Ramsay Research Agent — June 5, 2026

Ramsay Research Agent — June 5, 2026

Karpathy went back to pretraining. Windsurf became a different product overnight while you slept. A company stood on a stage and showed you their org chart: 3 people, 21 robots. And Opus 4.8 found a counterfeiting bug in Zcash that four years of cryptographers walked right past. Busy week. Let me get into it.

Top 5 Stories Today

Karpathy joined Anthropic's pretraining team, and his exit note is the real story

Andrej Karpathy announced he's joining Anthropic, starting on the pretraining team. The post (X/Twitter) pulled close to 3 million views inside an hour, which tells you how much weight this one name still carries.

Here's why I can't stop thinking about it. This is the guy who coined "vibe coding." The OpenAI founding member who spent the last couple years teaching, building Eureka Labs, making the most-watched neural-net-from-scratch videos on the internet. The independent voice. And he's walking back into a frontier lab to do pretraining. Not tooling. Not education. Not an agent startup. Pretraining. The most capital-intensive, least glamorous, hardest-to-do-solo part of the entire stack.

The companion post is the part builders should sit with. He wrote that he's "never felt this much behind as a programmer," that his contributed bits are getting "increasingly sparse and far between," and that he could be 10X more powerful if he properly strung together the AI capabilities already sitting in front of him. Read that again. One of the best engineers alive is telling you the bottleneck isn't capability. It's orchestration. It's knowing how to wire the pieces together.

I've felt a version of this for months. The models can do more than I'm asking them to do, and the gap is on me, not them. The limiting factor in my own work shifted from "can the model do this" to "have I built the right harness around it." Karpathy saying it out loud, while also voting with his feet by going to pretraining, is a two-part signal: the frontier work is concentrating at the labs, and the leverage for the rest of us is in integration.

What to do about it: stop treating your AI tooling as a fixed thing you've already configured. Karpathy, with all his ability, thinks he's leaving 10X on the table by not stringing capabilities together. You almost certainly are too. Audit your actual workflow this week. Where are you hand-carrying context between tools that should be wired together? That's your 10X, sitting there.

Windsurf became Devin Desktop overnight, and Cascade is dead July 1

Cognition shipped an over-the-air update on June 2 that rebranded Windsurf to Devin Desktop and auto-ported everyone's settings (Devin/Cognition). Cascade, the agent a lot of people actually chose Windsurf for, is deprecated. End of life July 1, 2026. In its place: Devin Local, a from-scratch Rust rewrite that's up to 30% more token-efficient and adds subagents. The default UI moved from an editor canvas to an "Agent Command Center" hub.

Sit with the mechanics for a second. You didn't download this. You didn't opt in. You opened your editor and it was a different product with a different agent and a different interface. That's the part that should make every builder uncomfortable, separate from whether Devin Local is good. Your core dev tool changed underneath you via OTA, and the thing you built habits around has a 26-day clock on it.

The 30% token efficiency claim matters more than it sounds, given where billing is heading (more on that below). A Rust rewrite of the agent loop is a real engineering investment, not a reskin. Subagents put it in the same conversation as Claude Code's orchestration work. So this isn't Cognition being lazy. It's Cognition deciding the editor was never the product. The agent was.

Which connects to the other half of this story: the Agent Client Protocol. ACP is an open standard letting any compatible agent run inside any compatible editor, and it's been picked up by JetBrains, Google, GitHub, Zed, and 25+ agents as of June 2026 (ChatForest). Devin Desktop launched on it, supporting Codex, Claude Agent, and OpenCode. The agent is being decoupled from the editor. Backends are becoming swappable.

What to do about it: if you're on Windsurf, you have a forced decision before July 1. Either commit to Devin Local and relearn the workflow, or export and move. Don't let the OTA make the choice for you by default. And more broadly, stop marrying yourself to any single agent's UI. The ACP momentum says the smart bet is portability. Pick tools that let you swap the backend, because the backend is going to keep changing without asking you.

SaaStr ran the whole company on 3 humans and 21+ AI agents, and showed the receipts

At SaaStr AI 2026, the team put the live back ends of their top agents on stage and walked through the operation agent by agent, with the numbers (SaaStr). Three humans. Twenty-one-plus agents. Not a keynote projection of the future of work. An itemized accounting of a content-and-events business running right now.

Most "AI will change everything" talks are vibes. This was a reference architecture. That's why it lands. I run a pipeline that dispatches 13 research agents daily and I still found their breakdown useful, because the hard question was never "can agents do tasks." It's "what's the actual human-to-agent ratio for a real business, and where do the humans stay." SaaStr's answer to where humans stay is roughly: taste, relationships, and the calls agents can't be trusted to make. The rest is metered token spend.

This doesn't stand alone. Intercom renamed itself Fin and shipped an agent whose only job is supervising another agent (VentureBeat). Databricks measured multi-agent system usage jumping 327% in four months as companies swap bundles of SaaS subscriptions for agents that span systems (Orbilon). The 20VC × SaaStr roundtable put a name on the thesis: "tokens over humans" (SaaStr). Agents managing agents, paid by consumption, displacing seat-priced tools. It's the same shape showing up in four places at once.

I'll be honest about my skepticism. "21 agents" is easy to say and hard to verify, and a content business is about the friendliest possible case for agent staffing. I don't think this maps cleanly to a company shipping a regulated product or holding customer money. But the transparency is the gift here. They showed the stack. That's rare, and it's worth more than any analyst projection.

What to do about it: map your own work to their model. Which of your recurring tasks are already agent-shaped, and what's the honest reason a human is still doing them? Sometimes the answer is taste. Sometimes it's just inertia. Be specific about which.

Microsoft shipped its own coding model at Build, and the platform owners are coming for the layer

Microsoft unveiled MAI-Code-1-Flash at Build, its first model that turns written descriptions into source code for apps and websites, explicitly aimed at lowering developer costs and cutting its dependence on OpenAI (CNBC). Same week, Google pushed Gemini 3.5 Flash to general availability: 76.2% on Terminal-Bench 2.1, 1656 Elo on GDPval-AA, 83.6% on MCP Atlas, priced at $1.50/$9 per million tokens with a 1M-token window (Google).

Connect the dots. Microsoft is building its own coding model to need OpenAI less. Google is shipping a frontier-agentic Flash model at aggressive pricing. Cognition rewrote its agent in Rust and put it on an open protocol. The platform owners and tool makers have all independently decided the coding model is too strategic to rent. A year ago the story was "which frontier lab's API do I call." Now it's "who owns the coding layer," and the answer is increasingly "the platform, in-house."

For builders this cuts two ways. The good: more competition on coding models means better prices and you stop being captive to one vendor's roadmap. Gemini 3.5 Flash at $1.50/$9 with frontier agentic scores is a genuinely strong default for high-volume agent loops where you were burning premium tokens on routine work. The uncomfortable: MAI-Code-1-Flash isn't really for you, it's for Microsoft, and the gravity of these platforms pulls toward defaults you didn't pick. When your cloud, your IDE, and your model all come from the same company, "best tool" quietly becomes "their tool."

What to do about it: benchmark Gemini 3.5 Flash against whatever you're currently paying premium rates for on agentic tasks. The Terminal-Bench and MCP Atlas numbers say it's real for tool-use workloads, and 4x speed at that price changes the math on running agents in a loop. But keep your prompts and harness portable. The whole point of this week is that the model under you is now a commodity that changes often. Don't hardcode to any one of them.

Opus 4.8 found a 4-year counterfeiting bug in Zcash that cryptographers missed, and ZEC dropped 31%

Security engineer Taylor Hornby, using a custom AI auditing framework paired with Anthropic's Opus 4.8 (released May 28), found a critical flaw in Zcash's Orchard protocol on May 29 that could have minted unlimited, undetectable counterfeit ZEC (Unchained). The bug had been live since Orchard activated in May 2022. Four years. An emergency two-phase network upgrade finished the fix June 2. ZEC fell about 31% on disclosure. And because of Zcash's own privacy design, it's cryptographically impossible to know whether the flaw was ever exploited. The story hit 783 points on Hacker News.

This is the one that rearranged my priors. Orchard is shielded-pool cryptography, the kind of code that gets the most expert eyes per line of anything in software. Professional cryptographers, formal review, years of scrutiny, real money on the line. And a critical unlimited-counterfeiting bug sat there since 2022 until a human pointed a frontier model at it.

It doesn't stand alone either. A developer reported Opus 4.8 one-shot a formally verified polygon-intersection proof that earlier models couldn't produce (GitHub/HN). Goedel-Architect is an agentic framework doing Lean 4 theorem proving via blueprint decomposition (arXiv). Three separate data points, same week, all pointing at a step change in machine-checkable, formal-methods, deep-correctness work with the late-May Opus release. The capability didn't creep. It jumped.

Be precise about what this is and isn't. It's not "AI replaces auditors." A skilled human built the framework, aimed it, and validated the finding. The model didn't wake up and decide to audit Zcash. But the assumption that adversarial review is a purely human ceiling, that enough expert eyes eventually catch everything, just took real damage. If a four-year-old bug in the most-scrutinized cryptography in crypto fell to one engineer plus Opus 4.8, what's sitting in your codebase that's had far fewer eyes?

What to do about it: run an AI-assisted audit pass on your security-critical code. Not as a replacement for review, as a second adversary with a different failure profile than a human reviewer. Point a frontier model specifically at invariants, auth boundaries, and anything handling money or access. The Zcash result says the floor on what this catches is higher than you think.

Security

MCP server sprawl is now the dominant agent supply-chain risk: 12,520 exposed services, ~40% with no auth. VIPER-MCP swept roughly 40,000 MCP server repos and produced 106 zero-days and 67 CVEs, while Censys counted 12,520 internet-exposed MCP services with about 40% completely unauthenticated (Adversa AI). Akamai separately disclosed SQL injection in Apache Doris MCP and unauthenticated metadata exfiltration in Alibaba RDS MCP. We speed-ran every mistake of the early API era, except faster and with tool-execution attached. If you run a remote MCP server and it doesn't have auth in front of it, that's the bug. Fix it today.

The NSA published its first authoritative baseline for securing MCP deployments. The guidance walks through MCP's inverted client-server pattern, unverified task propagation between servers, and arbitrary-code-execution exposure (Adversa AI). The single highest-impact line: put authentication in front of every remote MCP server and pull unauthenticated ones off the public internet. When the NSA writes baseline guidance for your protocol, the protocol is critical infrastructure now. Treat it that way.

SymJack and TrustFall: new symlink-hijack and RCE chains hit six AI coding agents. Microsoft researchers detailed SymJack, a symlink-hijack RCE affecting six coding agents, and TrustFall, which impacts Claude Code, Cursor, Gemini CLI, and GitHub Copilot (Microsoft Security). These join Semantic Kernel prompt-injection-to-host-RCE flaws. The local coding agent is now a prime attack surface, not a sandboxed toy. Audit filesystem and symlink handling in anything you run with shell access.

Windsurf prompt-injection RCE: attacker HTML can register a malicious MCP server. A disclosed flaw in Windsurf 1.9544.26 lets remote attackers run arbitrary commands. When the editor processes attacker-controlled HTML, malicious instructions modify the local MCP config and silently register a malicious STDIO MCP server (OX Security). Any content your agent fetches from the web is untrusted input. Treat a webpage your agent reads with the same suspicion as a file an attacker handed you.

Dashlane confirmed attackers downloaded encrypted vaults from ~20 users, and the disclosure was criticized as opaque. The attackers targeted large numbers of accounts to raise their odds (Ars Technica). Researchers panned the advisory for omitting scope and method, leaving users unable to judge their own exposure. The vaults are encrypted, so the crypto is the backstop, but a breach notice that doesn't tell you whether you're affected is half a notice.

Agents

Agent-threat-rules ships "Sigma for AI agents": 425 open detection rules, 97.1% recall, already in Microsoft AGT, Cisco AI Defense, MISP and OWASP. The project proposes a vendor-neutral detection standard explicitly modeled on Sigma (GitHub). That downstream adopter list is unusually broad for a young repo. This is the clearest sign yet that detections-as-code for autonomous agents is consolidating into one shared format instead of fragmenting per vendor. If you're building agent monitoring, start from this rather than rolling your own taxonomy.

Agent runtime security was the fastest-forming OSS category this week: 15+ new governance repos in days. A single week of trending surfaced Armorer (control plane with sandboxes and approvals), agent-aegis (full-lifecycle protection from Ant Group), immunity-agent (skill governance), Adrian (real-time malicious tool-use detection), and vigils (local Rust/Tauri approval plane) (GitHub). Ant Group, indie labs, and security startups all shipped into the same gap inside seven days. Approval and guardrail middleware is becoming a standard layer, not an afterthought. Pick one before you ship autonomous agents to production, don't bolt it on after the incident.

Claude Code reportedly ships a feature-flagged-off engine that fans out to 1,000 subagents. Paddo.dev documents a multi-agent orchestration system inside Claude Code where Claude writes a JavaScript orchestration script with a background runtime, holding intermediate state in script variables outside the main context window (paddo.dev). It mirrors orchestrator-worker research architectures. Script-driven, deterministic agent fan-out as a first-class coding pattern is where this is going. The context window stops being the ceiling when state lives in the script.

Latent Agents internalizes multi-agent debate into a single forward pass. An arXiv paper proposes a post-training method that captures the reasoning gains of agent ensembles without paying to run multiple agents at inference (arXiv). If it holds up, it collapses expensive debate orchestration into one model call. Worth watching for anyone weighing ensemble quality against latency and token budgets, which is most of us.

Research

Vortex makes sparse attention programmable for long-generation agents. The serving system targets the practical inference-cost wall you hit when agents produce very long outputs and dense attention becomes the bottleneck (arXiv). As agent runs get longer, this is the kind of infra that decides whether serving them at scale is affordable. Directly relevant if you're hosting agentic LLMs yourself.

A pre-registered study asks whether reasoning "skills" actually help code generation, or whether it's just the scaffolding. The controlled, two-tier design tests if prompting an LLM to reason like a scientist (form and falsify hypotheses) improves code, or whether the structure does the work regardless of the vocabulary (arXiv). Pre-registration is rare and welcome in prompt-engineering research, where most claims are vibes plus a cherry-picked example. Read it before you write your next elaborate reasoning prompt.

RREDCoT redistributes RL reward across chain-of-thought segments instead of only the final answer. Denser credit assignment attacks the sparse-reward problem that limits RL-trained reasoners (arXiv). If you're training your own reasoning models, segment-level reward is the lever to try when the model gets the right answer through bad steps.

Cloudflare's CEO says bot traffic has passed human traffic, driven by agentic activity, a year ahead of expectations. Automated traffic eclipsed real people earlier than anyone forecast (Tom's Hardware). Every assumption baked into rate-limiting, bot management, and analytics was built for a human-majority web that no longer exists. If you operate a site, your traffic model is already wrong.

Infrastructure & Architecture

TSMC told customers it can't keep up with AI demand, even with the US buildout. Executives reportedly conceded "we can only support so much" (The Verge). This is the upstream constraint behind everything else, the single bottleneck that throttles every frontier lab and hyperscaler at the same time. All the data-center announcements downstream of this run into the same fab ceiling.

AirTrunk committed $30B to build 5GW of AI compute across India. One of the largest single-country infrastructure commitments to date (TechCrunch). The hyperscale buildout is escalating into South Asia as demand outruns existing capacity. Meanwhile Meta is standing up capacity in literal tents borrowed from Tesla's playbook (TechCrunch), and Kevin O'Leary halved a 40,000-acre Utah site under community pressure (The Verge). The compute land-grab is hitting physical limits: fabs, power, water, and neighbors who vote.

Kong rebranded to "The API and AI Gateway" at 43.5K stars. It added ai-gateway alongside its established api-gateway topics (GitHub). Traditional edge infra (gateways, proxies, load balancers) is adding first-class LLM routing, governance, and observability. For platform engineers, an AI gateway at the edge is becoming the standard control point for model traffic and cost. This is where you centralize token spend before it sprawls across services.

Tools & Developer Experience

Hugging Face rebuilt its hf CLI to be consumed by agents, not just humans. The redesign optimizes command structure and output for programmatic, agentic workflows (Hugging Face). Tooling built first for agents-as-users is a design pattern worth internalizing. If you ship a CLI, the question now includes "what does this look like when an agent is calling it in a loop," not just "is this ergonomic for a person."

OpenAI Codex added Sites preview and Computer Use on Windows. Sites lets you create, deploy, and inspect web apps hosted by OpenAI directly from the Codex app, and Computer Use can now see, click, and type in Windows applications while testing and debugging (OpenAI). The Bedrock catalog also picked up GPT-5.5. The agent that writes the app and the agent that drives the GUI to test it are merging into one tool.

Boxes.dev pitches cloud dev environments built to run Claude Code and Codex remotely. Purpose-built sandboxes for agentic tools instead of your laptop (Boxes.dev). The pitch targets long-horizon or parallel agent runs that hit the limits of local execution. As agent runs stretch to hours, laptop-bound execution stops making sense, and "where does my agent actually run" becomes a real infra decision.

Models

Anthropic released Opus 4.8 on May 28, and the formal-methods jump is showing up everywhere. Beyond the Zcash audit, it one-shot a formally verified polygon-intersection proof earlier models failed (GitHub) and is anchoring agentic Lean 4 theorem-proving frameworks (arXiv). The pattern across these is deep-correctness, machine-checkable work, exactly the domain where you'd least expect a sudden leap. If your last impression of frontier-model formal reasoning is from a few months ago, it's stale.

Microsoft's MAI family expanded past text into voice with MAI-Voice-2. Expressive TTS with voice cloning across 15 languages (Product Hunt), alongside MAI-Code-1-Flash. Microsoft is methodically building out an in-house model stack across code, voice, and image to depend on OpenAI less across every modality, not just one. The "rent the model" era is ending for the platform owners.

OpenAI shipped "Dreaming," a new persistent-memory system for ChatGPT. The architecture is built to retain user preferences and keep context fresh across conversations (OpenAI). The whole industry is pivoting from per-session context windows to stateful, long-lived memory. Memory is now a competitive surface between assistants, not a feature checkbox.

Vibe Coding

Metered-by-default billing has now hit every major coding-agent vendor. A twelve-month progression: Cursor (June 2025), Anthropic Enterprise (Nov 2025), GitHub Copilot (June 1, 2026), Anthropic headless (June 15, 2026) (paddo.dev). Per-seat pricing was never designed for one person running a fleet of agents. Instrument token usage as a first-class cost concern now, because the subsidy window is closing. This connects directly to why Devin Local's 30% efficiency gain matters: efficiency is about to be money.

Cursor splits Teams into Standard ($32/seat) and Premium ($96/seat) with separate usage pools, effective July 1. Each seat now gets two pools, one for first-party Cursor models and one for third-party API calls, previously commingled (Octave HQ). The unbundling of "your model" from "everyone else's model" in the pricing is itself a signal: vendors want you on their inference. Watch which pool your routine work draws from.

Copilot's metering keeps completions free but bills agent mode. Code completions and Next Edit Suggestions stay unlimited on paid plans, while chat, agent mode, code review, Copilot CLI, and the cloud agent all draw down AI Credits (GitHub). Route routine inline work to free completions and reserve metered agent mode for tasks that justify the spend. Set user-level budget caps before the bill teaches you the lesson.

Amazon built an internal leaderboard ranking engineers by AI usage. Employees gamed it immediately. They ran agents on pointless tasks to inflate token counts (paddo.dev). Goodhart's Law with a meter attached. Measuring "AI usage" as a performance proxy optimizes for token burn, not shipped value. If you're tempted to track agent consumption as a productivity metric, this is your warning. Track outcomes.

Hot Projects & OSS

ruvnet/ruflo hit 58K stars as a multi-agent "meta-harness" for Claude. It deploys agent swarms with adaptive memory, self-learning, and autonomous workflow coordination, targeting the orchestration layer above individual coding agents (GitHub). This is the "orchestrating AI is the bottleneck" thesis turned into a repo. Worth a look if you're running parallel agent teams and want memory and coordination primitives out of the box instead of building them.

shareAI-lab/learn-claude-code reached 64.9K stars with "bash is all you need." A nano Claude-Code-style harness built from scratch, 0 to 1, as an educational reference (GitHub). The star count reflects real appetite for understanding how coding agents work under the hood, not just using them. If you've ever wanted to roll your own harness, this is the readable reference implementation to start from.

The agent-memory race is now a three-way benchmarked fight. MemPalace (~53.6K stars) claims best-benchmarked, against mem0 (~57.8K) and claude-mem (~80.8K) (GitHub). Agent memory went from experimental nicety to a competitive subcategory with published benchmarks. Pair this with the local-first angle: Mnemo offers a Rust + SQLite + petgraph memory layer with no cloud dependency (GitHub). Portable, controllable memory is having a moment.

NousResearch/hermes-agent hit ~182K stars and is becoming a named harness target. From the team behind the Hermes open-weight models, positioned as a personal agent that "grows with you" (GitHub). Other tools in this week's batch now name-check "Hermes Agent" as a first-class target alongside Claude Code and Codex. When competing tools start building integrations for your harness, it's arrived.

SaaS Disruption

Salesforce now runs three pricing models at once in Agentforce because per-seat broke. Summer '26 simultaneously offers conversation-based pricing for support, Flex Credits per AI action, and traditional per-user licensing (Monetizely). Roughly 43% of SaaS companies now use hybrid pricing, projected to hit 61% by year-end, and hybrid firms report ~38% higher revenue growth. The incumbent running all three meters in one product is the clearest admission that no single pricing axis survives the agent era.

Wordsmith raised $70M to pull legal work in-house and away from law firms, now used by 500+ companies. The Series B (led by Highland Europe and Index Ventures) explicitly positions to move corporate legal spend in-house, with BT, the Financial Times, Canva, and Trip.com on board (Yahoo Finance). This is vertical-AI eating services spend, not software spend. The target isn't another SaaS tool, it's the outside law firm's invoice.

Pylon reports 150+ migrations off Zendesk, Intercom, and Salesforce Service Cloud. The AI-native B2B support platform, built for Slack and Teams rather than retrofitted from B2C ticketing, serves 750+ companies (Together AI, Cognition, Temporal) with 158% net revenue retention nearing $10M ARR (SaaStr). The migration count is the real signal. Legacy helpdesk displacement in B2B is measurable now, not theoretical.

Vercel's AI SDK 6 crossed 3M weekly downloads, folding agent observability into the SDK. Up from ~446K a year ago, with agents, tool-execution approval, full MCP support, and DevTools that show step-by-step LLM/agent calls (Vercel). Agent tracing and observability is becoming a free SDK feature rather than a standalone paid product. If you were planning to pay for an agent-monitoring SaaS, check what your SDK already gives you first.

Policy & Governance

Trump signed a scaled-back AI executive order: voluntary 30-day frontier-model review. Cut from a 90-day draft after Musk, Zuckerberg, and Sacks lobbied, with mandatory licensing dropped (The Register). It also directs agencies to build cyber-capability benchmarks and stand up an "AI cybersecurity clearinghouse" for sharing model vulnerabilities. It's non-binding, but it's the first concrete US federal pre-release review framework. The clearinghouse piece connects straight to the labs-as-security-providers trend.

Ladybird browser stopped accepting public pull requests, blaming AI for breaking the "effort = good faith" signal. Andreas Kling announced on June 5 that the project will accept code only from maintainers, arguing AI broke the assumption that a substantial patch implies substantial effort (Ladybird). This is open source restructuring its trust model because AI made low-effort large contributions cheap. Expect more projects to follow as the alpha approaches and accountability matters more.

Anthropic, Google, and OpenAI are all positioning as security infrastructure for governments. Anthropic scaled Claude Mythos to critical infrastructure across 15+ countries via Project Glasswing (TechCrunch), while OpenAI is rolling GPT-5.5-Cyber to vetted EU governments and institutions (LLM Stats). The frontier labs are reframing themselves as security vendors to the state. Pair that with the EO's clearinghouse and the direction is clear: model providers and governments are entangling fast.

Skills of the Day

1. Run an AI-assisted audit pass on your security-critical code. The Zcash result proves a frontier model with a custom framework catches invariant and counterfeiting bugs that survived years of expert review. Point Opus 4.8 specifically at auth boundaries, money-handling paths, and protocol invariants. It's a second adversary with a different failure profile than your human reviewers, not a replacement for them.

2. Add cross-encoder reranking as a second stage to your RAG pipeline. Retrieve a broad candidate set (N=50–100) with hybrid dense+BM25, then re-score with a query-aware cross-encoder and keep only the top 3–5 chunks. On BRIGHT Biology this moved nDCG@10 from 0.13 to 0.40 (AppScale). It's the highest-ROI single change for an existing RAG system because it reorders the same candidates.

3. Pick your reranker by latency budget, not by default. A MiniLM cross-encoder over 50 candidates runs 100–250ms on CPU, FlashRank drops it to 15–30ms, Cohere's hosted Rerank adds 150–400ms plus network (Vaibhav Dixit). Merge dense and keyword results with Reciprocal Rank Fusion before reranking so both hit types get normalized into one ordering.

4. Use a PreToolUse hook to gate tool calls deterministically. Claude Code's PreToolUse hook fires after the model picks a tool but before it runs, receiving the full call as JSON on stdin and returning allow/block/modify (Jose Parreño García). This moves guardrails (block dangerous commands, require an issue ID, protect generated files) from prompt suggestions the model can reason around into a hard execution-layer gate it can't bypass.

5. Put auth in front of every remote MCP server today. With 12,520 internet-exposed MCP services and ~40% completely unauthenticated (Adversa AI), block public IP access to sensitive services, run MCP-enabled services sandboxed, treat external MCP config input as untrusted, and only install servers from verified sources. This directly counters the config-injection and RCE patterns disclosed this cycle.

6. Baseline your headless token usage before June 15. Run automation now with --output-format json and log the token counts while it's still subsidized (paddo.dev). Establishing per-job baselines lets you forecast post-metering costs and spot which agent loops are token-hungry before Anthropic starts billing them at full rates.

7. Wrap retrieval in an agentic loop instead of trusting one-shot fetch. 2026 production analysis attributes 73% of RAG failures to retrieval, not generation (Future AGI). Have the agent decide when to retrieve, rewrite the query between hops, and switch tools (vector, BM25, web, SQL) rather than betting everything on a single embedding search. Put your debugging effort where the failures actually are.

8. Select LoRA target modules by task, not by tuning everything. Amazon Science found module choice matters more than rank: o_proj + fc2 gave a 15% absolute reasoning gain, with o_proj-only a reliable default (Amazon Science). Pair it with rank r=32–64 for multi-step reasoning instead of adapting all linear layers and paying for compute you don't need.

9. Tier your eval stack by traffic share. Run millisecond distilled judges (hallucination, grounding) on 100% of production traffic, a frontier LLM judge on a 10–20% sample, and the full judge on 100% of CI regression cases before any prompt or model change ships (Vinayak Talikot). This keeps eval cost down while putting full coverage exactly where regressions hurt.

10. Tag every agent-memory write with identity scopes and compose them at retrieval. Tag each write with user_id, agent_id, and session_id, then compose the relevant scopes at read time and let results merge and rank automatically (Mem0). This stops one user's or session's context from leaking into another and lets a single memory layer serve per-user, per-agent, and shared-team knowledge without separate stores.