The Engineer

Refactoring documents two teams that abandoned endpoint-per-tool MCP designs. Notion's hosted server now has no tools to create, update or delete individual blocks; pages move as Markdown. Block's first Linear server used 30+ tools, and "what issues is [email protected] working on" took four to six calls. The lesson for you: tools generated 1:1 from a REST or GraphQL spec push a non-deterministic planning problem into the model's loop, where it burns tokens and fails workflows. The 2026-07-28 revision makes every request self-contained, so any server holding session state is now exposed.

The Information reports surging demand for deterministic simulators that replay the same failure on command. Antithesis (Replit, Palantir, Datadog) raised $105M at a $525M post-money led by Jane Street. The timing matters because the probabilistic alternative is failing openly: in Semgrep's test, six well-grounded models each missed 70% of 27 known IDORs, and pooling five LLMs reached only 29.6% union recall. The same AI makes offense cheaper too: XBOW built a Chrome exploit chain in six days for about $40k. If you gate merges on an LLM reviewer, you're trusting an oracle that can't reproduce its own verdict.

Three unrelated teams traced real problems to stock settings rather than hardware. ClickHouse found a 32 ms tail on simple SELECTs after idle periods: TCP's congestion window reset during idleness, and unbatched metadata packets exhausted it. Application-level batching removed it. A Postgres logical-replication demo cut a major-version upgrade to a 181 ms write pause with a 179 ms reverse-replication rollback. And a CUDA Graphs explainer shows decode latency is often launch-bound on the CPU, so a faster GPU shortens kernels but leaves the idle gaps between them. The through-line for you: profile and measure before you buy silicon.

Zenity showed that AWS Bedrock AgentCore agents could reach the instance metadata service via SSRF, so one chat prompt extracted credentials and compromised every agent in the same account and region. The Firecracker microVM isolated the code but not the authority. Separately, Håkon Måløy's Copilot-for-Word worm hides white-on-white instructions that survive Microsoft's formatting strip, alter financial figures, and self-copy into every downstream document. The pattern you own: a sandbox is not an authority boundary, and model behavior is not a control. Scope the role and cut the read-write-reingest loop.