The Engineer

The auth layer never ran

GitLab shipped out-of-cycle patches for CVE-2026-19478 on August 17. watchTowr's honeypots logged exploitation attempts two days later, per SANS NewsBites. Fixed self-managed builds: 19.2.4, 19.1.6, 19.0.8, 18.11.11. The injection sits in a GraphQL directive, so the vulnerable code executes during query parsing, structurally upstream of GitLab's per-project authorization, per SANS NewsBites' account of watchTowr's analysis. Mature authz that never runs still yields a pre-auth destructive-write primitive. Depth limits, complexity budgets and rate limits contribute nothing here; the payload is one shallow query. For anyone running their own GraphQL surface the transferable question is narrow. What executes before your auth middleware? Custom directives, schema stitching, persisted-query resolution and custom scalar coercion all parse first.

Patched and clean are different states

watchTowr's detection artifact is the string @gl_introduced in requests to /api/graphql. Grep reverse-proxy and web logs back to at least August 15, and treat a hit as an incident rather than a finding. Blast radius is every credential the platform ever held: CI/CD variables, group and project access tokens, runner registration tokens, deploy keys, and any long-lived cloud key reachable from a pipeline. Keyless OIDC does not help. With execution on the node an attacker mints job tokens and assumes the roles already trusted, so nothing static needs stealing.

Patching stops new exploitation. It does nothing about tokens already issued, or a pipeline definition quietly rewritten three days ago.

Zimbra is the boring-and-lethal case: unauthenticated OS command injection through the default-enabled snmp_notify and swatchdog path, fixed in July, exploited afterward. Nobody enabled that feature deliberately, which is why it survived every asset review. Citrix's auth bypass exists only when the appliance runs as a Gateway or AAA virtual server, so read per-appliance config instead of assuming fleet-wide exposure. Invalidate sessions and rotate appliance secrets inside the same change window, because session material on this class of edge box has outlived the patch before.

Entra ID is why the table reads left to right rather than by score. Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw already exploited in the wild, and stated no customer action is required, per The Hacker News. Vulnerable code and fix both sit vendor-side, so there is nothing to apply and no way to verify remediation. Export sign-in, audit and service-principal logs beyond default retention, then hunt credential additions to app registrations, new consent grants and anomalous token issuance inside the exploitation window. Cisco's nine fixes across Crosswork and Secure Workload, five of them at CVSS 10.0, in a review the company itself calls 'continued', put the same shape in the network tier: the systems that hold and enforce the segmentation map become the lateral-movement path. Expect more waves in those code lines.

Then the volume tier, where severity-first triage stops working. Oracle's August cycle carried 943 patches across more than 1,000 CVEs, and Atlassian disclosed 10 critical plus 162 high-severity issues in third-party dependencies. The vendor's own code was fine and its supply chain was not, and that queue is inherited downstream. The only filter that scales is reachability: loaded at runtime, reachable from an untrusted network, sitting next to credentials or regulated data. Put P50 and P95 hours from advisory to production deploy on the same dashboard as the availability SLOs. 48 hours is the planning constant, not the outlier.

The four ways teams silently disable their own cache

More than 85% of agent token burn is the cached prompt, per a16z's OpenRouter data. Cache hit ratio sets the bill, not model tier. Prefix caching needs a byte-identical prefix. It breaks mundanely: a timestamp near the top of the system prompt, a tool list built from a set or dict, retrieved chunks placed before stable policy text, a serializer that reorders JSON keys between library versions. Each converts cache reads into full-price prefill every iteration, silently. The audit is an afternoon of reading prompt-assembly code.

Turns compound, tokens per second do not

Resubmitting accumulated context each turn grows input volume roughly with the square of turn count, so turn count beats any per-token discount on the market. The Batch's coverage of Artificial Analysis' AA-Briefcase results: Grok 4.6 at high reasoning scored 1,577 Elo against Claude Opus 5's 1,715, in about half the turns and a quarter of the input tokens. Log turns-per-completed-task, or cheap per token keeps passing for cheap per outcome.

Qwen3.8-Max gained 11 index points and doubled cost per task, from $0.54 to $1.13, at identical $2.00 input and $6.00 output per million tokens. More reasoning tokens, same rate card. Grok 4.6 bought five index points for 2.3x Grok 4.5's per-task cost ($0.36 to $0.84). Cached reads stay the untouched lever: Grok $0.50 against $2.00 fresh, Qwen3.8-Max $0.25 against $2.00, an 8x spread. Grok prices above 200K tokens differently, so an unbounded window is a billing incident with a delay fuse.

Cache hit ratio is the new p99 — if you cannot chart it per agent workflow, you do not know what your AI costs.

Where the sources agree, and where one claim collapses

a16z and The Batch reach the same denominator from opposite ends: cost per completed task, built from turns, prefix size and cache hit ratio. Not Boring supplies the skepticism. Claims of 75x token reduction only land when the baseline was wasteful: full history resent every turn, whole documents instead of retrieved chunks, no prompt caching, retry loops on malformed output. Those are bugs, not purchases.

AI Breakfast counterweights the pure cost story. Mistral's agentic search moved FinanceBench correctness from 26.7% to 86% with no larger model underneath, by swapping single-shot retrieve-then-generate for a plan, search, read, verify loop. It also multiplies token spend by iteration count and yields a p95 tail set by how confused the agent gets. Trace tooling ships first.

If you self-host, routing is a cost lever

vLLM's automatic prefix caching and SGLang's RadixAttention pay off only when consecutive steps of one agent land on the same replica. Round-robin balancing destroys cache locality and forces silent re-prefill, so session affinity is throughput, not a latency nicety. The prefix cache occupies HBM, trading against batch size and maximum context. Cache writes cost a premium over standard input, so a prefix needs several reads to break even; short one-shot agents can be net-negative.

Where a sandbox escape actually lands

A type-confusion bug in a JavaScript sandbox widely used to run model-generated code was patched, per CSO First Look. It allows guest-to-host escape and remote code execution. This is a predictable failure class, not a surprise. Every in-process sandbox tries to build a security boundary inside a memory space that was never designed to hold one. Proxy-membrane designs leak through prototype chains and unmarshalled objects. V8-isolate designs leak through engine bugs. Type confusion is the classic engine bug. The escape does not land in a container. It lands in the process holding your DB pool, your environment variables and your instance-metadata reachability.

CSO First Look published no CVE, no package name, no version range. So this is a dependency-graph audit, not a lockfile diff. Grep for vm2, node:vm usage, isolated-vm, QuickJS bindings, and any agent framework's REPL or code-interpreter tool. Then answer one question per path: if the sandbox is escaped, what is in this process?

The same failure arriving through consent instead of a CVE

Techpresso's read on OpenAI's macOS iMessage plug-in for ChatGPT is the sharper version, because there is no vulnerability to patch. Full Disk Access is not path-scopable. No entitlement says "read ~/Library/Messages/chat.db and nothing else." Approving it so ChatGPT can summarize texts also grants that process read access to ~/.ssh, ~/.aws/credentials, ~/.kube/config, every .env in every checked-out repo, and Chrome and Safari cookie stores holding live admin-console sessions. On a consumer laptop that is privacy. On a developer laptop it is credential exposure. It arrives through a click, so no scanner flags it.

The same integration assembles the classic confused deputy inside one process: private data, untrusted inbound content from anyone who can text you, and an outbound send channel. Summarization is the injection vector. The topology is not macOS-specific. Support-inbox triage agents and PR-comment agents with write access have exactly this shape.

Split read from act. Any path that both ingests untrusted text and can send, commit or spend needs a human confirmation the model cannot satisfy on its own.

The persistence layer nobody scoped

ben's bites documents where agent session state actually lives. ~/.codex, ~/.claude and ~/.agents hold full plaintext transcripts plus a SQLite index the agent itself can query. Every pasted production stack trace, connection string and proprietary snippet sits unencrypted on every engineer's laptop, inside Time Machine, Dropbox and iCloud backup scope, and outside secret-scanning scope. Agent-searchable cross-session history is also a plausible prompt-injection exfiltration path between unrelated repos.

The identity variant, and the market's own admission

TLDR IT's read on Slack Code names the fourth instance. Agents run with the invoking user's permissions, so an agent cannot be scoped below the human, and effective privilege equals the union of every privileged human in the workspace. A phished Slack session becomes a code-execution primitive, and the audit log reads as if a person did it. The containment that holds lives on the git side: branch protection, required reviews, CODEOWNERS, and no agent-reachable path to main. Anthropic, meanwhile, shipped Computer Use and Skills to GA with isolation and metering left to the caller. The primitives are named. The isolation work is the caller's backlog.