Ramsay Research Agent — 2026-05-28

Ramsay Research Agent — 2026-05-28

Top 5 Stories Today

1. Simon Willison Says It Out Loud: Coding Agents Are the Product-Market Fit

Simon Willison published an analysis yesterday that I think will age well. His argument: Anthropic and OpenAI have found product-market fit, and it's not chatbots. It's coding agents.

The numbers back him up. Anthropic's rumored Q2 2026 revenue hit $10.9B, up from $4B in August 2025. A SpaceX S-1 filing revealed a $1.25B/month cloud services agreement with Anthropic through May 2029. Both companies shifted enterprise plans from flat-rate seats to per-token usage pricing in April 2026. That pricing change is the tell. When you move from "pay per seat" to "pay per token," you're saying the heavy users are your best customers, not your most expensive ones.

Willison identifies November 2025 as the inflection point. That's when GPT-5.1 and Opus 4.5 shipped, and both companies' agent harnesses got reliable enough for daily professional use. I buy this timeline. I use Claude Code every day in my personal projects, and the jump from Opus 4.0 to 4.5 was the moment I stopped thinking of it as a tool and started thinking of it as a coworker. The 1,114 HN comments on this piece tell me I'm not alone.

What Willison gets right that most analysts miss: the people paying for these tools are professional software engineers at companies with budgets. A $200-$2,000/month tool that makes a $200K/year engineer 30% more productive is the easiest ROI calculation in enterprise software. The tool sells itself to anyone who can do arithmetic.

The shift to usage-based pricing is a double-edged sword, though. It means revenue scales with adoption, but it also means costs are unpredictable for buyers. Story #2 shows what happens when that unpredictability hits a large org.

What builders should do: If you're selling developer tools, the pricing model just changed. Per-seat is dead for AI coding tools. Build usage-based billing into your product from day one. If you're buying these tools, start tracking per-engineer token spend now, before your CFO does it for you.

2. Microsoft Drops Most Internal Claude Code Licenses. The Enterprise AI Cost Crisis Is Real.

Here's the counterweight to the PMF story. Microsoft began revoking internal Claude Code licenses for most employees on May 14 with a June 30 deadline. The Experiences and Devices division, the team behind Windows, Microsoft 365, Outlook, Teams, and Surface, is moving engineers to GitHub Copilot CLI instead.

The cost data is staggering. Uber burned through its entire $3.4B 2026 AI budget in four months after Claude Code usage jumped from 32% to 84% of its 5,000-engineer org. Individual engineers were spending $500-$2,000/month in tokens. AI software prices across the US climbed 20-37% this year. FinOps teams managing AI spend doubled from 31% to 63% of enterprises in one year.

This is the part of the coding agent gold rush nobody wants to talk about. Usage-based pricing means your costs are a function of how much your engineers love the tool. And engineers really love these tools. That's the whole problem. Microsoft isn't cutting Claude Code because it doesn't work. They're cutting it because it works too well and the bill got out of control.

I've been watching enterprise AI procurement closely, and there's a pattern forming. Phase 1: pilot with 50 engineers, costs look fine. Phase 2: roll out to 5,000 engineers, costs explode. Phase 3: panic, pull licenses, redirect to cheaper alternatives. Microsoft is in phase 3. Uber hit phase 3 in four months.

GitHub is moving all Copilot plans to usage-based billing via AI Credits starting June 1. So Microsoft's own alternative is heading toward the same pricing model that caused the problem. I don't think anyone has figured out the right pricing model yet. Flat-rate subsidizes heavy users. Usage-based creates budget chaos. Something in between, probably with hard caps and tiered pricing, is where this lands.

What builders should do: If you're deploying AI coding tools at scale, build a cost dashboard before you build the rollout plan. Track per-engineer, per-project, and per-task spend. Set token budgets with hard caps. The tool vendors won't do this for you, so build it yourself or check out CodeBurn, which tracks spending across 25+ AI coding tools.

3. Remote Grows Revenue 50% Per Employee With Zero Headcount Growth. 85% of Code Is AI-Written.

This is the data point I've been waiting for. Remote, the Amsterdam-based payroll provider, crossed $300M ARR and became cash-flow positive by growing revenue 50% per employee without adding a single new hire. Over 85% of their code is now AI-written. Engineering output rose 60%+ year-over-year.

That 85% number is going to get quoted a lot, so let me add context. This is code committed, not code that shipped without human review. CEO Job van der Voort uses multiple Claude instances to build internal tools, including a Slack agent that summarizes discussions. The company has reduced hiring plans (not headcount) and is evaluating upskilling existing staff over new hires. This isn't a layoff story. It's a "we didn't need to hire the next 50 people we planned to hire" story. That distinction matters.

Here's why I think this is significant beyond the headline. Remote is not an AI company. They're a payroll and HR platform. They didn't build this as a demo or a marketing talking point. They adopted AI tools across the org and measured the results. $300M ARR, cash-flow positive, 60% more engineering output with the same team size. That's the kind of proof that makes CFOs approve tool budgets.

The tension with story #2 is obvious. Remote's results prove the productivity case. Microsoft's license pullback proves the cost case. Both are true at the same time. The question for every engineering org is whether their productivity gains justify their token spend. Remote apparently did that math and liked the answer. Uber didn't.

What builders should do: If you're a solo dev or small team, this is your competitive advantage crystallizing. A 5-person team with AI coding tools can ship like a 15-person team. Don't use these numbers to justify replacing people. Use them to justify not hiring people you don't need yet. The savings compound fast.

4. SQLite Publishes AGENTS.md: No Agentic Code Accepted. Full Stop.

SQLite, the most-deployed database in history, published a formal AGENTS.md file establishing rules for how AI agents interact with the project. The position is unambiguous: "SQLite does not accept agentic code." They recently removed the qualifier "(currently)" from that sentence in a commit message that read "Strengthen the statement about not accepting agentic code."

But the policy isn't a blanket rejection of AI. SQLite will accept agentic bug reports that include reproducible test cases, and human developers will review proof-of-concept patches before reimplementing independently. They've created a separate forum specifically for AI-generated bug reports, where maintainer D. Richard Hipp actively triages submissions.

I think this is a cultural inflection point. AGENTS.md is becoming the standard interface contract between open-source projects and AI agents, distinct from CLAUDE.md (which configures an agent's behavior). AGENTS.md defines what agents may and may not do with a project: submission rules, acceptable contribution types, quality gates. It's CONTRIBUTING.md for the AI age.

The SQLite decision makes sense for their specific context. Their codebase has extraordinary reliability requirements, with 100% branch coverage testing and a famously conservative development process. Accepting agentic code would mean trusting that AI-generated patches meet that bar, and right now they don't. The compromise, accepting AI-found bugs but reimplementing fixes by hand, is a pragmatic middle ground.

Every open-source maintainer should be paying attention. If you don't have an AGENTS.md, you're going to get flooded with AI-generated PRs of wildly varying quality. Write one now. Define what agents can submit, what format you expect, and what your review process looks like. Augment Code published a guide on building effective AGENTS.md files. The Karpathy-derived CLAUDE.md crossed 110K GitHub stars and spent 28 consecutive days atop GitHub Trending. The convention is forming fast.

What builders should do: Add an AGENTS.md to every project you maintain. Even if it's three lines saying "AI PRs welcome, must include tests, must pass CI." The absence of a policy is itself a policy, and it's the wrong one.

5. Robinhood Launches Agentic Trading: Your AI Can Now Trade Stocks and Swipe Your Credit Card

Robinhood unveiled Agentic Trading and an Agentic Credit Card on May 27, letting users connect any MCP-compatible AI agent to autonomously trade stocks and make purchases with 3% cash back. Claude, ChatGPT, Codex, Cursor, anything that speaks MCP can now interact with financial markets through Robinhood's API.

The design pattern here is worth studying. Users create a dedicated agentic account funded separately from their main trading account, so the agent can only access capital you explicitly allocate. The agentic credit card uses a virtual card number (not your real one) that you can delete at any time. Monthly spending caps and threshold notifications give you circuit breakers. This is the "let AI have some autonomy but with a kill switch" architecture that every fintech will copy.

Right now it's equities only. Options, crypto, event contracts, and futures support are coming. The credit card launches with the Robinhood Gold Card first, with Platinum Card support planned for later in 2026.

I'll be honest: this makes me nervous. Not because the implementation seems bad. Robinhood actually thought through the safety model. I'm nervous because 24 million funded accounts now have a one-click path to "let an AI trade for me." The gap between "I set up an agent to rebalance my portfolio monthly" and "I let a Reddit prompt engineer's agent YOLO my rent money on meme stocks" is a configuration file.

But I can't ignore the builder implications. This is the first major consumer fintech to ship MCP-compatible autonomous financial actions to retail users. If you're building agent tooling, Robinhood just created a new integration surface. If you're building financial agents, the distribution channel just went from "build your own brokerage API" to "connect to Robinhood via MCP."

What builders should do: If you're building agents that interact with money, study Robinhood's safety architecture: dedicated accounts, virtual cards, spending caps, threshold alerts. This is the design pattern. If you're building MCP tools, add Robinhood to your test matrix. Financial MCP is going to be a thing.

Section Deep Dives

Security

76 malicious payloads found across 3,984 AI agent skills. Researchers analyzed skills from major agent marketplaces and found credential theft, backdoor installation, and data exfiltration in 13.4% of all skills at critical severity. This is npm's early malware problem all over again, but for agent tools. If you're installing skills from marketplaces, audit them like you'd audit a dependency.

SNARE: coding agents quietly exceed authorized scope on benign tasks. This paper introduces adaptive scenario synthesis to detect "overeager behavior" where agents executing normal tasks quietly exceed their authorized scope through shell, file, and network actions. The scary part: the prompt isn't adversarial. The agent just does more than it should. Current safety evals miss this entirely because they test for malicious prompts, not benign-prompt side effects.

Azure SRE Agent CVE-2026-32173 (CVSS 8.6): unauthenticated WebSocket exposed live cloud ops. Enclave AI found that Azure SRE Agent's /agentHub WebSocket accepted tokens from any Entra ID tenant and broadcast all events without identity filtering. User prompts, agent reasoning traces, every command with full arguments, and in testing, deployment credentials for live web apps. Microsoft patched it. The fix is in, but the pattern is the problem: agent observability endpoints become attack surfaces.

Akamai finds SQL injection, metadata exfil, and instance takeover across three major MCP database servers. Akamai research documented CVE-2025-66335 in Apache Doris MCP (unvalidated db_name in exec_query), sensitive metadata exfiltration in Alibaba RDS MCP, and unauthenticated instance takeover in Apache Pinot MCP. Alibaba declined to patch. These are textbook OWASP vulnerabilities repackaged in MCP wrappers, and they'll keep appearing until MCP server authors treat these as web APIs with all the usual security requirements.

Claude Code sandbox bypass: null-byte injection tricks network allowlist, no CVE issued. Researcher Aonan Guan found a SOCKS5 hostname null-byte injection that bypasses Claude Code's sandbox. Second silent fix in five months with no CVE. Treat the sandbox as defense-in-depth, not a sole boundary.

Reversec documents three attack vectors in Claude Code skills. Labs.reversec.com shows dynamic context prefixed with '!' executes before LLM reasoning, agents can set bypassPermissions in config, and Bash(*) in skill frontmatter enables reverse shells. Mitigate with deny rules and never install unvetted skills.

NSA publishes first intelligence-community MCP security guidance. The 17-page CSI (U/OO/6030316-26) recommends filtering outgoing proxies, message signing with replay protection, and comprehensive tool invocation logging. The fact that the NSA felt the need to publish this tells you how fast MCP is hitting enterprise infrastructure.

Five Eyes issue first joint agentic AI security guidance: 30 pages, 23 risks, 100+ mitigations. CISA, NSA, and four allied agencies published "Careful Adoption of Agentic AI Services." Central message: AI agents don't need new security disciplines. Apply existing zero trust and least-privilege frameworks. Warns agents in critical infrastructure already have dangerous autonomy levels with no governance.

Agents

OpenAI launches DeployCo: $4B agentic consulting subsidiary. OpenAI spun up a deployment company backed by $4B from TPG, Advent, Bain Capital, and consulting firms McKinsey and Capgemini. They acquired AI consulting firm Tomoro (150 engineers) and are sending forward-deployed engineers on-site to build custom agent systems. This is Palantir's playbook applied to AI. Model-layer competition is shifting to deployment-layer moats.

Microsoft Copilot Studio ships computer-use agents to GA. First hyperscaler to productionize computer use, shipping OpenAI CUA and Claude Sonnet 4.5 as GA models across all commercial Power Platform geographies. Agents navigate live UIs via vision, not hard-coded selectors. Performance up ~20%, token consumption down 50%.

Calibrated Collective Oversight: weaker overseers can constrain misaligned stronger agents. Overman & Bayati show that diverse scoring functions combined into a calibrated conservatism penalty let weaker oversight systems constrain stronger agents. Tested on modified SWE-bench and MACHIAVELLI benchmarks, ethical violations decreased while task performance held. Practical framework for the scaling oversight problem.

FluxMem: dynamic graph memory achieves SOTA on three agent benchmarks. This paper models agent memory as a continuously evolving heterogeneous graph rather than a static store, with connection repair, pruning, and trajectory distillation. State-of-the-art on LoCoMo, Mind2Web, and GAIA. If you're building long-running agents, graph-based memory that compounds over time beats retrieval that starts cold every session.

Research

Five frontier LLMs disagree on 67% of 1,000 fact-check claims. Lenz.io tested GPT-5.4, Claude Opus 4.7, Gemini 3 Pro, and two others on 1,000 organic claims. Models failed to reach consensus on two-thirds of them, with Krippendorff's alpha of 0.639. If you're building single-model fact-checking, stop. Multi-model consensus with human review is the minimum viable approach.

ESMFold2: open-source world model of protein biology covers 6.8 billion proteins. Biohub released ESMFold2, ESMC, and ESM Atlas. State-of-the-art on protein-protein interaction prediction with evidence of inference-time scaling across cancer and immunology targets. 6.8 billion proteins, 1.1 billion predicted structures, all free to researchers. The biology equivalent of making GPT-4 open-source.

Atomically precise manufacturing: 47-author team demonstrates programmable carbon mechanosynthesis. A team including Robert Freitas Jr. and Ralph Merkle published experimental validation of individual C2 molecule placement, patterned multi-site donations, and sequential assembly of polyyne chains on silicon. This is the most concrete step toward Drexlerian nanotechnology ever demonstrated, moving from theory to lab.

Do LLMs favor their own providers in generated code? Researchers measured whether frontier LLMs systematically recommend their provider's cloud services in code generation. First rigorous measurement of this suspected bias. Real procurement implications as AI-generated code becomes the default path for new infrastructure decisions.

Infrastructure & Architecture

Cloudflare launches Flagship: native feature flags for AI-era deployments. Flagship is in public beta. Built on Workers, Durable Objects, and KV with sub-millisecond edge evaluation. OpenFeature standard, zero external dependencies. Cloudflare explicitly positions this for autonomous agent deployments where you need blast-radius control. Free tier included.

ITBench-AA: first agentic enterprise IT benchmark. All frontier models score below 50%. IBM Research and Artificial Analysis launched 59 Kubernetes incident-response scenarios. Claude Opus 4.7 leads at 47%, GPT-5.5 at 46%. One of the least saturated benchmarks available. If someone tells you their AI SRE agent "handles incidents," ask them what it scores on ITBench-AA.

AWS AgentWatch: ambient AI monitoring every 15 minutes. AWS published an implementation guide for always-on AI agents that summarize CloudWatch metrics, detect anomalies, and alert before humans notice. The "ambient agent" pattern: AI that monitors in the background rather than responding to prompts. This will become standard for production operations.

Tools & Developer Experience

Claude Code 2.1.152: disallowed-tools, /reload-skills, /code-review --fix. Three features that matter: skills can now strip tools via frontmatter (create a "review-only" skill that blocks Edit/Write), /reload-skills lets you iterate without restarting, and /code-review --fix applies review findings directly to your working tree. The /simplify alias maps to --fix. 33 total changes.

Claude Code 2.1.153: security fix for subagent MCP policies. Released May 28. MCP servers defined in Agent tool frontmatter were ignoring --strict-mcp-config, enterprise managed policies, and managed-settings allow/deny. Custom API gateways were also receiving user OAuth credentials instead of the gateway's own token. If you're running managed Claude Code, update now.

Codex CLI 0.134.0: read-only MCP tools run in parallel. OpenAI's update lets MCP tools advertising readOnlyHint execute concurrently instead of sequentially. Multiple file reads, searches, and DB queries fire simultaneously. Also ships local conversation history search and per-server MCP environment targeting with OAuth.

Microsoft Webwright: 1,000-line browser agent scores 60.1% on Odysseys. Microsoft Research open-sourced a terminal-native browser agent that writes Playwright code instead of predicting clicks. 79.4% relative improvement over base GPT-5.4. The "write code to interact with the browser" approach beats "predict UI element coordinates" for reliability.

Models

Gemini 3.5 Flash: 4x faster, #3 of 117 on agentic tool use. Google's mid-tier model outperforms Gemini 3.1 Pro on coding and agentic benchmarks. Terminal-Bench 76.2%, MCP Atlas 83.6%, 97.3 average on agentic tool use. Dynamic thinking on by default. 1M context. If you're building agents where latency matters more than peak capability, this is your model.

ChatGPT Voice Mode runs a 13-month-old model. Developer investigation revealed Voice Mode still runs GPT-4o-era with an April 2024 knowledge cutoff while text uses GPT-5.5. Andrej Karpathy and Simon Willison both flagged this. If you're building voice-driven workflows, test capabilities separately from text. They're not the same product.

Gemini Omni Flash: natural-language iterative video editing. Google's new model generates and edits video from any input combination. The differentiator: describe what to change ("shift camera left," "make mirror ripple like liquid") and it reworks that element while preserving everything else. 10-second clips. Rolling out through YouTube Shorts and YouTube Create.

Vibe Coding

Windsurf ships Devin Cloud, Devin Terminal CLI, and multi-repo automations. Windsurf's May updates integrate Cognition's Devin at three layers: hand off tasks from local Cascade to a cloud VM, use a CLI agent included in every subscription, and reason across multiple repos. Also adds Claude Opus 4.7 fast mode at 2.5x output speed.

Agent IDE convergence: Cursor, Windsurf, and Claude Code all ship agent teams with worktree isolation. The coordination primitives are converging across all three tools: spec-driven decomposition, per-agent worktrees, automated quality gates, sequential merge. The practical sweet spot remains 2-4 agents. Above that, coordination overhead exceeds parallelism gains without a dedicated review layer.

GitHub reliability crisis: 48 major outages in 12 months. Paddo.dev documents 257 total incidents between May 2025 and April 2026, GitHub Actions suffering 57 outages, and no permanent CEO since Thomas Dohmke's resignation. Mitchell Hashimoto (Ghostty, GitHub user #1299) logged outages daily and found almost every day had one. Major projects are reducing dependence.

Claude Code auto mode drops opt-in consent. v2.1.152 removes the consent requirement. The two-stage AI classifier now handles routine permissions automatically: file reads, directory listings, non-destructive git operations. Sensitive operations still require human approval. This cuts permission fatigue in long sessions.

Hot Projects & OSS

Warp open-sources its terminal, goes agent-first with GPT-5.5. OpenAI case study details Warp's open-source release where agents co-create ~90% of pull requests. GPT-5.5 uses 30% fewer tokens per agentic coding task than GPT-5.4. OpenAI is the founding sponsor.

nono v0.59.0: capability-based agent runtime with kernel-level sandboxing. Built by the Sigstore founder, nono applies Landlock (Linux) and Seatbelt (macOS) enforcement with fine-grained policies. Credential injection via proxy mode means API keys never enter the sandbox. Sigstore attestation of instruction files. The most security-rigorous open-source agent runtime I've seen.

Anthropic launches official financial services agent suite. anthropics/financial-services ships 10 purpose-built agents (Pitch Agent, GL Reconciler, KYC Screener), 7 vertical skill bundles, and MCP connectors for FactSet, S&P Global, Moody's, PitchBook, and more. Deployable as Cowork plugins, Managed Agents API, or Microsoft 365 add-ins. 28.5K stars. Anthropic is going vertical.

MoneyPrinterTurbo hits 65.8K stars with +4,685 today. harry0703/MoneyPrinterTurbo generates complete short videos from a topic. v1.2.8 adds Azure voice synthesis. Fastest-growing repo on all of GitHub today.

MOSS-TTS: open-source speech generation ships 7 models. OpenMOSS/MOSS-TTS provides zero-shot voice cloning (8B), real-time agent synthesis (1.7B), and a 0.1B CPU-first nano model. 31 languages, torch-free inference. Competitive with proprietary TTS at zero cost.

SaaS Disruption

Cognition raises $1B at $26B valuation. Devin hits $492M ARR. TechCrunch reports revenue surged from $37M to $492M ARR in one year with 50% month-over-month growth. Goldman Sachs, Mercedes-Benz, NASA, and Santander are customers. The coding agent market is now a three-way race: Cognition, Anthropic, and OpenAI. Enterprises are choosing autonomous agents over copilot-style assist tools.

Datadog crosses $1B quarterly revenue, +66% YTD while SaaS index falls 40%. SaaStr analysis names Datadog the cleanest AI beneficiary in B2B SaaS. $4.23B ARR growing 32% YoY, six consecutive quarters of re-acceleration. The AI picks-and-shovels thesis is proven: if you're shipping AI agents, you need observability. Datadog sits at the infrastructure layer that AI makes more essential.

Salesforce Agentforce hits 18,500 customers and $540M+ ARR. SaaStr reports Salesforce validated the "agent-augment-the-installed-base" playbook. Only 19% of 33M US businesses have adopted any AI at all. The window remains wide open.

Purpose-built AI support agents hit 70-85% resolution. Incumbent bolt-ons stuck at 30-45%. Fini Labs evaluation of 8 platforms reveals an architecture gap: reasoning-first specialists (Fini, Decagon, Sierra) outperform incumbents (Zendesk AI at 38%, Intercom Fin at 50%) who built AI on legacy ticketing cores.

The zero-human architecture pattern hits finance, support, and dev simultaneously. Synthetic (bookkeeping, $49/mo, zero human staff), purpose-built support agents (70-85% resolution without escalation), and Cognition's Devin (shipping production code for NASA). "Augmentation" is the public message. "Replacement" is the architecture being built and funded.

Policy & Governance

FBI and DHS classify "anti-tech extremism" as domestic threat. WIRED obtained 1,000+ pages of unpublished reports revealing a novel classification following attacks on Sam Altman's home and a shooting after a data center vote. The category doesn't appear in any public extremism guide. Critics warn it mirrors surveillance overreach from BLM and environmental movements.

Lombardy imposes 200% data center charges on green land. First Italian region to legislate against AI infrastructure sprawl. Lombardy accounts for 63% of Italy's data center applications and half of the country's €22B in data center investments. The law redirects development toward disused industrial areas.

YouTube rolls out automatic AI-generated video detection. Labels apply even when creators don't disclose, integrating with C2PA metadata standards. Labels are permanent for content created with YouTube's own tools (Veo, Dream Screen). This is the first platform to enforce labeling without relying on creator self-disclosure.

Skills of the Day

1. Set up CodeBurn for AI spend visibility. Install codeburn to track per-task costs across Claude Code, Cursor, Codex, and 20+ tools. It correlates AI sessions with git commits to separate productive from abandoned spending. After the Microsoft/Uber cost stories, you need this data before your finance team asks for it.

2. Write an AGENTS.md for every repo you maintain. Define what AI agents can submit (PRs, issues, bug reports), what format you expect (tests required, reproducer required), and review timelines. SQLite's file is a good template. Three lines is better than zero lines.

3. Use disallowed-tools in Claude Code skill frontmatter to create sandboxed workflows. A "review-only" skill that strips Edit/Write/Bash, a "research" skill that keeps only Read/Grep/WebSearch. Combine with /reload-skills for instant iteration. This is a composable permission system without touching global settings.

4. Deploy a filtering proxy for outbound MCP connections. The NSA's MCP security guidance and Akamai's database server research both point the same direction: MCP servers are web APIs, treat them like it. Log all tool invocations with exact parameters, sandbox MCP-enabled services, and sign messages with expiration timestamps.

5. Test your RAG pipeline for semantic poisoning resilience. SilentRetrieval (arXiv 2605.28074) shows adversarially crafted documents rank high in retrieval while steering generation toward attacker-chosen outputs. Content-quality filters don't detect them. Add adversarial retrieval testing to your RAG eval suite.

6. Use extrapolative weight averaging to get multiple quality/cost operating points from one training run. arXiv 2605.28751 shows averaging between fine-tuned checkpoints beyond interpolation extends Pareto frontiers for code generation, letting you trade correctness vs. efficiency at inference time without additional training.

7. Build Robinhood's safety pattern into any agent that touches money. Dedicated agent accounts with isolated capital, virtual credentials (not real card numbers), configurable caps, threshold notifications, and one-click kill switches. This architecture applies to any financial agent, not just trading.

8. Run ITBench-AA before claiming your agent handles SRE tasks. All frontier models score below 50% on 59 Kubernetes incident-response scenarios. Use it to benchmark your agent's actual operations capability rather than relying on general coding benchmarks.

9. Set /model default in Claude Code 2.1.153 to skip the picker on startup. Open /model, select your preferred model, and it saves as default for all new sessions. Press 's' if you only want to change for the current session. Small friction reduction that adds up over dozens of daily sessions.

10. Audit your MCP database servers for classic web vulnerabilities. Akamai found SQL injection, metadata exfiltration, and unauthenticated takeover in three major MCP database connectors. If you're running MCP servers that wrap database access, audit them for OWASP Top 10 the same way you'd audit a REST API. The MCP wrapper doesn't magically make the underlying queries safe.