The Engineer

Classify the failure before you change the model

An agent run fails exactly three ways: the environment never came up, the test output was unreadable, or the logic was wrong. Only the third is a model problem. Most teams never separate the three, conclude the model is not good enough, and go shopping. The misattribution is the expensive part. Two of the three categories are fixed by work already in the muscle memory of any platform team.

Agent-legible has a spec, not a vibe. One command that provisions and verifies. Machine-readable test output in JSON, not scrollback. Seeded deterministic fixtures instead of shared staging state. Mocked external dependencies, so a run does not die on someone else's rate limit. Snapshot and restore, so a failed run does not poison the next. Every one of those helps human developers too, which puts a floor under the investment.

Decomposition shows up in three independent traces

Google's Chrome vulnerability pipeline is not one model doing one thing. Automated triage runs first, then a fixing agent drafts patches, then a critic agent reviews them, then test-writing agents verify across every supported platform. The last gate is machine-checked, which is the part that matters. Devshot reports the same direction from a different angle: decomposing an automated task into guided steps succeeded 100% of the time versus 50% one-shot, with higher-quality output. AgentRadio, per AINews, moved SWE-Atlas QnA from 32.3% to 62.1% using four agents over asynchronous messaging, beating a stronger single-model baseline. Three unrelated systems, one finding: the bottleneck is orchestration, not model capability.

The costs are specific and they arrive early. Async message ordering is non-deterministic. Debugging fan-out without trace-level observability is misery. Tracing goes in before the second agent does.

Where agents are measurably unsafe

The review queue is the next queue

GitHub shipped Stacked Pull Requests in public preview. The detail worth reading is that existing reviews, status checks and merge requirements keep working, which means the integration problem third-party stacked-diff tools kept re-implementing is now native. Good engineering. The announcement skips two failure modes. CI fan-out: required checks on a five-PR stack cost five times the build minutes of one large PR. Mid-stack rebase cascades: a reviewer's change at layer two invalidates everything above it. Cap stack depth at three or four. Put the highest-risk change at the bottom so it fails early.

One correlation risk nobody in the available coverage named. If the same model family generates the code, reviews the diff and writes the tests, that is a second opinion from the same brain. Shared priors, shared blind spots. Decorrelating costs a config change.

If your coding agents are not merging code, the bug is probably in your build harness, not your model choice.

The physical bottleneck moved from silicon to power

Rented compute is inflating, and chip supply is not the mechanism. a16z read the import and orders data: power-conversion imports are down roughly 23% in units while prices are up about 25% versus January 2025, HVAC is the fastest-growing data center machinery order category, and the backlog ratio for computer and electronic products sits just under six months. Vertiv booked $3.27B of revenue and still missed its own guidance by about $76M, blaming multi-phased project execution as deployments scale in size and complexity. That is tail latency with concrete poured into it. Aggregate capacity arrives; per-project schedules widen as builds get bigger.

The second-order finding matters more for procurement. A100 spot pricing is stable and older editions are getting more expensive. There is no obsolescence dividend. Prior-generation accelerators are a live, bid sourcing pool, which makes a wide CUDA compatibility floor and a validated quantized-model path on A100-class hardware a first-class deployment tier rather than an emergency fallback.

Why the token cuts do not reconcile

OpenAI credited serving gains to speculative decoding: +15% token generation and -20% GPU serving cost. Do that arithmetic. It does not fund an 80% price cut. Per AI Breakfast's analysis, the residual is distillation into a smaller checkpoint plus deliberate margin sacrifice against Chinese providers. Read those prices as a competitive weapon, not a structural floor, and keep the cost model behind an abstraction you own.

DeepSeek's V4-Flash 0731 makes the same point from the other side: Artificial Analysis index 50 against GPT-5.6 Luna's 51, roughly 60% lower cost per task, $0.14/$0.28 per million tokens, MIT weights the same day, Responses API compatible and "fully adapted for Codex." An A/B is a router config change, not a migration. Pin the dated string 0731, not flash, so a post-training refresh cannot silently regress you.

The discount lands on the input prefix

Cached input is $0.0028 per million — exactly 2% of the $0.14 input rate. Here is what actually happens in an agent loop: every turn replays a growing tool-call transcript, so cached input dominates volume. TLDR's arithmetic on a representative 10-turn session lands at roughly 200K input tokens against 5K output. Most of the spend is the agent re-reading its own conversation. Past turn five, prefix-cache hit rate and context compaction outrank model choice.

So prompt engineering is a caching problem. Hoist timestamps, request IDs and per-user state out of the prefix. Freeze tool-definition ordering. Keep context append-only, and stabilize retrieved-chunk ordering. One dynamic token near position zero of a system prompt is a ~50x input-cost multiplier. The optimization is provider-agnostic; it pays on every vendor you route to.

Where memory pressure lands

Record memory-industry profits and hyperscalers now graded on free cash flow point the same direction: memory does not get cheaper. In an inference stack that pressure lands almost entirely on the KV cache. Measure gigabytes per concurrent session, enable paged attention and prefix caching, cut oversized default context windows, and evaluate KV quantization before buying more accelerator hours. Watch the long-context interaction. Weights are one budget, KV cache is another, and running near a million tokens moves a box from 2x80GB to 4x80GB.

Efficiency work deferred as premature optimization is now the only capacity available at a price you were planning for.

What the 13-year-old bug tells you about the rest

The bug an agent found in Chrome was a sandbox escape that let the browser read local files. It survived 13-plus years of human review, continuous fuzzing, and one of the best-funded bounty programs in the industry. The class is the lesson, not the finding: mature, heavily audited C++ still hides exploitable logic bugs at trust boundaries. For anything embedding Chromium, that bug shape is what turns a rendered-content vulnerability into desktop data theft.

Agentic scanning is also dual-use and asymmetric. The capability that found it is available to people with no disclosure obligation, and open-source dependency trees are the obvious next target. "Scan everything" is not a plan. Scan where privilege changes hands: file I/O, IPC, deserialization, parsers, anything crossing a sandbox or privilege line.

Absorption, not discovery, is the metric

Twice-weekly upstream releases plus restart-free patching make a quarterly Chromium upgrade structurally losing. The number that survives a design review is lag-days from Chrome stable to your shipped artifact, tracked as an SLO with a hard ceiling and an alert. Track it per surface: Electron, CEF, WebView2, headless Chrome in CI, server-side PDF and screenshot rendering. Make the bump a pipeline, not a calendar entry. The human-scheduled version cannot hold this cadence.

The same compression shows up elsewhere. Apple shipped 187 vulnerabilities in a single security-update-only release across the 26.6 line, which SANS editors attribute partly to AI-assisted flaw discovery. CISA has issued three-day remediation windows: the Cisco Secure FMC hardcoded credential (CVE-2026-20316) landed on KEV on July 29 with an August 1 deadline. Detection is no longer the binding constraint. The constraint is whether build, canary and fleet rollout can land a critical patch in 72 hours with confidence. If they cannot, that gap is the exposure number, and it is an engineering-capacity problem rather than a security-tooling one.

The query you want to already have

CISA and 14 partner nations published 2026 Minimum Elements for a Software Bill of Materials, preserving the 2021 NTIA core principles and tracking EU Cyber Resilience Act expectations. Generate SBOMs at build time from the resolved dependency graph. The payoff is not the compliance artifact. It is that in the next three-day window, "which artifacts contain this component" is a query instead of a war room.

The governance half nobody budgets

Amazon ran an unbounded agent loop on a menial coding task and learned about the overrun afterward, from internal usage metrics. Same mechanism as the agent-orchestration dive above, which is why it belongs here. That is a governance failure, not a model defect, and any org with an unbounded loop carries the same exposure. Minimum controls: hard per-run token and dollar ceilings enforced in the harness, sub-minute cost telemetry instead of the monthly invoice, mechanical work routed to small models by default with frontier models as explicit opt-in. Falling per-token prices are precisely what lull teams into removing the caps.

An agent found a 13-year-old Chrome bug, and the metric that fell out of it is patch absorption rate — the only exposure number you can actually measure.