Data

Vercel's AI Gateway report covers 200K+ teams over 7 months of real traffic. Agentic workloads are now 59% of all token volume. Chat completions are the minority case. That changes billing math, observability shape, and what counts as a failure.

If the billing dashboard still groups by request, it is measuring the wrong thing. Agentic traffic means sessions of 10-50 API calls before anything user-visible comes out the other end.

The Cost Structure Problem

Off-the-shelf MCP without a knowledge graph layer costs 30% more tokens per the Glean benchmark. Here is what actually happens on each hop: the system prompt re-tokenizes, the schema re-sends, the context the previous hop already paid for re-streams. On a five-hop plan that is 30% waste per session, scaling with fan-out, not user count. The fix is mechanical. Pass a trace or span ID on the MCP envelope. Dedupe system prompt payloads across hops. Cache prefix KV if the provider exposes it.

The Provider Mix Is Now Bimodal

Anthropic takes 61% of spend, mostly Opus for reasoning. Google takes 38% of token volume, mostly Flash for throughput. Same invoice, two different budgets. Routing Opus for classification burns money. Routing Flash for multi-step reasoning returns garbage. The routing layer is not optimization. It is correctness.

Claude Code /goal: No Budget, No Ground Truth

The /goal command runs multi-turn coding sessions to completion. The evaluator is Haiku, and it only reads the conversation transcript. It cannot stat a file, run tests, or check git. If the coding model claims tests pass and the transcript is internally consistent, the goal is satisfied. The repo state is irrelevant to that decision. There is no built-in token budget. Runaway sessions are the default failure mode on ambiguous goals.

The Minimum Viable Wrapper

• Wall-clock timeout plus a token meter polling the status endpoint, SIGTERM at threshold
• Cap per-tool retries. The default is generous. Most failures do not improve on attempt 4
• Run /goal against a scratch branch with a hard file allowlist
• Post-step, run the real test suite externally instead of trusting transcript claims

Architecture Convergence: Durable Execution

One week of shipping. Cline rebuilt its SDK with agent teams and scheduled jobs. LangChain launched Managed Deep Agents on SmithDB, 12-15x faster nested traces. Cursor extended cloud agents with full dev environment lifecycle. The consensus shape is Temporal-style durable execution: explicit state machines, checkpoints, hierarchical decomposition, observable intermediate state. Retrofitting recovery onto a stateless prompt loop is a rewrite, not a patch.