The Scientist

The Convergence

The artifacts and toolchains trusted by default are now the primary attack surface, and this week's incidents land in the same architectural place. The Hugging Face Transformers RCE fires from model config files, not the long-warned pickle weights. Claude Code's MCP integration carries an actively-exploited flaw where developer trust is the vector. Meta's Instagram AI chatbot was social-engineered into changing account emails through tool calls. And OpenAI shipped Lockdown Mode, whose mitigation is disabling the features that can be hijacked rather than refusing the instructions that hijack them.

Why This Is Different From the Pickle Warning

The security guidance of the past two years converged on "prefer safetensors, never load untrusted .bin files." That guidance is necessary but insufficient. Config-driven code paths — specifically trust_remote_code=True auto-loading custom modeling code from config.json / auto_map — give attackers a route that reads as innocuous in code review. Configs are small, easy to overlook, and have shown up as a vector more than once.

If you patch and do not audit, you have closed roughly half the exposure. The other half lives in configs already sitting in caches and registries.

The Pattern Across Vendors

The Meta case is the canonical confused-deputy failure: the agent holds authority the user should not be able to invoke through natural language. Any agent with write-side tools — CRM updates, file mutations, payment actions — inherits this attack class.

The Lockdown Mode Admission

OpenAI's mitigation is not a clever classifier. They removed the action half of the trust boundary. The capability-removal route, chosen by the team with the deepest prompt-injection research portfolio, is informative about where the research actually stands. The implicit claim: the model layer cannot be trusted to refuse adversarial instructions reliably enough for agentic features to stay on by default.

The thing this announcement doesn't tell you is what fraction of sessions remain in Lockdown Mode after the next release cycle. Defaults move under product pressure. The interesting metric is not whether the mode exists but the steady-state opt-in rate.

What Your Team Should Grep For

The pattern to find: from_pretrained and trust_remote_code. Anywhere trust_remote_code=True is set against a Hub model, the deployment is one poisoned commit from RCE on a GPU host. The highest-risk surface is not the inference server, which usually pins to vetted weights. It is the research workstation evaluating ten candidate models in an afternoon, with credentials cached for cloud storage and the model registry.

The Number and What It Means

GitHub's CPO disclosed that March 2026 produced 17 million agent-generated pull requests. The capacity plan called for ~5% growth and got ~15%, a 3x miss. The proximate cause was December 2025, when macro-delegation became reliable enough to ship at scale. The fix was emergency load-shedding into Azure and West-Coast network re-provisioning.

Capacity models pegged to human PR authorship are off by an order of magnitude at this point.

The Downstream Multiplier

17M is a volume metric. The cost impact is a load metric, and the two are not the same. Each PR triggers CI pipeline runs, security scans, artifact storage, and review queues. If even a quarter of 17M PRs trigger full builds, the implied runner-minutes are several multiples of what most CI systems were sized for in 2023. Pipeline cost scales with runs, not headcount. A capacity model built on seat-count is measuring the wrong axis.

Copilot's Response: Semantic Routing + Usage Billing

GitHub's answer has two parts. First, semantic routing: Copilot's 'auto' setting routes between MAI Code One Flash (small, cheap) and frontier models (Opus, GPT) conditioned on task complexity. Second, usage-based billing effective June 1, 2026, which moves token discipline into the P0 cost metric column.

Security surface

17M agent PRs is also a security surface. Agents produce plausible-but-wrong code at non-trivial rates. A review process that applies one SLA to human and agent PRs is applying one SLA to two different error distributions. The thing this doesn't tell you is what a misconfigured agent loop costs under usage-based billing. The honest answer is a month's budget in hours. Chronicle exists because GitHub knows this.

Your Concrete Next Step

Pull the last 90 days of PR-open events, segment by author type (human vs. bot/agent), and fit the runner-minute curve against agent share. If the slope tracks GitHub's curve at even half magnitude, the 2025 capacity plan is already wrong by 2–4x. If it doesn't, agents are opening PRs that don't trigger full builds, which is worth confirming before the next budget cycle.

The Hardware Signal

Google split TPU gen-8 into two SKUs at Cloud Next '26: 8t for training (throughput-optimized) and 8i for inference (latency and chip-to-chip speed optimized), with shared Axion CPUs and a common software stack so JAX/XLA code ports across both. The vendor is now saying in public what production teams have been routing around for two years: the chip that wins the research leaderboard is rarely the chip that wins the serving budget.

The Price Anchor

Google is paying SpaceX $920M/month for roughly 110K Nvidia GPUs. That works out to about $8.4K/GPU/month all-in — GPUs, CPUs, memory, power, ops. Anthropic pays $1.25B/month for Colossus 1. These are the first public reference points for hyperscaler compute economics, and they include a 90-day cancellation clause after Dec 31, 2026. Multi-year lock-in is no longer on offer.

The chip that wins the research leaderboard is rarely the chip that wins the serving budget.

Open Weights Hit the Long-Context Tier

MiniMax M3 shipped open weights at 1M-token context. Gemma 4 12B runs multimodal on a laptop. Nvidia's RTX Spark puts workstation-class inference on a desk. The proprietary long-context moat is closing faster than most retrieval roadmaps have priced in.

The Practical Constraint

A 1M-token prefill on a local box is minutes of wall clock, and the KV cache will not fit on a single consumer GPU without aggressive quantization or paged attention. Needle-in-haystack scores measure retrieval depth, not multi-hop reasoning across the full window. The thing the advertised ceiling does not tell you is where quality actually breaks. The relevant question is whether useful behavior holds at 50% of claimed length or only 25%. At 50%, the engineering bill pays off. At 25%, it does not.

The Hybrid Pattern to Copy

Perplexity ships a hybrid PC/cloud split: a small local model returns an answer plus an uncertainty estimate, and only the high-uncertainty tail routes to a frontier API. The pattern to prototype is a confidence-gated router instrumented with local-vs-cloud rates, per-slice quality deltas, and dollars saved. Without the telemetry, the savings are a guess.