The Engineer

The chain is short, boring, and ends at the metadata service

Next.js's built-in optimizer exposes /_next/image?url=…&w=…&q=…. Behind that route, sharp hands bytes to native decode libraries — libavif, libheif, aom — C and C++ parsing adversarially shaped input inside the Node process. That process usually holds the database URL, a service-account token, and an unrestricted path to the cloud metadata endpoint. Crafted AVIF, optimizer decode, code execution with the application's own identity, then IMDS or an internal service. Pre-auth, no user interaction.

AVIF is the tell. A modern codec got adopted for payload savings, and a memory-safety surface in the request path came with it. With a wildcard images.remotePatterns allowlist, or a legacy images.domains entry, the attacker skips the upload feature entirely. They host the payload and pass the URL.

The Windows-only flaw comes from path handling the test matrix never runs

A framework bug that fires only on Windows almost always means OS-divergent path normalization or process-spawn semantics in the server runtime. Backslash separators and drive-relative paths get past a check written against POSIX assumptions; so do reserved device names. Teams that are Linux containers end to end can treat it as noise. Any IIS-fronted Node service is a separate exposure, and so is an on-prem enterprise deployment or an internal tool running on Windows.

Sort the queue by exploitation evidence

ServiceNow carries the highest scores and no known exploitation. PaperCut carries no score advantage and is being used right now, per the vendor's own confirmation, and "all versions affected" means there is no safe older release to roll back to. VulnCheck's two undocumented factory implants in ZBT routers are the one item on the list a patch does not close. That one closes with a purchase order.

Patch, then shrink the surface, then move the decoder

1. Patch. Verify by lockfile across every repo, including the dashboard nobody owns. Caret ranges in package.json prove nothing.
2. Shrink the surface, same day. Drop image/avif from images.formats — WebP-only costs a few percent of payload. Replace wildcard remotePatterns with exact host and path entries. Set unoptimized where a route never needs transforms. If images already route through Cloudinary or imgix, confirm the built-in optimizer is disabled rather than merely unused.
3. Move the decoder. Push transforms to the CDN edge, or to a dedicated optimizer with no cloud role, no VPC egress, IMDSv2 with hop limit 1, and seccomp or gVisor. Then the next AVIF, JXL or HEIF bug is a contained crash instead of a breach.

Where the reporting diverges: both accounts agree the flaws are pre-auth and credit Hacktron, but only one states the patched versions, and the other truncates CVE identifiers and affected ranges. Pull the upstream Vercel advisory before this goes into a postmortem.

Native codec decode does not belong in a process that holds credentials.

Minimal mode is a shell plus a file editor

Check what produced the top number. The configuration DeepSeek calls minimal mode is a shell and a file editor. The scaffolding that maximizes an agentic benchmark score is the scaffolding with the widest blast radius, so containment and benchmarking are the same discussion. DeepSeek published the harness, which is good craft: MIT-licensed, model-agnostic, built on a plugin kernel that treats models, tools, skills, sessions, sandboxes, storage, loops and scheduling as swappable parts. The property worth stealing is that it logs everything the model ingests, so any session can be resumed, forked, searched or replayed. Event-sourced sessions are how you debug a nondeterministic system at 3am.

Pinning a model version does not pin behavior

JIT-Agent and the finite-state-machine induction work arrive at the same finding from different directions. JIT-Agent has the model synthesize its own harness across memory, planning, action protocol and tool orchestration. The induction work builds compact finite-state machines from agent traces and finds behavior topology tracks the deployment scaffold more than the underlying LLM. So every prompt-template edit, retry-policy tweak, tool-description rewrite and memory-eviction change is a behavioral release carrying no version number. Version the harness, the tool definitions and the sandbox image as one artifact. Gate model bumps on it in CI.

Two knobs that pay off

Reasoning effort first. Moving GLM-5.3-Flash from high to max roughly doubled token consumption for roughly flat accuracy. A service that hardcodes maximum effort as a defensive default pays a 2x token tax for a statistically flat result. Make it a per-task-class config parameter and A/B it against your own eval set.

Tier selection second. Artificial Analysis has Claude Opus 5 at 63 on its Intelligence Index at $2.34 per task, Gemini 3.7 Flash at 57 for $0.40, DeepSeek-V4-Pro at 53 for $0.25, and GPT-5.6 Luna at 52 for $0.05. Eleven points of index costs 47x. Nvidia's NeMo Switchyard routing library exists to arbitrage that gap, reportedly cutting agentic task cost to a third of running Claude Opus 4.8 alone.

Split throughput from latency before believing any speed claim

Cerebras' mechanism is real engineering. Sol's weights live in 44GB of on-chip SRAM, which removes external-memory round trips. Their own end-to-end figure is the honest one: 83 seconds against 7.7 minutes on six quality-matched GDPVal tasks. That is a 5.6x speedup, roughly half the 11x token-rate headline. Prefill and reasoning latency hide in the gap, and none of it is independently confirmed. Every throughput and cost figure in this section is self-reported by a party with an interest.

The frontier is 30% on real scientific tasks

Claude Opus 5 leads Terminal-Bench-Science at 30% across 70 tasks contributed by working scientists and graded on concrete artifacts: analyses, simulations, proofs, code, data products. That is the frontier on real professional work. Design for verification checkpoints and cheap rollback, because the expected failure rate is around 70% and the failures will be silent and plausible.

If you did not run it in your own scaffolding, you do not have a number.

How prefix drift turns cache hits into misses

Prompt caching keys on an exact prefix. Anything upstream that mutates that prefix nondeterministically turns a hit into a miss. In Claude Code the coupling was specific: a side effect of token refresh leaked into tool-definition serialization, joining the auth path and the prompt path where they should have been isolated. The same shape recurs in ISO timestamps inside system prompts, tool arrays built from an unordered map, session or trace metadata injected before the cache breakpoint, and feature flags evaluated per request.

Detection is cheap. Serialize the cached prefix on two consecutive calls and assert byte identity in CI. Monitoring is cheaper: treat cache-hit rate as a first-class SLI and alert on periodic dips instead of absolute values, because an hourly sawtooth disappears into a daily average.

Routing is now a billing control

DeepSeek-V4-Pro charges $1.32 per million input tokens, $0.044 per million cached input, and $3.96 per million output at peak. Two details promote that discount to an architecture requirement. The API rejects follow-up tool-use requests that omit prior reasoning traces, so reasoning persists across calls by being replayed, and every agent turn resends a growing prefix. Peak hours are defined windows (01:00–04:00 and 06:00–10:00 UTC), with half price outside them.

Put those together and a stateless load balancer that breaks prefix affinity multiplies the input bill 30x without changing a line of application code. Sticky sessions become a cost control. Batch agent work belongs in the off-peak window, scheduled deliberately.

Enforcement belongs in the gateway

Microsoft cracked down on internal AI use after one employee spent $28,000 in 28 days before anyone noticed. The failure is a missing quota enforcement point in the request path, not an employee behaving badly. Application-level budget checks get bypassed by the next integration that skips them. The proxy is what holds: hard per-key and per-agent token quotas, alerts on the derivative of burn rate, and chargeback tags on every call.

The observability half is equally mechanical. Three independent accounts put the spend in the retry loops, reflection passes and tool-call fan-out the orchestrator generates rather than in the model call itself. Emit tokens-in, tokens-out, model, cache-hit and retry-count as span attributes, tagged by feature, tenant and agent step. That yields cost per successful task, which is the figure that survives a finance review. Purpose-built per-session attribution tooling now exists, which is itself evidence that native provider observability is weak.

Then wire the circuit breakers

• Max tool-call depth, so a planner cannot recurse into an invoice.
• Per-task token ceiling, enforced at the gateway rather than in the agent's own prompt.
• Per-tenant spend kill switch, chaos-tested with a deliberately looping agent, which is cheaper than letting production run that test.

One honest caveat: cache-hit rate approximates what you are billed for. Provider usage reporting and prefix accounting differ between vendors, so validate the measured hit rate against an actual invoice line before setting an error budget on it.

A cache miss is silent all the way through the stack. The invoice is the only thing that pages anyone.