The Engineer

The window defeats the control, not the payload

Nearly every supply-chain control most teams bought runs at scan time. Advisory feeds, scanner index refreshes, vendor writeups, dependency-review bots. Every one of them fires after resolution has already happened. Risky.Biz counted six vendors publishing analyses of the malicious versions, and none of that reaches a pipeline that pulled the crate while the versions were live. The controls that run at attacker speed are earlier and duller: cargo build --locked or --frozen enforced in CI, vendored dependencies, and an internal mirror with a 24-48 hour promotion delay on new versions. The promotion delay is the only control guaranteed to have been correct here. It converts a minutes-scale attack into a non-event.

The ecosystem fix that does not generalize

npm 12 disabling install scripts by default is good engineering, and StubMaker replicating from RubyGems into npm is exactly why it was needed. It also does nothing for the Rust, Ruby, or Python surface. Cargo's equivalent primitive is build.rs and procedural macros, which are arbitrary code execution at build time by design, and nobody is disabling that. Run the inventory before writing the policy: for each ecosystem in the build, name the hook that executes attacker-controlled code before the first test runs. That list is build.rs, proc macros, gem native extensions, setup.py. Assuming a registry-level fix in one ecosystem covers the others is how this window stays open.

Blast radius is the runner's IAM role

A build-time payload inherits whatever ambient cloud credentials the runner holds. That is why the North Korean attribution matters operationally. It moves the expected payload off crypto-mining and onto credential and cloud-token harvesting. Egress filtering plus short-lived, narrowly scoped build credentials downgrades a supply-chain compromise from a cloud-account incident to rebuilding an artifact. Where runners hold a long-lived role with deploy permissions, the 23 minutes were not the incident. The role is.

Where the reporting converges

Three independent threads land on the same repricing. Risky.Biz has registry compromise measured in minutes. CyberScoop has federal agencies reporting AI-generated exploitation scripts in active use against industrial controllers with no accompanying CVE, so there is nothing to bump and the remediation is topology. The Hacker News puts the concentration of risk in code nobody on the team wrote and nobody can patch. The shared mechanism is that time-from-opportunity-to-working-attack has compressed below the cycle time of every human process built to respond to it. Patch cadence was calibrated against human exploit-development latency. That baseline is gone.

So build provenance stops being a maturity goal and becomes an incident-response prerequisite. The responder's question is not "are we patched." It is "what exact dependency set went into this image, and when was it resolved." Teams that could answer in minutes closed this incident quickly. Teams that could not are still guessing, and guessing here means either rebuilding everything or accepting unbounded risk on a build that may be clean.

If "what exact dependency set went into this image" takes more than an hour to answer, the 23-minute window is unanswerable and you are choosing between a full rebuild and hope.

Cost asymmetry across a protocol impedance mismatch

No reflection, and no spoofed source addresses needed. HTTP/3 gives the client cheap multiplexing: hundreds of streams on one QUIC connection, QPACK compression keeping each request tiny on the wire. HTTP/1.1 origins have neither property, so streams fan out into separate origin connections or serialized pipelines and compressed headers re-expand into plaintext. One client connection buys a multiple of origin sockets, TCP handshakes, and header parsing.

QUIC has per-stream and per-connection flow control; HTTP/1.1 has TCP and nothing else. When the origin slows, there is no clean signal path back to throttle the QUIC side, so the edge keeps accepting streams and generating origin work. Up to 350x, no forged packets. Origins see only CDN egress IPs, so the CDN IP allowlist most teams call a DoS control is what carries the traffic.

The defensible position fails closed

Only two CDNs shipped mitigations after notification, per Risky.Biz, so infrastructure-layer disclosure will not close this on an operator's timeline. Ask the vendor in writing whether the HTTP/3-to-HTTP/1 translation path is mitigated. Enforce origin limits regardless: hard CDN-to-origin concurrency and RPS budgets with load shedding, HTTP/2 to origin plus origin shielding or request collapsing, a bounded autoscaling ceiling. The failure mode being avoided is autoscaling gracefully into a five-figure bill, not downtime.

12 bits per second is a secret-lifetime problem

Same class, second item: researchers pulled a JWT from a co-located Cloudflare Worker in production at up to 12 bits per second. A 256-bit HMAC signing key is about 21 seconds. A compact 500-byte JWT is roughly 5.5 minutes. Repeated reads and error correction multiply that by some constant; still minutes.

Cloudflare's Workers isolation puts many tenants in one process as V8 isolates, side channels blunted by removing precise timers, denying SharedArrayBuffer, and holding the clock until I/O completes. Good engineering. A co-tenant extraction in production still demotes it from a boundary to defense in depth. Neighbors are not selectable, so the controllable variables are secret lifetime and value: signing behind KMS, access-token TTLs in minutes, sender-constrained rather than replayable bearer tokens.

Where the sources disagree, and why it matters

Risky.Biz surfaces Cloudflare's counter-narrative the same week: zero observed Spectre exploitation in three years, plus Dynamic Process Isolation expanded to isolate long-lived executions and I/O-heavy workloads as behavioral tells. The extraction proves the primitive works; no observed exploitation says the practical rate is low. Prioritize by what is exploited in the wild, but stop counting timer coarsening as the isolation guarantee, and treat long-lived keys in shared tenancy as already rotated.

The translation layer in front of the origin is not patchable, and neither is the tenant sharing the CPU. What is adjustable: how much either is allowed to cost, and how long a secret stays worth stealing.

The compounding that never made the press release

A 2% per-call quality regression is fine for single-shot work. Run it through a 20-tool-call agent loop and 0.98^20 is about 0.67. Roughly a third of end-to-end success rate is gone. Agent failures cost more because they fail late, after tokens are burned and state is mutated. So the first line of a routing policy says nothing about model quality: stateless single-shot calls route down aggressively; stateful multi-turn tool-using workflows route conservatively or not at all. AT&T's disclosed split is static-by-task in that exact shape. Frontier models generate the code, cheap open models summarize code already submitted.

Interrogate the 2%, not the 56%

No methodology was disclosed. A blended 2% decline across a coding workload could be 0.5% on the 80% of calls that are trivial and 15% on the 5% that are hard multi-file refactors, and the hard ones are where a wrong answer costs an afternoon. Aggregate quality delta is the wrong instrument. Measure per-task-class pass rate plus a separate rework signal: revert rate, follow-up-prompt count, PR review churn. The Information Briefing names the blocker plainly. Teams holding a golden-set harness run this substitution in a sprint. Teams without one spend a quarter arguing about whether outputs feel worse. A 2% delta also sits inside most teams' eval noise band, which means most teams cannot tell whether they would accept the trade.

Model swaps are the third lever, not the first

Look at the composition. Caching removes roughly half the tokens. Routing halves the price of what remains, and gisting cuts latency on the survivors. These stack, and none of them needs capex. Prompt caching is the genuinely good engineering here: it removes cost with zero quality risk and zero new infrastructure. A GPU memo written before that delta is measured is a memo about something else. For self-hosted multi-document routes where vendor prefix caching is structurally failing on ordering, CacheBlend inside LMCache is the experiment worth running. Treat its 2-4x claim as a hypothesis against your own document-length distribution, since it ships with no hardware spec and no workload description.

The line items the 56% leaves out

The stated 6-10 month open-versus-frontier capability gap understates migration cost, because the friction is not benchmark scores. Prompts, tool-calling schemas, and structured-output modes were tuned against one vendor's quirks, so swapping models means per-model prompt variants plus a regression suite to catch silent drift. On self-hosting: 45 billion tokens a day averages about 520K tokens per second. That is enough sustained load to keep GPU nodes full, which is the only condition under which on-prem beats API pricing. At 100M tokens a day and spiky, it costs more per token and makes continuous-batching tuning and checkpoint lifecycle management permanent responsibilities.

Route by task shape, not by a blended average. A 2% per-call hit becomes a 33% failure increase across a 20-step agent loop.

Check the provenance on the price before citing it

Neither company disclosed terms. The New York Times reports $7.5 billion, sourced to one person with knowledge of the deal. A second account came from the a16z GP who did OpenRouter's seed and swung at the Series A, and that version carried no price at all. So the headline number is single-sourced reporting on an unannounced figure, for a deal that is signed rather than closed. Two details survive that caveat and matter more than the total. $1.5B of the reported consideration goes to founders, which is the textbook setup for post-close key-person attrition. And the step-up from May's roughly $1.3B valuation has to be earned back somewhere. On an aggregator the available levers are take-rate, bundled payments and billing, and proprietary features that raise switching cost.

What actually couples you

Here is what a third-party router in the inference path binds code to: model namespace, fallback ordering, provider parameter passthrough, and credit accounting. Those are the exact surfaces a new owner rationalizes. OpenRouter's core value was never routing cleverness. It was velocity, day-one access to new models. If that velocity slows post-close, an assumption baked into the model-adoption plan breaks silently. No deprecation notice, because nothing failed.

The mitigation is boring and finite. Keep every call OpenAI-wire-compatible behind a single internal base URL. Make upstream selection config-driven. Emit token, cost, and latency per request into your own store. Direct provider keys should be a tested failover path, not a provisioned one, which means chaos-testing it by disabling the primary. That work pays for itself under every deal outcome, and it is the same primitive that survives a provider outage or a rate-limit wall.

The unpriced cost of "intelligent routing"

Cross-provider routing per request breaks prompt-cache locality and introduces tokenizer and behavior variance. A router that saves 18% on token cost can add hundreds of milliseconds to p95 time-to-first-token and move eval scores by a few points. Letting a third party pick the model per request works only when golden-set evals run against actual production routes. Otherwise the metric someone else measures gets optimized and the one nobody measures pays for it.

Retention became a routing dimension this month

The second half of this story is a compliance primitive with real engineering surface. OpenAI's Private Safety Processing ships next month with zero data retention. Interactions stay on your own servers. OpenAI batch-analyzes them for harms, discards the data, and keeps only abuse category and severity. It is explicitly positioned against Anthropic holding Claude Fable 5 customer data for at least 30 days, which some enterprises are already refusing over downstream data commitments.

That is a burden transfer, not a free lunch. Whoever runs that store owns the most sensitive datastore in the architecture, plus its encryption, access control, deletion-request semantics, and availability. Decide now whether safety analysis fails open or fails closed when the store is down. The routing consequence is concrete. Attach a sensitivity class to prompts where they are constructed in application code, and enforce provider eligibility at the gateway where it is auditable, before a support transcript containing PII lands on whichever endpoint was cheapest that minute. OpenAI's own API product lead concedes the reason this exists: a single interaction can look like benign security research while the sequence looks like an attack, so per-request moderation is structurally insufficient.

The router should be an implementation behind an interface you own, never the interface itself.