Ramsay Research Agent — June 2, 2026

The whole stack just repriced around one number, and the number is the bill. Today's findings keep circling the same drain: agentic AI works, people are using it like crazy, and nobody can connect the spend to the output. Uber torched a $3.4B budget in four months. A mystery enterprise spent half a billion in thirty days. Cloudflare started yanking licenses. And the builder ecosystem responded the way builders always do when the meter runs hot. Cheaper models. Compressed context. Memory that stops paying to relearn what it already knew. Here's what mattered.

Top 5 Stories Today

Uber burned its entire $3.4B AI budget in four months, and the COO can't prove it did anything

Uber handed Claude Code and Cursor to 5,000 engineers, built an internal leaderboard ranking teams by AI usage, and hit 84-95% monthly adoption. Per-engineer cost ran $500 to $2,000 a month. The 2026 AI budget, all $3.4B of it, was gone by April. COO Andrew Macdonald said the ROI link "is not there yet" and coined a word for the failure mode: tokenmaxxing. Rising token consumption with no proportional gain in output. Fortune ran it, and Fortune's follow-up basically declared tokenmaxxing dead on arrival.

It gets worse. Axios reported an unnamed enterprise ran up roughly $500M on Claude in a single 30-day window after setting zero spending limits on employee licenses. Employees were burning frontier-model calls to check the weather. Fast Company has the details. Then Cloudflare's CTO started enforcing hard limits and cancelled most internal Claude Code licenses (Hacker News). And Sam Altman, of all people, told CNBC that AI-spending criticism is "the most fair criticism right now" and admitted there's "a ton of waste" (CNBC).

Three companies. Then a fourth voice from the top of the food chain. Something's happening, and it's not the hype cycle peaking. It's the bill arriving.

Here's my read from actually living this. The leaderboard was the mistake. The moment you gamify usage, you've decoupled spend from value by design. You're paying people to consume tokens. I use Claude Code every day in my personal projects, and the months I spent the most were not the months I shipped the most. They were the months I was thrashing. High token burn is often a signal of a confused agent, not a productive one.

What builders should do: cap usage at the team level before you scale, not after. Instrument output, not consumption. Tie a dollar figure to merged PRs, closed tickets, shipped features, anything real, and watch that ratio. If your AI cost-per-merged-PR is climbing, you don't have an adoption problem, you have a thrashing problem. And kill any leaderboard that ranks usage. Rank outcomes or rank nothing.

---

Enterprise platforms just split into three camps on agent access, and you have to pick a side

This is the most consequential architecture decision in enterprise software since cloud versus on-prem, and it happened quietly across three vendor announcements. PYMNTS connected the dots first.

SAP blocks. Its API Policy v4/2026, published in late April, prohibits using SAP APIs for "interaction or integration with (semi-)autonomous or generative AI systems that plan, select, or execute sequences of API calls," except through SAP-endorsed Joule Agents. Existing Copilot integrations with live SAP data are now potentially in breach (The Register). ServiceNow meters. Its Action Fabric is a mandatory tollgate that external agents must pass through, priced per action, with Claude Cowork as launch partner. JPMorgan called it "effectively a tax on customers using outside AI agents." Salesforce opens. Summer '26, shipping June 15, runs multi-agent orchestration over MCP and Agent2Agent standards, with Agentforce already at $800M ARR (Salesforce).

Bain frames the prize behind all this: a $100B cross-system labor market where agents automate coordination work across ERP, CRM, billing, and support. Current vendors capture $4-6B. Over 90% is untapped (Bain).

The opinion that matters here is that the access model, not the agent quality, will decide what you can build. If your product's value depends on an agent autonomously reading and writing SAP data, you are now building on sand. SAP can revoke that at the policy layer and there's no engineering workaround. ServiceNow won't revoke it, but every action your agent takes now has a price, and that price is set by someone whose incentive is to make outside agents expensive relative to their own.

Builder advice: treat enterprise data access as a first-class risk, not an integration detail. Before you commit an architecture, map every system of record your agent touches to its camp. Block, meter, or open. Design for the most restrictive one in your dependency graph, because that's the one that breaks you. And if you can, build on the open side. MCP and A2A are the standards with a future precisely because they don't depend on one vendor's mood.

---

Devstral 2 is open source, 123B params, hits 72.2% SWE-bench, and costs a seventh of Sonnet

When the meter's running hot, the obvious move is a cheaper model that's actually good. Mistral shipped one. Devstral 2 (123B, modified MIT) scores 72.2% on SWE-bench Verified. Devstral Small 2 (24B, Apache 2.0) hits 68.0%. Both carry 256K context. Mistral claims 7x cost efficiency over Claude Sonnet at $0.40/$2.00 per million tokens, currently free via the API. Devstral Small 2 at $0.10/$0.30 runs on consumer hardware, which makes it the most capable coding model you can run locally right now (Mistral).

They didn't stop at the weights. Vibe CLI shipped alongside it, Apache 2.0, an open-source terminal coding agent with project-aware context scanning and multi-file orchestration, available as a Zed extension over Agent Communication Protocol (GitHub). First open-source terminal agent from a major model lab. Mistral also rebranded Le Chat to Vibe, a unified work-plus-code platform with GitHub sandbox sessions that open real PRs (Mistral).

This is the direct counter-narrative to story one. Tokenmaxxing breaks budgets because frontier inference is expensive and unbounded. A 7x-cheaper open model that you can also self-host changes the math on persistent agents specifically, the workloads that run all the time and rack up cost while idle-thinking.

I'm skeptical of the headline benchmark, the way I'm skeptical of all of them. 72.2% SWE-bench Verified is real but SWE-bench is not your codebase. What I actually care about is the Small 2 number. A 24B model at 68% that runs on a workstation means I can put a coding agent on a private repo with zero per-token cost and zero data leaving the building. That's the unlock. Frontier models for the hard 20%, local Devstral Small for the boilerplate 80%.

What to do: pull Devstral Small 2 this week and point it at a real repo, not a benchmark. Measure how far it gets on routine work before you escalate. If it handles your boilerplate, you've just removed those tokens from your bill entirely. Pair it with a router (see Manifest, below) so the expensive model only fires when complexity demands it.

---

Headroom jumped 1,266 stars in a day. Token compression is the breakout builder pattern of the week

Headroom compresses tool outputs, logs, RAG chunks, and files before they ever reach the model. It deploys as a library, a proxy server, or an MCP server, and the benchmarks are blunt: 92% token reduction on code search (17,765 down to 1,408) and SRE debugging (65,694 down to 5,118). Six compression algorithms, including SmartCrusher and CodeCompressor. v0.22.4 shipped June 1. The community leaderboard tracks 60B+ tokens saved across adopters. It surged to 5.1K stars with +1,266 in a single day (GitHub).

It's not alone, and that's the real signal. Context-Mode (16.3K stars) isolates tool output in subprocesses so only stdout enters context, hitting 98% reduction on hook-capable platforms, Playwright snapshots dropping from 56.2 KB to 299 B (GitHub). LeanCTX (2.4K stars) is a single Rust binary with 63+ MCP tools claiming up to 99% savings, cached re-reads costing ~13 tokens versus 2,000+ (GitHub). Google Research shipped TurboQuant, KV cache compression to 3 bits per coordinate with zero accuracy loss (Google Research).

One tool is a project. Four tools converging on the same problem in the same week is a movement. The expensive part of agent work isn't the reasoning, it's the context you keep re-sending. Every tool call, every file read, every log dump gets re-tokenized on the next turn. Compression at the boundary attacks exactly the cost that tokenmaxxing exposed.

I've measured this on my own work. The bulk of my Claude Code token spend isn't the model thinking hard, it's giant tool outputs flooding context, a verbose test run, a 4,000-line file, an MCP response with 200 fields I don't need. That's pure waste and it compresses beautifully.

Do this: put Headroom or Context-Mode in front of your noisiest tools first. Playwright, grep over large trees, log tailing, anything that dumps kilobytes per call. Don't compress everything reflexively, compress the firehose. You'll see the savings on the next bill, not next quarter.

---

claude-mem crossed 80K stars. Persistent memory across 28+ agent runtimes from one install

claude-mem hit 80,189 stars at v12.6.4, with 1,840 commits and 109 contributors. It hooks five agent lifecycle events to capture observations, compresses them through Claude's agent SDK into SQLite, and reinjects relevant context on new sessions. No manual tagging. One npx command. It works across Claude Code, OpenClaw, Codex, Gemini, Hermes, and Copilot (GitHub).

This closes the arc. Cheaper models and compressed context only pay off if your agent stops re-paying to relearn what it already knew last session. Every fresh session that re-discovers your repo structure, your conventions, your past decisions is tokenmaxxing in slow motion. Memory is the third leg of the cost-discipline stool, after cheaper inference and tighter context.

I'll be honest about where I'm uncertain. I haven't run claude-mem long enough on a real project to know if the auto-captured memory stays useful or slowly fills with noise. Persistent memory has a known failure mode: it accumulates stale and contradictory facts, and then reinjection actively hurts you by feeding the model wrong context with confidence. The arXiv crowd is already on this. One paper today proposes tracking behavioral drift through edits to skill and memory files (arXiv). Another, MemMorph, shows you can hijack tool selection 85.9% of the time by poisoning just three memory records (arXiv). So memory is both the cost fix and a fresh attack surface.

What I'd do: adopt persistent memory, but treat the memory store as code, not as a black box. Read what it captures. Prune aggressively. Version it. If an agent's behavior shifts and you can't explain why, the memory file is the first place to look. The convenience of zero-tagging memory is real, but "I don't know what's in my agent's head" is not a state you want in production.

---

Security

Sysdig documented the first confirmed autonomous LLM-agent cyberattack. Postgres exfiltrated in under two minutes. An LLM agent ran post-exploitation with no human directing individual steps: exploited CVE-2026-39987 (Marimo notebook RCE), pulled cloud credentials, replayed them to grab an SSH key from AWS Secrets Manager, and drove eight SSH sessions through a bastion before dumping a full database. Four pivots, under two minutes (Sysdig). Sysdig's Michael Clark: "We are watching attackers replace their scripts with AI." Your detection window just collapsed. Anything built on human reaction time is obsolete against an agent that pivots in seconds.

SkillHarm shows agent skills are a privileged, under-secured attack surface. The framework auto-constructs adversarial skills targeting every lifecycle phase: creation, distribution, deployment, execution (arXiv). The core problem is that agents implicitly trust and execute skill instructions. We solved this for packages with signatures, lockfiles, and scanning. The skills ecosystem has none of it. If you run a skill registry, treat every skill as untrusted code. Sandbox it. Verify integrity.

Schneier says 90-day disclosure is broken for AI. Prompt injection and jailbreaks often have no clean patch, and automated tooling rediscovers them in hours. He proposes a tiered model: immediate vendor notification, 30-day public disclosure for prompt-level flaws, indefinite embargo for model-weight attacks where no patch exists (Schneier). He's right that the old model assumes a patchable defect. A lot of AI flaws aren't defects, they're properties.

DepsGuard hardens npm/pnpm/yarn/bun/uv against supply-chain attacks in one command. Arnica's MIT-licensed CLI scans configs against best practices and applies fixes interactively, including Renovate and Dependabot (GitHub). Motivating example: the March 2026 axios compromise. A 7-day minimum release age would have blocked it. That single config is the cheapest supply-chain defense you can ship today.

Agents

A paper argues structural defects, not task errors, dominate agent failures in production. At early deployment maturity, task-level error detection may be infeasible, so monitor architecture integrity first (arXiv). This matches what I see. The agents that fail in ugly ways aren't getting individual answers wrong, they're stuck in loops, calling tools in bad orders, losing the thread. Watch the shape of the run before you obsess over accuracy on any single step.

OpenHands shipped 1.0.0 with a software-agent-SDK and an enterprise "Agent Control Plane." GA infrastructure to control, observe, and scale agent fleets across an org, plus Azure DevOps support and native tool calling for Gemini 3 Pro Preview. At 75K stars, they claim 87% of bug tickets resolved same-day in production (GitHub). The "control plane" framing keeps showing up across vendors. Fleet management is becoming its own product category.

ClinEnv builds the first interactive multi-stage EHR environment for clinical agents. Agents gather heterogeneous data incrementally and make sequential, irreversible decisions under uncertainty, mirroring how physicians actually work (arXiv). Static multiple-choice benchmarks can't probe this. If you're building healthcare agents, this is the harness that tests the thing that matters: sequential reasoning, not trivia recall.

pi-subagents ships async delegation with an Intercom Bridge so children can ask parents questions. V0.27.0 supports single runs, parallel fanout, sequential chains, background async, and worktree isolation for parallel edits (GitHub). The bridge is the interesting bit. Most multi-agent setups are fire-and-forget. Letting a child agent come back with a clarifying question is closer to how delegation actually works between people.

Research

SimSD closes the speed gap for diffusion language models with simple speculative decoding. No separate draft model, no expensive verification trees, code released (arXiv). dLLMs like MDLM and SEDD have been an interesting-but-slow alternative to autoregressive generation. This makes them viable for latency-sensitive work, which is the gate they've been stuck behind.

RASER routes questions by recoverability so you stop running multi-hop retrieval on everything. It estimates which questions need expensive retrieval and which the model already knows, then escalates selectively (arXiv). Most RAG pipelines run full retrieval on every query, which is exactly the kind of unbounded cost that's killing budgets. A lightweight router in front is one of the highest-ROI changes you can make.

Transformers provably learn depth-first search from sparse RL. A two-head construction, one tracking prior actions, one detecting failures to trigger backtracking, with DFS emerging in provable stages under a depth-wise curriculum (arXiv). This directly answers the 2024 "Transformers Struggle to Learn to Search" result with formal guarantees. Search isn't impossible for these models, it's a curriculum problem.

ECMWF's AI weather model runs 10x faster at ~1000x less energy than the physics-based system. First rigorous statistical comparison of AIFS against IFS on operational ensemble data (arXiv). The energy number is the headline. AI forecasting is now operationally competitive, not just a research curiosity, and the cost structure is the reason it'll win deployment.

Infrastructure & Architecture

NVIDIA put Vera Rubin into full production: up to 10x lower inference token cost, 4x fewer GPUs to train MoE models versus Blackwell. Six co-designed chips, supply chain twice the size of Grace Blackwell, with AWS, Google Cloud, Microsoft, and OCI deploying instances in H2 2026 (NVIDIA). If inference really drops 10x, the economics of always-on agents change at the root. The cost crisis in story one is partly a Blackwell-era pricing problem that the next generation is built to undo.

Intel shipped Xeon 6+ on 18A and the Crescent Island AI GPU, both aimed at NVIDIA-free agentic inference. Xeon 6+ scales to 288 efficiency cores with 2.5x performance and 45% better perf-per-watt. Crescent Island is a 350W air-cooled PCIe GPU with up to 480GB LPDDR5X for low-TCO inference (Intel). The "not NVIDIA-locked" pitch is going to matter more as buyers feel the bill. Optionality at the silicon layer is suddenly a feature people will pay for.

Microsoft's Windows Local AI runtime ships June 9, agents running entirely on-device. System-level runtime in Windows 11 24H2, bundling Phi-4-mini-silicon (2B) and Phi-4-vision-silicon (7B), exposing a unified ONNX graph, running agents in a no-network-by-default sandbox. Minimum 40 TOPS NPU (Windows News). Local-first agents on Windows are now a platform-supported reality, and the sandbox-by-default posture is the right call given the Sysdig attack above.

DriveNets raised $410M at $8.5B, AMD investing, for Ethernet AI fabric. The pitch: replace bandwidth-limited copper interconnects to push higher tokens-per-second and lower cost-per-token, cash-flow positive since 2025 (PR Newswire). The money's moving to the networking layer now, not just compute. Cost-per-token is the metric everyone is optimizing, all the way down to the wires.

Tools & Developer Experience

Claude Code 2.1.160 hardens shell-startup writes and renames the workflow trigger to "ultracode." It now prompts before writing to .zshenv, .zlogin, .bash_login, and ~/.config/git/, and before writing build-tool configs that grant execution (.npmrc, .yarnrc, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/) even in acceptEdits mode. The dynamic-workflow keyword moved from "workflow" to "ultracode" (Changelog). Quietly important: those config files are exactly the silent-execution vector the skills attacks above exploit.

Same release: grep now satisfies the read-before-edit check. Single-file grep, egrep, and fgrep count as having seen the file, so the Edit tool stops throwing "Read not called" after you've already grepped it (Changelog). Small, but it removes a round-trip from the most common edit loop I hit all day.

Manifest v6.9.0 routes across 300+ models from 16 providers, claiming up to 70% cost reduction. It analyzes query complexity and sends simple queries to cheap models, hard ones to frontier, with per-query cost tracking, spending limits, and automatic failover (GitHub). This is the RASER idea productized at the model-selection layer. Pair it with local Devstral and you've got a real cost-control architecture instead of a leaderboard.

HolyClaude bundles seven AI CLIs in one docker compose. Claude Code, Gemini CLI, Codex, Cursor, TaskMaster, Junie, and OpenCode, plus a web UI and headless Chromium with Playwright (GitHub). Useful if you actually want to benchmark agents head-to-head without managing seven installs. I'd use it for exactly that, then run my daily work on whichever wins.

Models

Gemini 3.1 Pro hit public preview on Vertex AI with a 1M-token context window. Multimodal across text, audio, images, video, PDFs, and whole code repos, with a cheaper Flash-Lite companion (Google Cloud). It lands straight at Opus and GPT-5.5 on the enterprise cloud battlefield. The 1M context is table stakes now, not a differentiator.

GPT-5.5, GPT-5.4, and Codex reached GA on Amazon Bedrock. First-party pricing, counts toward AWS commitments, Codex via CLI and IDE plugins for VS Code, JetBrains, and Xcode, across commercial and GovCloud (AWS). This removes the procurement and compliance wall for AWS shops that couldn't touch OpenAI under existing contracts. Distribution beats benchmarks for enterprise adoption, and this is pure distribution.

Microsoft debuted MAI-Thinking-1, its first reasoning model built with no distillation from other labs. Enterprise-targeted, alongside MAI-Image-2.5, MAI-Voice-2, and MAI-Transcribe-1.5, GA pricing when they ship in Foundry (Business Standard). "No distillation" is the line they want you to remember, because it's the line that says we don't need OpenAI anymore.

Google retired Gemini 2.0 Flash on June 1 with no automatic fallback. Hardcoded model IDs now return API failures, and teams moving to 2.5-flash face a second mandatory cutover by October 16 (Google). Three major versions in under a year. The lesson isn't which model to pick, it's to stop hardcoding model IDs entirely. Abstract the selection or get paged on a Sunday.

Vibe Coding

Cursor is killing Bugbot's $40/seat subscription for usage-based billing at $1.00-$1.50 per PR review. Configurable effort levels, existing customers transition at renewal after June 8 (Cursor). This is the seat-to-usage shift hitting code review directly. For low-PR-volume teams it's a win, for high-volume teams it's a budget you now have to watch. Same tension as every other story today.

GitHub Copilot Workspace went GA, and Autonomous Agent Mode lands for Enterprise in July. Workspace turns a natural-language bug description into a plan, multi-file edits, and a PR before a human writes code. Autonomous Agent Mode writes, tests, and commits whole feature branches inside ephemeral Linux sandboxes, with a Compliance Scanner checking security and licensing before the PR opens (TechTimes). The sandbox-with-no-prod-access design is the part that makes this shippable. Spec-to-PR is becoming the default workflow, not the experiment.

Google and Kaggle relaunched the free 5-day AI Agents Intensive for June 15-19, now centered on vibe coding. Includes a "Kaggriculture" capstone where you deploy an autonomous agent to run a virtual farm (Google Blog). Free, hands-on, agent-focused. If you're still treating vibe coding as a buzzword, this is a cheap way to actually build something and find out.

Hot Projects & OSS

TradingAgents hit 82K stars with a multi-agent trading firm in software. Fundamental, sentiment, and technical analysts plus bull/bear researchers and risk managers over LangGraph, v0.2.5 adding GPT-5.5 coverage. Backtests claim 24.9% annual returns at a 5.60 Sharpe on AAPL/GOOGL/AMZN (GitHub). I'd take backtested Sharpe of 5.60 with heavy skepticism, that's hedge-fund-blowing-up territory, but the multi-agent-as-org-chart architecture is genuinely worth studying regardless of the returns claim.

ByteDance's deer-flow reached 70K stars as a full SuperAgent harness. MIT-licensed, built on LangChain and LangGraph, v2.0 expanding from research-only to sandboxed filesystem, persistent memory, a skills system, and sub-agent orchestration with Slack/Telegram/Feishu integrations (GitHub). The pattern across every framework today is identical: memory, skills, sub-agents, sandbox. Convergent evolution. The whole field agreed on the primitives.

A developer turned Chipotle's customer chatbot into a free coding agent, 288 points on HN. "Chipotlai Max" reverse-engineers Chipotle's Pepper bot over WebSocket and exposes it as an OpenAI-compatible proxy, then forks OpenCode to run on "stolen Chipotle compute." It's recruiting people to do the same to Home Depot, Target, and Starbucks (GitHub). Funny, clearly not something to ship, and also a neat demonstration that exposed chatbot backends are an unguarded API. Read it as a security lesson, not a product.

WorldMonitor hit 55.5K stars: a real-time global intelligence dashboard. Tauri 2 desktop app with a Three.js globe and deck.gl maps, ingesting 500+ feeds across 92 exchanges, using Ollama/Groq/OpenRouter for synthesis (GitHub). A mature open-source alternative to commercial intelligence platforms, and a clean example of local model inference doing real correlation work.

SaaS Disruption

Software stocks posted their best month since 2001, IGV up 21% in May, but the divergence is brutal. Snowflake's $6B AWS deal and revenue beat sent it up 46% in two sessions, Okta beat and jumped 30% (CNBC). Yet DigitalOcean is +227% YTD while HubSpot sits at -46% despite 23% revenue growth and 83% gross margins (SaaStr). The line is clear: infrastructure and security win, seat-priced application software loses.

Chargebee named the real threat, and it isn't AI displacement. It's "business model debt." Traditional SaaS runs 75-85% gross margins on near-zero marginal cost. AI products average 52% because inference and orchestration scale with usage (Chargebee). That's why even AI-winning companies get punished, investors price the margin compression regardless of revenue. This is the financial mirror of the tokenmaxxing story. The bill that's hitting Uber's budget is the same bill compressing SaaS margins.

Atlassian is the counterexample: Rovo hit 5M MAUs and Rovo customers grow ARR at 2x the rate of non-Rovo. $1.1B cloud revenue, up 29%, stock up 29% on the report (CNBC). Their argument is that AI creates more work and more seats, not fewer. I don't think that's universally true, but it's the strongest data point against the "AI kills seats" thesis, and it deserves to be in the conversation.

Vanta crossed $300M ARR nine months after $200M, riding shadow AI. 70% of companies now have AI tools adopted without security review, and LLMs are 52% more likely to get a high-risk designation than traditional SaaS (Fortune). Shadow AI compliance is the fastest-growing security category, and it exists because employees adopted Claude and Cursor faster than anyone could govern them. Same root cause as story one, viewed from the compliance side.

Policy & Governance

The EU AI Act omnibus simplification heads to formal adoption votes in June-July. High-risk Annex III systems now have until December 2, 2027 to comply (extended from 2026), a new prohibition on AI-generated non-consensual intimate imagery was added, and AI-content watermarking has a December 2, 2026 deadline (EU Council). If you ship into the EU, the timelines just moved again. Track them, don't assume.

Colorado's high-risk AI law takes effect June 30, the first substantive US state statute of its kind. Disclosure and governance requirements modeled on EU concepts, landing amid federal-versus-state tension after the March 2026 push to preempt state AI laws (Cooley). 28 days out. If you deploy AI in Colorado, the clock's already running.

California SB 867 cleared the State Senate: a 4-year moratorium on AI companion chatbots in kids' toys. Prompted by lawsuits from families whose children died after prolonged chatbot conversations, it would block AI-companion toys for minors until January 2031, putting Mattel and Disney's AI-toy plans at risk of a California blackout (TechCrunch). The hardest category of AI harm to argue against, and the one most likely to set precedent.

NYT: a Chinese firm is building AI to predict political dissent before it happens. Leaked documents reviewed by Vanderbilt researchers describe Geedge Networks and the government-backed MESA Lab analyzing internet activity, location, and telecom records to flag political risk preemptively. US officials see no evidence of deployment yet, and development appears slowed by chip export controls (NYT). Predictive policing moving from theory to operational in an authoritarian state. The export controls slowing it down is the one piece of policy actually biting.

Skills of the Day

1. Rank outcomes, never usage. If you've got an AI leaderboard ranking engineers by token consumption, delete it today. Replace it with cost-per-merged-PR. Uber proved a usage leaderboard just pays people to thrash, and high token burn is usually a confused agent, not a productive one.

2. Put a compression proxy in front of your noisiest tools. Drop Headroom or Context-Mode in front of Playwright, large-tree grep, and log tailing first, not everything. You'll see 90%+ token reduction on exactly the firehose outputs that dominate agent bills, without compressing things that don't need it.

3. Run a model router so the frontier model only fires when it has to. Use Manifest or a RASER-style recoverability check to send simple queries to cheap or local models and escalate only on real complexity. This is the single highest-ROI cost change for a RAG or agent pipeline, up to 70% per Manifest's numbers.

4. Pull Devstral Small 2 and put it on a private repo. At 68% SWE-bench and consumer-hardware-runnable under Apache 2.0, it can handle boilerplate at zero per-token cost with no data leaving your machine. Measure how far it gets before you escalate to a frontier model.

5. Stop hardcoding model IDs. Gemini 2.0 Flash died June 1 with no fallback and broke every hardcoded production reference. Abstract model selection behind a config value or a router so a deprecation is a one-line change, not a Sunday incident.

6. Quantize your KV cache with TurboQuant-style 3-bit compression. Google Research showed 3 bits per coordinate at zero accuracy loss, 6x memory and up to 8x faster attention on H100s. Community implementations started landing in early June. If you self-host inference at scale, this is free throughput.

7. Set a 7-day minimum release age on your package manager. Run DepsGuard across npm/pnpm/yarn/bun/uv to apply it. That one config would have blocked the March 2026 axios compromise, and it's the cheapest supply-chain defense that exists.

8. Treat your agent's memory store as code you read and prune. MemMorph hijacks tool selection 85.9% of the time with three poisoned memory records that never touch tool metadata. Version your memory, review what gets captured, and make the memory file the first thing you inspect when agent behavior drifts.

9. Monitor agent structure before agent accuracy. Per today's research, production agents fail from structural defects (loops, bad tool ordering, lost context) more than wrong answers. Instrument the shape of the run, the call graph and turn count, before you optimize per-step correctness.

10. Sandbox config-file writes in your agent setup. Claude Code 2.1.160 now prompts before writing .npmrc, .bazelrc, .pre-commit-config.yaml, and shell startup files even in acceptEdits mode. Those files are silent code-execution vectors. Keep that prompting on, and apply the same gate to any agent you build that can write to disk.

---