The Engineer

A New Attack Class Targeting Agent Behavior, Not Prompts

Three independent sources this week converged on the same conclusion: AI coding agents with filesystem and network access are live vulnerability surfaces. This is not prompt injection. It's social engineering that exploits the agent's most useful behavior — error recovery.

The payload resolves via DNS, meaning the repo passes any static analysis or code review — the malicious content isn't in the repo, it's fetched at runtime from attacker-controlled infrastructure.

The Mozilla 0DIN Kill Chain

1. Attacker publishes a clean-looking GitHub repo with an install step that intentionally errors
2. The agent, doing what it's designed to do (fix errors), executes the suggested recovery command: python3 -m axiom init
3. The command resolves a DNS record to fetch the actual payload — a reverse shell
4. The DNS record can be swapped post-review, meaning a repo that was clean yesterday weaponizes today

This was demonstrated against Claude Code and Codex specifically. The attack bypasses all static analysis because the malicious content never exists in the repository.

The Credential Leakage Dimension

O'Reilly Radar independently elevated credential leakage from coding agents to a mainstream security concern this week. The attack variant: an agent reads a file containing a crafted prompt injection buried in a dependency's README, docstring, or test fixture. It then exfiltrates credentials or writes code that phones home. If agents have filesystem access and network access simultaneously — and most do — the vulnerability is live.

Why This Compounds With Supply Chain Risk

The Klue/LastPass OAuth breach reported this week shows the same pattern at a different layer: obscure vendor → token compromise → downstream data exfiltration. Your coding agent's execution environment is another node in this graph. A compromised dependency triggers agent behavior that exfiltrates secrets through a path you're not monitoring.

Remediation Architecture

The fix isn't 'don't use agents.' It's treating agent execution environments with the same paranoia you'd apply to running untrusted user code.

Four Apache 2.0 Releases Changed the Math

The self-hosted AI story just went from 'interesting experiment' to 'obviously correct for most workloads.' Four independent releases this week deliver frontier-adjacent capability on hardware you already own, while AWS simultaneously raised AI workload prices 20%.

Ornith-30B-A3B: 30 billion total parameters, 3 billion active per forward pass, running on a single RTX 4090 with quantization, hitting 71.2% on SWE-Bench Verified. That's roughly where Claude 3.5 Sonnet was in late 2024, but at 1% of closed-model inference cost.

The Release Stack

The Cost Pressure From Both Directions

Push factor: AWS raised AI workload rental prices 20% effective now. Google is limiting compute access. The cloud providers are signaling demand exceeds supply.

Pull factor: Coinbase publicly shared they halved AI spend while increasing token usage by defaulting to open-weight models. The architecture is a routing layer that directs requests to the cheapest model meeting the quality bar.

The MoE (Mixture of Experts) architecture is the enabling technology. You hold the full parameter count in memory but only activate a fraction per token. Ornith activates 3B of 30B parameters per forward pass — that's why it runs on a 4090. Qwen-AgentWorld activates 12B of 70B. You get large-model capability at small-model inference cost.

Mistral OCR 4: The Most Immediately Deployable Win

If you run any document processing pipeline, this is the highest-ROI item. The 2B model returns structured output that feeds directly into RAG pipelines: bounding boxes, block-type labels (heading/paragraph/table/figure/caption/footnote/formula), reading order, and per-token confidence scores. That confidence score lets you set thresholds and route low-confidence extractions to human review instead of polluting your vector store.

The real win isn't just accuracy — it's eliminating per-page pricing and keeping your documents inside your security boundary.

What Self-Scaffolding RL Means for Your Agent Stack

Ornith's training approach is architecturally significant. Instead of hand-coding agent loops (plan → code → verify → retry), the model learns to construct these loops during RL training. This means your agent infrastructure can be dramatically thinner: provide tool APIs and let the model orchestrate itself. The implication is that frameworks like LangChain and CrewAI may be transitional — the orchestration logic moves into the model weights.

No Memory Architecture Wins — That IS the Finding

A multi-university study (Shanghai Jiao Tong, Tsinghua, MemTensor) benchmarked 12 representative agent memory architectures and found effectiveness is entirely workload-dependent. A system that tops the chart on long-horizon recall loses on high-churn short-context reads. The ranking flips depending on access pattern.

Treat memory architecture selection like database selection. Profile your access patterns first. Then choose, or compose, your architecture.

The MEMPROBE evaluation framework confirms the failure mode: agents systematically miss on episodic memory retrieval and hidden-state reconstruction. If you picked a memory architecture from a paper or vibes, you have undiscovered failure modes you haven't profiled.

The Memory Taxonomy That Replaces Handwaving

A new paper formalizes agent memory into a 3×3 grid:

• Three levels: token-level (conversation context), parametric (fine-tuned knowledge), latent (learned persistent representations)
• Three functions: factual, experiential, working

This is explicitly separated from RAG and context engineering. Most production agents today are memory-amnesiac — they restart fresh each session or stuff a summary into the system prompt. For a long-running deployment agent, experiential memory (which tool chains succeeded, which approaches failed) is the highest-leverage addition.

PydanticAI V2: The Context Window Bloat Fix

The defer_loading=True pattern solves a specific problem: multi-tool agents waste context window on tool definitions the model never uses. The mechanism: expose a compact catalog (tool name + one-line description), let the model select, then hydrate the full schema only for selected tools. This is code splitting from frontend bundlers, applied to LLM context.

The composable units abstraction bundles instructions, tools, lifecycle hooks, and model settings into one testable unit. Most agent frameworks give you no way to validate a unit in isolation before composing. KAOS (K8s agent orchestrator) already migrated to V2, suggesting API stability.

When Deferred Loading Helps vs. Hurts

Helps: Agents with 10+ tools where most calls use 2-3. Context window utilization drops significantly.

Hurts: Every call hits a fresh agent with cold starts, or you need deterministic tool selection without the catalog-selection round-trip.

The Self-Scaffolding Convergence

Three signals point the same direction: hand-coded orchestration layers are being absorbed into model capabilities. Ornith's self-scaffolding RL learns agent loops during training. Qwen-AgentWorld internalizes environment simulations. PydanticAI V2 makes the remaining orchestration thinner. If your architecture has heavy LangChain/LangGraph/CrewAI dependencies, audit whether those abstractions are still earning their complexity budget — the models are increasingly capable of self-orchestration when given tool APIs directly.