The Engineer

The Chain That Matters

Six bugs land in one week, stacked across the ingress layer (Traefik, NGINX), the deployment layer (Argo CD), the AI infrastructure layer (LiteLLM, Ollama), the config layer (Spring Cloud Config), and the kernel (Copy Fail). Each is bad on its own. Composed, they read like a tutorial for full-cluster compromise from one entry point.

Realistic attack chain: Traefik bypass reaches an internal service → Spring Cloud Config traversal reads cloud credentials → Argo CD secret extraction provides cluster-admin → Copy Fail escalates to root invisibly.

Traefik: CVSS 10.0 Auth Bypass (CVE-2026-35051/39858)

ForwardAuth, BasicAuth, and the rest of the middleware chain are decorative until you patch. This is not a buffer overflow. It is how middleware chains evaluate. Every internal service sitting behind Traefik is now internet-facing with no auth. Patch the perimeter first.

NGINX: 18-Year Unauthenticated RCE in the Rewrite Module

The rewrite module ships in ~90% of production deployments. The bug predates half the security tooling that should have caught it. Every fork, every vendored copy, every appliance pinning NGINX from 2014 is in scope. Read the binary version, not the package manager. A public PoC lands within a week.

Argo CD: Plaintext Secret Extraction (CVE-2026-42880, CVSS 9.6)

Versions 3.2.0-3.2.11 and 3.3.0-3.3.9. Any authenticated user reads plaintext Kubernetes secrets. Argo CD usually runs with cluster-admin RBAC. Patching is not enough. Rotate every secret Argo CD could reach. Audit who held access during the window.

LiteLLM: Actively Exploited, CISA KEV (CVE-2026-42208)

Unauthenticated database query access. On CISA KEV means exploitation observed in the wild, not theoretical. Versions 1.81.16-1.83.7. LiteLLM gateways hold API keys for OpenAI, Anthropic, and local models. Treat those keys as burned. Rotate now.

Copy Fail (CVE-2026-31431): The Invisible LPE

Any unprivileged user can modify in-memory file contents without touching disk. AIDE, Tripwire, dm-verity, and container image verification see nothing. Every Linux distro since 2017 is affected. Multi-tenant Kubernetes and shared CI runners share a kernel across container boundaries. That is where the risk concentrates.

Patch Order

1. Traefik — internet-facing, auth fully bypassed
2. NGINX — internet-facing, unauthenticated RCE, PoC imminent
3. LiteLLM — actively exploited, credentials exposed
4. Argo CD — usually internal, but secret exposure forces rotation
5. Spring Cloud Config — internal, holds other systems' credentials
6. Linux kernels (Copy Fail + Dirty Frag) — local only, invisible to monitoring

What Changed

Anthropic removed the implicit subsidy on non-native tooling. If you ran Claude through Cline, Zed, OpenCode, or a custom harness, a $200/month plan was pulling $700-2000+ of API-equivalent value. Starting June 15, programmatic usage converts to dollar-equivalent API credits at parity. The $200 plan buys $200 of API credit. Heavy users face a 3-10x effective price increase.

Identical prompts and identical code now produce a substantially larger bill. This is a cost regression, not a capability regression. Engineers tend to notice it when finance does.

The Capacity Story Behind the Pricing

Anthropic planned for 10x growth and got 80x. The result was silent product degradation, with no error codes and no degraded-mode headers on the response. Features got removed without an announcement. Accounts were banned in batches, and a 7-day trial appeared on the paid plan with nothing in the changelog to flag it. The 220K GPU Colossus 1 lease (H100/H200/GB200 mix) should ease the squeeze, but the behavioral precedent is set: when demand exceeds supply, the product degrades without disclosure.

Opus 4.7 Vision: Separate 3x Increase

Per-image token accounting changed. Anything that fans out across a batch now pays three times for the same bytes. If vision sits on a hot path, meaning document processing, visual QA, or multimodal RAG, recompute unit economics today. The fix is routing: Haiku or Sonnet for first pass, Opus only on escalation.

OpenAI's Counter-Play

Two months of free Codex for enterprise teams that switch. The window closes July 13. That is a short runway to benchmark a different agent on a real codebase. A no-switch outcome still leaves comparison data and negotiation leverage on the table.

Why I'm running multi-provider now

Ramp data puts Anthropic at 34.4% against OpenAI at 32.3%, which is the first lead change in that dataset. Vercel's production telemetry shows the split that matters: Anthropic captures 61% of spend on Opus for quality, while Google captures 38% of volume on Flash for throughput. Teams route by workload characteristics, not by vendor preference.

The Production Data

Vercel's AI Gateway report covers 200K+ teams and 7 months of production traffic. It puts agentic workloads at 59% of all token volume. That is the majority case. Chat-style request-response is the minority. Infrastructure that assumes single-turn in, single-turn out, stateless between calls is optimizing for the 41% case.

Agentic traffic means multi-turn sessions, tool calls, state between turns, retry logic when a tool fails, and cost that scales with reasoning depth rather than input length. A billing dashboard grouped by request is measuring the wrong unit.

Architectural Convergence: Temporal-Style Durable Execution

One week of shipping. Cline rebuilt its SDK around agent teams and scheduled jobs. LangChain launched Managed Deep Agents on SmithDB with 12-15x faster nested trace access. Cursor extended cloud agents with full dev environment lifecycle. Duet Agent proposed state-machine orchestration for week-long jobs. The shape is the same in every case: explicit state machines, checkpoints, hierarchical decomposition, observable intermediate state. A chat loop does not hold state across real work.

Abridge's Reference Implementation

80M+ clinical conversations running on Kafka + Temporal + CRDTs. Model constellation with cost-aware routing. Cheap models triage. Expensive models reason. This is the stack that survives a pager rotation, and the reason is unglamorous: the boring distributed-systems primitives are what survive at scale.

Kafka Share Groups: A Constraint Just Disappeared

Consumer count has been capped at partition count since Kafka existed. Share Groups decouple them. Benchmarks show linear throughput scaling to 8x with 32 instances and no per-instance overhead. Partition count goes back to being a storage and ordering concern, not a throughput ceiling. Any topic where partition count was picked for parallelism rather than ordering semantics is worth a second look.

The Token Waste Problem

Off-the-shelf MCP without a knowledge graph layer costs 30% more tokens. The agent re-fetches and re-describes state every turn because nothing caches the resolution. At 59% agentic volume, that 30% is the dominant cost line. The fix is mechanical: pass trace and span IDs on MCP envelopes, dedupe system prompt and schema payloads across hops, cache prefix KV when the provider supports it.