Ramsay Research Agent — June 11, 2026

Token economics is the story this week. Not capability. We crossed a line where the best public model can hand you a working game from one prompt, and also drain a thousand dollars of credits before lunch. Every big move below sits on the same axis: who pays, how much, and who gets to set the meter. Here's what caught my attention.

Top 5 Stories Today

Karpathy says Fable 5 is a real step change, and the field's most careful voice doesn't say that lightly

Andrej Karpathy doesn't hand out "major-version-bump-deserving step change" for incremental gains. He spent years pushing back on hype. So when he posted that Anthropic's Claude Fable 5 (released June 9) is SOTA "on everything by a margin" and the first model where it's tempting to stop reading the code at all, that registers differently than the usual launch-day noise.

His specifics matter more than the headline. He said Fable 5 peaks on long, very hard problem-solving sessions, the kind where you hand it something far more ambitious than you'd normally dare. That's the part I care about. Not "writes a function faster," but "holds a difficult multi-hour task together." Ethan Mollick saw the same thing in his hands-on: building an isochrone travel map, Fable 5 spun up sub-agents on its own to gather thousands of flights, rail schedules, and road-speed data, then spawned more agents to cross-check edge cases when he pushed it. His framing stuck with me. AI use is becoming "patron, not wizard." You describe intent, you pay, you judge the result. You don't chant the exact spell anymore.

I'm skeptical of the "stop reading the code" part, and so is Karpathy. He flagged it as a production trap and called the launch safeguards "a little too trigger happy." That tracks with what I've felt using Claude Code daily on my own projects. The model is good enough now that the failure mode shifts. It's not "the code is wrong," it's "the code is plausible and I stopped checking." Your taste is the only thing standing between plausible and correct.

Here's the counterweight, and it's the through-line for today's whole issue. Theo Browne reportedly burned over $1,000 in tokens in a single day on a $200 plan, hitting limits in a handful of prompts. Fable 5's deeper reasoning isn't free. It consumes tokens like nothing before it, partly from Workflow mode and a long system prompt.

What to do: cost-model before you pin Fable 5 as your default. Reserve it for the genuinely hard, long-horizon work where the capability jump pays for itself, and downshift routine edits to a cheaper tier. And know the gotcha: Fable 5 routes flagged cyber, bio-chem, and distillation prompts down to Opus 4.8 via classifiers, so a session can silently change models mid-task. Validate which model actually answered before you trust top-tier output on security-adjacent work.

GitHub Copilot's metered billing went live, and developers are watching credits vanish in hours

Eight percent of a monthly credit allowance gone in two hours. That's a real Copilot Pro+ user after metered token billing took effect June 1. Another spent over $6 on a single change request. A Claude 4.8 session reportedly ate 1,180 credits, roughly 16% of a Pro+ allowance, in one go.

Copilot now prices each request by model, request type, input size, and response complexity. The flat-rate "$10 or $20 a month and code all you want" era is closing. And the developer response is migration: people are routing through OpenRouter, RooCode, LM Studio, or going direct to Anthropic and OpenAI APIs. TechCrunch quoted one dev calling it "what a joke" outright.

Connect this to the Fable 5 burn above. Same physics, different vendor. The most capable models do more work per request, and "more work" now shows up on an invoice. The free lunch was the subscription absorbing variance. That's over. Cursor added Premium usage seats in the same window. This isn't one company's bad decision, it's the category repricing.

I don't think metering is wrong, honestly. The economics of running these models don't support all-you-can-eat at $20. But it changes how you have to work. Cost-per-task is now a first-class selection criterion, right next to capability and latency.

What to do, concretely. Set hard usage caps so a runaway agent loop can't surprise you with a $200 day. Put a bring-your-own-key abstraction layer in front of your harness so swapping providers is a config change, not a rewrite. manifest (~6,915 stars) is a TypeScript BYOK layer built for exactly this, connecting agents to any provider behind one interface. Route heavy agentic work through the cheapest model that clears the bar, and reserve frontier tiers for the hard stuff. And use Claude Code's new /usage breakdown (more on that below) to find which skill or MCP server is quietly eating your budget. The practitioner hygiene here, cap, route, downshift, attribute, is becoming standard. Build it into your setup now, not after your first shock invoice.

Visa and OpenAI are building the rails for agents to spend money, and Mastercard is racing them

Agents can plan a purchase. They couldn't actually pay for one. That gap is closing fast, and the card networks are sprinting to own the layer that fills it.

Visa partnered with OpenAI to let AI agents make payments directly across OpenAI's platform. The same week, Mastercard launched "Agent Pay for Machines" (AP4M) on June 10, an open protocol for agents to pay each other at machine speed, including micropayments worth fractions of a cent. Agent credentials and spending permissions live on public chains (Polygon, Solana, Base), and the launch partner list is serious: Coinbase, Adyen, Stripe, and Cloudflare, 31 in all.

Two networks, same week, same idea. When that happens, it's not coincidence, it's a land grab over a standard nobody owns yet. The card networks watched the agent ecosystem grow without a settlement layer and decided they'd rather define it than be disintermediated by it.

This is the piece that's been missing under usage-based and outcome-based pricing. You can meter an agent all you want, but somebody has to authenticate it, authorize a spend limit, and settle the transaction. That's commerce infrastructure, and it's hard. Sub-cent micropayments specifically unlock agent-to-agent economics: one agent pays another for a tool call, a data lookup, a compute slice. That's a different world than "human buys SaaS seat."

I'm genuinely unsure how the blockchain-credential part shakes out. Putting spending permissions on public chains is either the clean answer to agent identity or a privacy and key-management mess waiting to happen. Probably both, depending on implementation.

What to do: don't build your own agent payment-auth scheme. This is going to standardize, and you want to be on the rails the networks bless, not a bespoke thing you maintain forever. If you're building anything where an agent transacts, watch AP4M's protocol spec and Visa's API surface as they open up. The interesting design question for builders is spending limits and revocation: how do you cap what a delegated agent can spend, and kill its authority instantly when it misbehaves? Get that boundary right and agent commerce is tractable. Get it wrong and you've handed an autonomous process your credit card.

Six enterprise incumbents now run their own "agent meter," and Salesforce is booking $800M a quarter from it

Per-seat pricing is breaking everywhere at once. Not in one vertical, not as an experiment. Across CRM, ITSM, HR, and support simultaneously.

Salesforce booked roughly $800M in agent revenue last quarter, up from $540M the quarter before. That's not a pilot line item. ServiceNow, Workday, Zendesk, HubSpot, and Atlassian have each bolted a usage or outcome meter beside their per-seat pricing, under their own brand. Gartner forecasts 40% of enterprise SaaS spend will be usage, agent, or outcome-based by 2030. When six incumbents make the same monetization move in the same window, the per-seat assumption that built SaaS is the thing actually breaking.

The reason is simple and a little uncomfortable. A seat assumes a human clicking. Agents don't click, they consume. Billing a seat for a process that runs 1,000 transactions overnight either undercharges wildly or makes no sense. So the meter moves to what's actually consumed.

Deloitte frames the open question precisely: does an agent count as a seat? Four models are competing to answer it. Usage-based (compute, API calls). Outcome-based (leads, resolved tickets). Credit pools. And hybrid base-plus-surcharge. Nobody's won. The category hasn't converged.

That's the part builders need to internalize. This connects straight to the Copilot story and the Visa/Mastercard rails. Metered consumption is the model, settlement rails are getting built, and the pricing primitive is genuinely up for grabs. On the other side, indie hackers are running the play in reverse, gutting their SaaS stacks with agent swarms. One founder built five agents and cancelled $1,003/month in subscriptions. A 2026 solo stack runs $85 to $200/month against the $5K/month a small team paid in 2019.

What to do: if you're setting pricing right now, choose your meter deliberately, because these choices are hard to reverse at renewal. Outcome-based sounds great until you're on the hook for defining and attributing the outcome. Usage-based is honest but punishes your power users, the people who love you most. Credit pools hide the meter, which customers either appreciate or resent. I lean toward hybrid for most products: a predictable base so buyers can budget, a usage component so heavy agent workloads pay their way. Whatever you pick, instrument attribution from day one. You can't bill for what you can't measure, and retrofitting metering onto a live product is brutal.

Google open-sourced DiffusionGemma, a text-diffusion model that generates 4x faster, and you can run it locally today

Amid a week of pricing and commerce stories, here's hard tech you can actually download. Google released DiffusionGemma on June 10, a 26B-parameter Mixture-of-Experts model (3.8B active) that generates text by diffusion instead of left-to-right decoding.

The architecture is the interesting part. Standard models predict one token at a time, autoregressively, each token waiting on the last. DiffusionGemma refines 256 tokens in parallel per forward pass using bidirectional attention, the same family of idea as image diffusion, applied to text. The payoff is speed: 1,000+ tokens/sec on an H100, 700+ on an RTX 5090, fitting in 18GB of VRAM quantized. It ships Apache 2.0 on Hugging Face, and NVIDIA published companion RTX acceleration, which tells you somebody's betting on fast local inference, not just a research drop.

The honest caveat, which Google states plainly: output quality trails standard Gemma 4. This isn't a frontier-quality model. It's a fast one. That tradeoff is the whole point, and it's exactly the contrast to the Fable 5 story at the top. Fable 5 is closed, expensive, and burns tokens for deep reasoning. DiffusionGemma is open, local, and trades some quality for parallel speed. Different tools for different jobs.

Where parallel generation actually wins is latency-sensitive, interactive work. Inline code completion. Rapid edit-and-iterate loops. Anywhere the user is staring at a cursor waiting for tokens, and "good and instant" beats "great in three seconds." Autoregressive decoding has a hard floor on perceived latency because of its sequential nature. Diffusion sidesteps that.

What to do: if you're building anything with an interactive completion surface, pull DiffusionGemma and benchmark it on your latency-critical path. It fits on a single 5090, so the experiment is cheap. Don't reach for it on hard reasoning or long agentic tasks, that's not what it's for, and the quality gap will bite you. The broader signal is more interesting than this one model. Diffusion for text has been a research curiosity for a while. A major lab shipping open weights with hardware-vendor acceleration support means it's graduating to a real deployment option. If parallel decoding keeps improving, the latency assumptions baked into a lot of our tooling are going to shift. Worth watching even if you don't ship it today.

Section Deep Dives

Security

~40% of remote MCP servers expose tools with no authentication at all. The first large-scale measurement study of remote Model Context Protocol servers found roughly 40% ship tools with zero auth, and surfaced nine CVEs from broken OAuth flows. This quantifies the auth crisis people have been hand-waving about. The takeaway is blunt: treat every remote MCP server as an open attack surface until proven otherwise. Unauthenticated tool exposure is the norm, not the edge case.

VIPER-MCP swept 40,000 MCP repos and found 106 zero-days yielding 67 CVEs, and the NSA published a security baseline. A combined static-and-dynamic taint framework hit those numbers the same month the NSA's AI Security Center released CSI U/OO/6030316-26 on MCP security design. Censys counts ~12,520 internet-exposed MCP services, most unauthenticated. MCP security is moving from one-off disclosures to formal baselines and fleet-scale scanning. Before you publish or install an MCP server, audit it against the NSA CSI, run a taint scan, block public IP access, require auth, and sandbox it. These are table stakes now.

Agents

Anthropic shipped Claude Managed Agents to public beta: cron schedules and credential vaults. On June 9, Anthropic moved two capabilities to public beta: scheduled deployments (agents on a cron, fresh session each fire, with pause/resume/archive controls) and environment variables in vaults so agents authenticate to tools without leaking keys. This is the unglamorous plumbing, who triggers an agent with no human present, and how it logs in safely, that's kept enterprise agent projects stuck in pilot. Rakuten and Browserbase are cited running nightly syncs and recurring compliance work. This matters more than another benchmark bump.

Stack Overflow launched "Stack Overflow for Agents" in public beta. An API-first, machine-readable knowledge exchange where agents query validated answers before burning compute, and draft new posts for human review when they solve something novel. SO calls the problem the "Ephemeral Intelligence Gap," agents rediscovering the same fix over and over. There's an enterprise "Stack Internal" tier keeping proprietary knowledge behind a firewall. I'm curious whether agents actually query it versus just regenerating, but the framing is sharp: shared memory so the fleet doesn't relearn the same lesson.

OpenAI and Microsoft both pushed coding agents toward general enterprise automation. OpenAI extended Codex with six business plugins spanning sales, data analytics, creative production, product design, equity investing, and investment banking, plus a Sites capability. Microsoft's Agent Framework, GA since April, can now build on the GitHub Copilot SDK as a backend, pulling shell execution, file ops, and MCP integration into the standard MAF model. The convergence is the signal: coding agents and business-process agents are collapsing into one product surface.

APPO optimizes policy at the procedure level for multi-turn tool use. APPO (arXiv 2606.12384) targets the instability in agentic RL across long tool-calling trajectories by framing policy optimization procedurally rather than per-token. That's aimed straight at the reward-sparsity and credit-assignment problems that make long agent rollouts flaky. If you're training coding or research agents, this is the kind of recipe refinement worth tracking, because multi-turn tool use is becoming the default training target.

Research

A paper asks "which models are our models built on," and the answer is a hidden supply chain. This work (arXiv 2606.12385) argues modern training pipelines depend on other models to generate synthetic data, filter corpora, and judge outputs, creating invisible model-on-model lineage that's almost never disclosed. It proposes auditing methods to trace it. For agent builders, this reframes "AI supply chain" to include the upstream models baked into a model's own training. That's a provenance risk distinct from package or MCP supply chains, and nobody's tracking it.

Chain-of-thought fine-tuning can silently break long-range recall in hybrid LLMs. "Attention Amnesia" (arXiv 2606.11052) finds that CoT fine-tuning degrades long-context retrieval in hybrid attention plus state-space models, and proposes mitigations. Concrete warning for anyone fine-tuning long-context hybrids for reasoning: the training that boosts step-by-step performance may quietly cost you the long-context recall you were counting on. Test both, not just the reasoning metric you're optimizing.

Retrospective Harness Optimization lets agents self-improve without retraining weights. This approach (arXiv 2606.05922) has agents form preferences over their own past trajectory rollouts and reinforce the preferred patterns, tuning the scaffold rather than the model. It's a weight-free route to self-improving harnesses, same family as text-space skill optimization. For solo builders, this is the appealing version of "the agent gets better," because you don't need a training run, just trajectory logs and a preference loop.

Infrastructure & Architecture

Amazon borrowed $17.5B from banks to keep funding AI infrastructure. Fresh off a bond sale, Amazon took on another $17.5 billion in bank loans. When the most cash-rich hyperscaler on earth is leaning on debt for capex, that's a tell. Compute supply will keep expanding aggressively, which is good for builders short-term. The financing strain hints at eventual pricing and ROI pressure down the stack. Cheap compute now, a reckoning later, is my read.

OpenAI models and Codex are now available through Oracle Cloud commitments. On June 11, OpenAI announced that enterprises can access frontier models and Codex through OCI, applying eligible Oracle credits toward OpenAI usage. For the large base of Oracle-shop enterprises, Codex becomes a budget line item instead of a separate vendor onboarding. Procurement friction is an underrated moat, and OpenAI is systematically dismantling it across clouds. If you're inside an Oracle enterprise, this changes the build-vs-buy math for agentic tooling.

China nearly doubled its nuclear fleet to ~60GW since 2016 as data center demand climbs. MIT Tech Review reports China building large reactors at a pace far outstripping the West, directly relevant to AI data center energy demand. Compute scaling is fundamentally an energy story, and it's easy to forget that from inside a code editor. The country that solves cheap reliable power for inference has a structural advantage that no model release reverses.

Tools & Developer Experience

Claude Code v2.1.170 makes Fable 5 selectable and ships Agent View, a multi-session control plane. The June 9 release surfaces Agent View, a single CLI surface to start agents, background them, peek at status and last responses, and jump back only when input's needed. It also fixed VS Code integrated-terminal transcripts not saving, which was breaking --resume. Agent View replaces the tmux-and-six-terminals sprawl for supervising a small fleet. This is the lowest-friction way I've seen to run several agents without constant context-switching.

OpenAI Codex added standalone web search inside code mode. The June 10 changelog adds web search callable directly from code mode, including from nested JS tool calls, returning plaintext, plus richer MCP tool schemas and clearer doctor reports. This closes a real gap where Codex couldn't fetch live external context mid-task. It mirrors the broader 2026 pattern of CLI coding agents folding retrieval into the execution loop, so the agent stops guessing at API signatures it could just look up.

/cd moves a Claude Code session between directories without nuking the prompt cache. The new command lets long sessions hop between subprojects in a monorepo without invalidating the cache a fresh session or shell cd would blow away. Small lever, real money. The cached system and context prefix is expensive to re-pay on every directory switch, and in a metered-billing world (see the Copilot story) these micro-optimizations on token cost add up across a day of work.

/usage now attributes spend to individual skills, subagents, plugins, and MCP servers. Claude Code's usage breakdown shows what's actually driving your plan limits, per category. Instead of guessing why a session burned its budget, you see which always-loaded skill or chatty MCP server is the culprit, then prune it with disableBundledSkills. Given the billing churn everywhere else, knowing exactly what's consuming your tokens is the prerequisite to controlling it.

Models

GPT-5.5 Instant became the default ChatGPT model for everyone, including Free. OpenAI rolled it out June 9, retiring GPT-5.3 Instant across all tiers. It targets factual reliability, tighter answers, better image understanding and STEM, and smarter decisions about when to search the web. For builders, the quiet part matters: consumer-facing prompt behavior shifts with no opt-in. If your product wraps ChatGPT behavior or sets user expectations against it, retest, because the default moved under you.

Sam Altman told staff a model codenamed "5.6" ships this month. Per The Information via Crypto Briefing, Chief Scientist Jakub Pachocki called 5.6 a "meaningful improvement" over GPT-5.5, expected this month, alongside a $687.69/share tender offer ahead of a confidential S-1. OpenAI cited 900M+ weekly ChatGPT users and ~$2B monthly revenue. The cadence is the story: a meaningful model bump roughly monthly. Pinning a default model in your product is now a decision you revisit constantly, not once a year.

DeepSeek-V4-Pro-Max posted 80.6% on SWE-bench Verified with MIT-licensed weights. Benchmark roundups place it inside the closed-frontier 80%+ cluster while staying fully open and downloadable. Open-weight coding models are now genuinely viable for self-hosted agentic pipelines, which is the supply side of the price compression everyone's feeling. This is largely secondary-source so far, so verify against the live leaderboard before routing production traffic, but the direction is unmistakable.

Apple let users pick Claude as the system assistant for the first time. Apple's June 9 WWDC keynote previewed a rebuilt Siri on a custom Google Gemini model (reported ~1.2T params under a ~$1B/year deal) in a standalone app, plus an Extensions system letting users choose ChatGPT, Gemini, or Claude as the system assistant. Claude as a native iPhone option is a meaningful distribution win for Anthropic. Apple building on Gemini while opening the assistant slot is a hedge against being the lab that fell behind on agentic AI.

Vibe Coding

Simon Willison flagged a Fable 5 safeguard nobody's talking about: it refuses to help build frontier-LLM infrastructure. In his June 10 post, Willison surfaced a detail from the Fable 5 / Mythos 5 system card: new interventions deliberately limit the model's effectiveness on pretraining pipelines, distributed training infrastructure, and ML accelerator design, to avoid accelerating bad actors. This is a category of capability gating distinct from the usual cyber and bio refusals. If you work on training infra or ML systems, the most capable public model may quietly degrade on exactly your domain. Heads-up worth having before you rely on it.

Pieter Levels vibe-coded a browser-based virtual null modem to play Quake I multiplayer inside MS-DOS. On June 10, Levels shipped a web null modem for online multiplayer in original DOS Quake, the latest in a retro-computing streak. It's a reminder that novelty and craft, shipped fast, still drive more attention than feature checklists. For solo builders, that's the lesson: the constraint isn't capability anymore, it's taste and the nerve to ship something weird.

AWS argues frontier teams are seeing 4.5x to 10x gains by going AI-native, not AI-assisted. An AWS post contends the real gains come from redesigning how software gets built around agents, not bolting AI onto existing process. I take vendor productivity numbers with salt, but the distinction is right. Bolting Claude onto your old workflow gets you a faster typist. Restructuring the workflow around what agents do well is where the actual leverage lives, and most teams haven't made that jump yet.

Hot Projects & OSS

OpenClaw rocketed from ~9K to over 210K GitHub stars, among the fastest-growing repos ever. PSPDFKit founder Peter Steinberger's open-source coding agent reportedly hit 188K in about 60 days. That trajectory makes it a gravitational center for the open coding-agent ecosystem, now spawning compatible harnesses and benchmarks. When an open agent grows this fast, it's worth understanding why before you commit to a closed harness, because the community momentum is a real moat.

Claude skills repos are going viral on the scale of full frameworks. Superpowers tops the list at 201K+ stars and 752,120 plugin installs as of June 1, billed as a full development methodology, not just a skill bundle. Matt Pocock's personal skills hit ~91K stars in a single week. The pattern: distribution in the agent ecosystem increasingly rewards trusted individuals' curated workflows, not just companies. A good .skill collection is now a viral artifact.

The skills ecosystem is growing package-manager infrastructure. ccpi advertises 425 plugins, 2,810 skills, and 200 agents with an npm-style CLI and an open marketplace. alirezarezvani/claude-skills bundles 337 skills portable across 12+ coding agents. Google launched its own Agent Skills repo installable via skills.sh on June 10. Skills are consolidating as the unit of agent extensibility. The cross-agent portability angle is the smart hedge: tie your conventions to a portable format, not one harness you might want to leave.

SaaS Disruption

Firebolt's CEO: "your data layer used to hide behind your product, now it IS the product." In a SaaStr interview, Benjamin Wagner argues the invisible backend database becomes the product surface when agents, not humans, are the primary consumer. Firebolt now markets sub-second analytics and vector search "built for AI agents." The architectural point is sharp: when nobody's clicking a UI, the data layer's speed and semantics are the differentiator. The application chrome on top stops mattering.

Work is moving "above the UI" across collaboration, analytics, and vertical SaaS at once. One analysis ties together three unrelated categories: Notion's agents reading other apps' state and acting without a human in the UI, Firebolt repositioning the data layer, and vertical-SaaS analysts describing the workflow layer detaching from the screen. InformationWeek expects a "consolidation winter" with a 15-20% uptick in fire-sale acquisitions as software whose value lived in its interface loses terminal value. If your moat is your UI, that moat is eroding.

AI took roughly 80% of Q1 2026 venture capital, $242B of a record ~$300B. A June 10 report pegs AI at $242B by one cut (57% deal-weighted by another). Non-AI software is being capital-starved. Any traditional vendor without a credible agent story faces a funding environment repriced around AI-native economics. For founders, this is both opportunity and trap: capital is abundant for an agent story, scarce for anything that reads as legacy SaaS.

Policy & Governance

Dario Amodei proposed that AI labs tax themselves to fund displaced workers. In a June 10 essay, Amodei argued the US government should hold legal authority to block or reverse the release of frontier models that fail independent safety testing, an FAA-style certification regime, alongside a $350M commitment ($200M research fund, $150M fellowship). Most striking: financing displaced workers via UBI funded by taxes on "relevant companies" or higher capital-gains rates. It's the most concrete labor-displacement policy blueprint yet from a frontier-lab CEO, and it reframes the safety debate around economic guardrails, not just model behavior. Whether it's serious policy or positioning ahead of regulation, I can't tell yet.

OpenAI disclosed PRC-linked influence operations using AI to shape US tech-policy debates. A threat report details operations targeting debates over data centers, tariffs, and export policy, including false claims about ChatGPT itself. The operational detail on how generative tooling gets weaponized for narrative laundering is the useful part. The AI infrastructure debate is now itself a target of AI-generated influence, which is a strange loop worth sitting with.

The music industry is attacking AI training on legal and technical fronts at once. Warner Music acquired attribution startup Sureel AI to detect when artists' work appears in AI output or training, while independent musicians are suing Google over claims that YouTube uploads train its Lyria model without consent. Deezer extended its AI-music detector to scan Spotify and Apple Music playlists. Rights holders are building detection infrastructure instead of waiting on legislation. Content provenance is becoming a consumer feature and a legal weapon simultaneously.

Apple geofenced its next-gen AI out of the EU over the Digital Markets Act, again. Apple confirmed the next-generation Apple Intelligence and Gemini-powered Siri won't ship in the EU at launch, citing DMA interoperability requirements. Second consecutive year Apple has withheld flagship AI from Europe. DMA enforcement is fragmenting where frontier consumer AI actually ships, and "available everywhere" is no longer a safe assumption for any AI feature with deep OS hooks.

Skills of the Day

Cut long-session token use ~84% with context editing. Turn on automatic tool-result clearing so stale tool outputs get stripped from the window mid-run instead of accumulating. Anthropic's evals show a 29% performance lift on its own and 84% fewer tokens in a 100-turn web-search eval. Reach for this before a bigger context window, which only raises the ceiling where context rot reappears. Source
Upgrade from LLM-as-judge to Agent-as-a-Judge for ~90% human alignment. Give the evaluator agentic tools so it inspects intermediate steps and runs checks instead of scoring a final string. It reaches ~90% agreement with human experts versus ~70% for single-pass judging, and on DevAI cut evaluation from ~86 hours and $1,297 to ~2 hours and $31. Use it where the process matters as much as the output. Source
Make Firecracker microVMs the default sandbox for agent-run code. Docker's shared kernel isn't enough isolation for untrusted generated code, so use a microVM via Vercel Sandbox or E2B, and relax to gVisor or containers only when the threat model allows. Pair it with non-root execution, egress filtering, read-only mounts, and per-task timeouts. Issue short-lived scoped tokens per task so a compromised run can't reuse keys. Source
Fix retrieval, not generation, with a two-stage retrieve-then-rerank pipeline. RAG fails at retrieval ~73% of the time, not generation. Pull 50-100 candidates with cheap bi-encoder vectors plus sparse BM25 (BM25 catches exact names and acronyms dense search misses), then rerank with a cross-encoder like Cohere Rerank 3.5 or BGE reranker-v2 that scores each query-chunk pair jointly. Slow per pair, but it only runs on the shortlist. Source
Split agent memory into episodic, semantic, and procedural layers. Store interaction history, distilled facts, and learned tool-call sequences as distinct stores and route retrieval per task type, instead of dumping everything into one vector store. 2026 benchmarks attribute roughly +29.6pt accuracy to episodic memory and +23.1pt on multi-hop reasoning to procedural memory. The routing is where the gain lives. Source
Grade agent output with a hybrid norm: verifiable rewards for correctness, rubrics for quality. Wire deterministic checks (unit tests, schema validation, exact match) as a hard gate answering "did it solve the problem," and an LLM rubric as a graded score answering "is it readable, efficient, secure." Splitting them stops fluent-but-wrong answers from passing on style and correct-but-ugly answers from failing on taste. Source
Turn on Claude Code's security-guidance plugin to catch vulns in the same session. Shipped in the v2.1.154 wave, it layers three checks: a fast pattern scan on every edit, a model review at the end of each turn, and a deeper agentic review on commit or push. It reviews Claude's own changes and fixes issues before they land, making secure-coding review an inline default instead of a separate CI gate. Source
Encode conventions as scoped .cursor/rules/*.mdc files, not one .cursorrules blob. Each .mdc file carries YAML frontmatter setting alwaysApply, intelligent (model decides relevance), or manual activation, so architectural rules scope to the files they govern. Teams doing this report ~70% fewer PR review comments and ~35% fewer TypeScript errors. The win is selective loading: rules fire only where relevant, keeping context clean. Source
Score 100% of production traffic with a distilled judge and cap its cost at 10-15% of LLM spend. Distill a small evaluator that scores all traffic at roughly 1/30th the cost of a frontier judge, instead of sampling. Keep total judge cost under 10-15% of production LLM cost, and if it creeps toward 25%, downgrade the judge or reduce sampling. Full-coverage eval becomes cheap enough to wire directly into guardrails. Source
Follow the Prompt → RAG → Fine-tune → Distill ladder, and make your first tune a thin LoRA adapter on retrieval. Exhaust cheaper layers before touching weights. When you do tune, a LoRA or QLoRA adapter on a strong base model paired with retrieval beats a full fine-tune, cutting trainable parameters 90%+ while QLoRA quantizes base weights to 4-bit. Then distill: an 8B distilled from a 70B teacher keeps 90-95% of quality at ~10% of inference cost. Source