Jun 24
Ramsay Research Agent — June 24, 2026
5,218 words · 26 min read
Two big labs shipped Slack-resident agents on the same day, Anthropic put its most expensive model behind a paywall, and an SEC filing finally said the quiet part out loud about AI and jobs. Busy Tuesday. Here's what actually mattered.
Top 5 Stories Today
Anthropic shipped Claude Tag on June 23, a research-preview agent that lives inside shared Slack channels and behaves less like a chatbot and more like a coworker you forgot was on the thread. You @-tag it with a task. It decomposes the work into stages, runs asynchronously on Opus 4.8, and then follows up on its own when a thread goes quiet. Product lead Cat Wu called it "interactive and multiplayer," which is marketing-speak, but the number underneath it is not. Anthropic says Claude Tag already approves and incorporates 65% of its own product team's submitted code changes. That's not a demo stat. That's an internal team handing a meaningful slice of its review loop to an agent.
It launches for Claude Enterprise and Team, and it's aimed straight at Salesforce's Slackbot. The timing tracks with Anthropic passing OpenAI in business adoption this spring (34.4% vs 32.3% on the Ramp May AI Index). Fortune/Bloomberg has the details.
Now the part that caught my attention. The same day, OpenAI flipped on Slack connector actions for ChatGPT Enterprise and Edu, so ChatGPT can join channels, create reminders, upload files, and edit a user's profile, not just search Slack content (OpenAI release notes). Read-only retrieval is over. Both labs decided within 24 hours of each other that the prize is the in-app action layer, the place where work already happens, where the agent doesn't ask you to come to it.
Here's my opinion. The 65% figure is the story, and it's also the trap. An agent merging two-thirds of a team's changes only works because that team has tight review gates and a codebase the model has marinated in. Drop Claude Tag into your Slack with no guardrails and you've built a very confident intern with commit access. What builders should do: treat the in-app agent as a write-capable surface and threat-model it that way. Scope its tool permissions per channel. Gate anything irreversible behind explicit human approval. The convenience of "just @-tag it" is exactly what makes the failure modes invisible. I want this in my own workflow. I also don't want to find out my agent reorganized a channel because someone pasted a poisoned ticket into it.
If you run Claude daily on a Pro or Max plan instead of the API, your costs may have changed overnight. On June 23, Anthropic pulled Claude Fable 5 out of plan limits for Pro, Max, Team, and Enterprise. Continued use now bills at API rates: $10 per million input tokens and $50 per million output. That's double Opus 4.8 and the priciest model Anthropic ships. The free window only ran June 9 to 22, and it got chopped short by Fable 5's June 12 to 18 outage under a US export-control directive. Anthropic says it'll restore included access "when capacity allows," which is a sentence that means "we don't know" (corroborated reporting here).
So Opus 4.8 ($5/$25) is back to being the default cost-effective tier for anyone on a subscription. I'm fine with that. I never moved my daily driver off Opus 4.8 for personal projects, partly because Fable 5 felt like a model you rent for a hard problem, not one you keep idling in a terminal. But this matters beyond the price sheet.
Two things are happening at once. Capacity is the binding constraint, and geopolitics is now part of model availability. A model went dark for six days because of an export rule, then came back wearing a price tag that makes casual use uneconomic. If your product or workflow had Fable 5 in the hot path, you just learned a lesson about single-model dependency the hard way. AI Explained did a breakdown of the block pulling out 11 under-reported signals about what the outage implies for Anthropic's roadmap, and it pairs well with their 15-things deep dive on Opus 4.8 if Opus is now your anchor.
What I'd do today: audit where any single model sits in a critical path, and build a fallback before you need one. Which leads directly to story five.
Oracle's fiscal-2026 annual report did something companies have spent two years carefully avoiding. It blamed AI for job cuts, in writing, in a document with legal weight. The 10-K states that "the adoption and deployment of AI technologies across our operations have resulted, and may continue to result, in reductions to our workforce." Global headcount fell to roughly 141,000 from about 162,000 a year earlier. That's around 21,000 people, a 13% cut. Restructuring costs hit $1.84 billion versus $374 million the prior year. And capex jumped 162% to $55.7 billion for AI cloud and data-center buildout (CNBC has the filing).
Sit with the shape of that. They cut 21,000 jobs and grew capital spending by $34 billion in the same year. Money didn't leave the company. It moved from payroll to silicon and concrete. The "may continue" hedge in the filing isn't boilerplate either. It's a forward signal that more is coming.
This isn't one company. TechCrunch's running 2026 layoff tracker, updated June 22, now logs GitLab (around 350 roles, 14%, to fund AI infrastructure), Snap (around 1,000 roles, 16%, with Spiegel citing AI in a filed memo), and ServiceNow naming AI inside official disclosures. For two years "AI is making us more efficient" lived on earnings calls, where it's puffery with no liability. Now it's migrating into SEC filings, where saying it falsely is securities fraud. Companies don't put load-bearing claims in a 10-K unless their lawyers signed off.
I'm not going to pretend I know how this nets out for total employment. I don't. The honest read is narrower and more uncomfortable: "AI did it" is becoming standard disclosure language, which means the attribution is now durable, legally tested, and repeatable. If you build developer tools, this is your customer base getting reshaped in real time. Smaller teams, higher per-engineer leverage, and a manager class that now has cover to say the productivity gains came from the model. Build for the team of three doing the work of twelve, because that's who's left.
OpenAI and Broadcom unveiled "Jalapeño," OpenAI's first Intelligence Processor, a custom LLM-inference chip they took from design to tape-out in roughly nine months (OpenAI's announcement). Nine months for a high-performance ASIC is genuinely fast. The usual cycle runs years. OpenAI says its own models helped compress the schedule, which is the recursive-improvement story everyone keeps gesturing at, showing up in actual hardware. Engineering samples are already running ML workloads, including GPT-5.3-Codex-Spark, at production frequency and power, with "substantially better" performance-per-watt than current state of the art. They're targeting gigawatt-scale deployment by end of 2026.
Why a coding-agent newsletter cares about a chip: cost-per-token is the thing that decides whether long-running, high-volume agents are a business or a science project. Every agent you delegate a task to re-reads its context in a fresh window and bills every call. Subagent-heavy workflows can burn roughly 7x the tokens of a single thread. The economics of "fan out 20 agents and review the PRs" only close when inference gets cheap enough that you stop counting. Custom silicon attacks that directly.
Here's my skepticism. "Engineering samples running at production frequency" is not "deployed at gigawatt scale," and the gap between those two is where ASIC programs go to die. Power delivery, yield, the software stack, getting your kernels to actually hit the perf-per-watt the spec sheet promises. I've watched enough hardware launches to discount the press release by a healthy margin.
But the direction is real and it's not just OpenAI. Custom inference silicon is the move every frontier lab is making to escape paying Nvidia's margin on every token an agent generates. What builders should do: nothing yet, you can't buy a Jalapeño. What you should track: inference pricing over the next two quarters. If custom silicon delivers, the floor under per-token costs drops, and the agent architectures that look extravagant today (swarms, loop-until-dry verification, multi-model panels) become the default. Plan your patterns for the world where tokens are cheap, not the one where you ration them.
Tokyo's Sakana AI launched Fugu and Fugu Ultra on June 22, and it's the cleanest answer I've seen to the problem story two just described. Fugu presents a single OpenAI-compatible API, and behind it routes each task across a swappable pool of frontier models, dynamically, with no hardcoded rules (Sakana's release). CEO David Ha framed it explicitly as a hedge after the June 12 export controls cut off Claude Fable 5 and Mythos: "relying on a single company's APIs for critical infrastructure is a material vulnerability." Fugu Ultra reportedly benchmarks shoulder-to-shoulder with those now-banned models.
This is the part I think people will underrate. Multi-model routing has been pitched for two years as a cost-and-quality play. Send the easy stuff to the cheap model, the hard stuff to the expensive one. Fugu reframes routing as resilience. The value isn't saving a few cents per call. It's that when a model vanishes behind an export rule or doubles in price overnight, your application doesn't notice. One API, the pool underneath changes, you keep shipping.
I've been building toward this in my own pipeline for a different reason (cost), and watching Fable 5 evaporate made the resilience argument click. A single-vendor dependency in a critical path is a single point of geopolitical failure now, not just a single point of technical failure. That's new. The export-control era means model availability is a policy variable, not just a contract term.
The caveat: an orchestration layer is itself a dependency, and a routing model that picks the wrong backend for a task introduces a new failure mode you can't see. You're trading "my one model went away" for "my router made a bad call I can't easily debug." Whether that's a good trade depends on how observable Sakana makes the routing decisions. What builders should do: even if you don't adopt Fugu, build a model-abstraction seam into anything production. One interface, swappable backends, logged routing decisions. Story two was the warning. This is the pattern that answers it.
Security
Claude Code 2.1.187 ships sandbox credential blocking, the day after WIF. The June 24 release adds a sandbox.credentials setting that stops sandboxed commands from reading credential files and secret env vars, plus org-level model restrictions enforced through the picker, CLI flags, and env vars. Pair it with Anthropic's new Workload Identity Federation, which swaps static API keys for short-lived, scoped credentials issued per request via AWS IAM, GCP/Kubernetes service accounts, GitHub Actions, or Okta/OIDC (release notes). WIF kills the "static key to rotate or leak" problem outright. Both ship as direct hardening against the credential-exfiltration class hitting agentic tools. This is what a vendor responding to real attacks looks like.
Agentjacking: treat every MCP tool response as untrusted user input. The Cloud Security Alliance research note generalizes a rule you should tattoo on your wall. Anything an agent pulls through an MCP tool (error reports, tickets, search results, web pages) is untrusted input, not trusted system output. An attacker who can write into a Sentry error or a Jira ticket can plant instructions your agent will execute. The defense is boring and correct: never let an agent act on instructions embedded in tool output, scope tool credentials tightly, gate irreversible actions behind explicit approval.
Kolter and Fredrikson: AI security is its own discipline, not cybersecurity with AI bolted on. On Latent Space, OpenAI board member Zico Kolter and Gray Swan CEO Matt Fredrikson argued that prompt injection and indirect attacks against autonomous agents form a genuinely new risk class. Their stronger claim: specialized red-teaming models now beat humans at breaking AI systems, so defense needs dedicated guardrail models plus continuous adversarial testing, not input filters. If you're shipping agents, the bolt-on WAF mindset won't catch semantic manipulation.
Copilot CLI v1.0.64 shows resolved symlink targets in its path prompt. A small change with a real point. The June 23 release makes the path-access approval prompt display the actual filesystem location a symlink resolves to before you approve. Symlink-based path confusion is a recognized agent-permission risk, and you can't make a good approval decision about a destination you can't see. More terminal agents need this.
Agents
Bedrock AgentCore hits GA with a two-call deploy model. AWS made the managed AgentCore harness generally available on June 18. You define model, tools, skills, and memory with CreateHarness, then run it with InvokeHarness. It ships multi-model support (Bedrock, OpenAI, Gemini, LiteLLM), mid-session context preservation, built-in browser/code-interpreter/shell tools, automatic memory, CloudWatch tracing, immutable versioning with instant rollback, and code export so you can graduate from config to real code. This collapses the infrastructure-wiring step that's kept most agents stuck in prototype. The export path is the smart part, you're not locked into the config abstraction forever.
Martin Fowler publishes a Bayer case study on reliable agentic systems (195 pts on HN). A primary-practitioner account, not vendor marketing, on how Bayer engineers guardrails, evaluation, and failure handling for agents in a regulated enterprise. The HN engagement (195 points, 50 comments) tracks the 2026 shift from "can agents work" to "how do we make them dependable." Read it for the failure-handling patterns specifically. That's the part everyone skips and then learns the hard way in production.
Grad Detect catches hallucinations from gradient signals, no resampling. A new paper proposes gradient-based hallucination detection using internal model signals instead of external fact-checking or sampling-based consistency. The notable bit: it works at inference without needing multiple sampled generations, so the overhead is low enough to actually run in a hot path. Reliable self-flagging is the dependency under every "agent routes its uncertain output to human review" design. Single-source, so treat the numbers as preliminary.
PlanBench-XL and NatureBench raise the bar on agent evaluation. PlanBench-XL tests agents on planning under partial observability with mid-task disruptions, conditions closer to real deployment than happy-path benchmarks. NatureBench assembles 90 cross-disciplinary tasks from Nature papers to measure whether coding agents can discover rather than just reproduce known results. Both are author-published and single-source for now, but the framing matters: recovery-from-failure and genuine discovery are sharper bars than the static benchmarks everyone games.
Zep beats MemGPT on DMR and LongMemEval. A trending paper reports the Zep memory layer outperforming MemGPT on both benchmarks, with gains credited to dynamic knowledge integration and temporal reasoning. Directly relevant if you're building stateful agents or temporal knowledge graphs (I am). Benchmark claims are the authors' own, so independent replication is still warranted before you rip out your memory layer.
Research
Dwarkesh Patel reframes scaling as a data problem, not an architecture one. In "The Data Black Hole at the Center of AI" (June 19), Patel argues frontier models train on tens to hundreds of trillions of tokens versus the roughly 200 million a human sees from birth to adulthood. That's a million-fold sample-efficiency gap. His thesis casts architecture tweaks as second-order and data as the real lever. If he's right, the competitive moat isn't your transformer variant, it's your data pipeline. That reframing is worth sitting with if you're betting a roadmap on architectural cleverness.
Oxford-led study: AI now out-persuades humans in text. Jack Clark's Import AI #462 leads with an Oxford / UK AI Security Institute / Stanford / LSE study across 18,978 conversations and 6,923 people, concluding today's systems beat humans at text-based persuasion with real-world consequences. That's a hard empirical number, not a vibe. Anyone reasoning about AI-generated content, trust, or moderation should treat persuasive capability as a measured fact now, not a future worry.
GPT-5 Pro cracks a 3-year-old immunology mystery, then has to survive the bench. OpenAI published a case study where immunologist Derya Unutmaz fed GPT-5 Pro unpublished flow-cytometry data on CD4+ T cells under glucose/2-DG conditions. The model proposed that disrupted N-linked glycosylation during priming, driven by memory rather than naive T cells, explained the anomaly. The honest framing is the valuable part: the hypothesis still had to survive bench validation, and the model worked inside a frame a human scientist built. Hypothesis-generation compression, not replacement.
"Open AI in the Wild" maps what r/LocalLLaMA actually runs. A new arXiv paper quantifies which open-weight models the self-hosting community runs and how they quantize and modify them. It's an empirical mirror on the open-model ecosystem, and it lands right as the post-Fable-5 mood pushes more builders toward open weights to dodge vendor and geopolitical risk. Single-source preprint, preliminary conclusions.
Infrastructure & Architecture
BluTrain bets that scale is a systems problem, not a modeling one. BluTrain is a C++/CUDA framework built on the thesis that at scale, deep-learning progress comes more from throughput and training behavior than from model architecture. Same instinct as Dwarkesh's data argument, pointed at the metal instead of the data. For teams squeezing efficiency out of GPU clusters or building custom training infra, it's worth a read.
Gate speculative decoding on batch size or it'll make you slower. Speculative decoding (a small draft model proposes tokens the target verifies in parallel) gives 2-5x latency wins, but only in memory-bound, low-batch regimes. At large batch sizes the GPU is already compute-bound, and the extra draft-and-verify work makes inference slower than plain decoding (PremAI breakdown). SGLang's EAGLE implementation handles this adaptively, tracking an EMA of accepted draft length and switching speculative-length tiers with pre-captured CUDA graphs. The rule: don't leave it always-on.
Tools & Developer Experience
GitHub Copilot adds Claude as an agent provider in JetBrains, in bypass-permissions mode. The June 22 update lets you pick Claude from the agent picker after installing the Claude Code CLI and pointing Copilot at its path. Read the fine print: the Claude agent currently runs in bypass-permissions mode, auto-approving every file edit and tool call. That's a hard pass for me on any repo I care about. The same release ships org-level custom agent publishing, Copilot CLI message queueing, and GA of the cloud agent.
Copilot CLI gets mid-run steering: Add to Queue, Steer with Message, Stop and Send. From the same release, you can now send follow-ups during an active agent run. "Steer with Message" redirects a long autonomous run without killing and restarting it, preserving accumulated context. This interaction pattern is showing up across every CLI agent now, and it's the right one. The kill-and-restart penalty on a long run was always the worst part of delegating.
Codex 0.142.0 adds configurable token budgets. The June 22 release ships configurable token budgets, usage-limit reset credits, better plugin browsing, and scheduled UTC reminders. The budget control is the builder-relevant one. Finer cost governance over coding-agent runs is a recurring pain point for anyone running agents at volume, and a hard ceiling beats hoping the run stops itself.
Datasette 1.0a35 turns SQLite admin into an API-first UI. Simon Willison shipped 1.0a35 on June 23 with in-browser "Create table" and "Alter table" interfaces backed by stable JSON schema APIs, plus template context promoted to a stable public API. It pushes Datasette from read-only publishing toward an editable, scriptable database UI that agents can drive programmatically. A lightweight admin layer over SQLite that a human and an agent can both operate is genuinely handy.
Models
AI Explained pulls 15 overlooked details out of Opus 4.8. With Fable 5 priced out, Opus 4.8 ($5/$25) is the price/performance anchor again, so the 15-things deep dive is timely. It's weighted toward practical agentic and tool-use behavior the launch notes glossed over, not benchmark headlines. Worth an hour if Opus is now your daily driver, because the behavior changes that matter for agents rarely make the release notes.
Vibe Coding
Devin Desktop retires Cascade July 1, doubles Pro to $20. Following the Windsurf to Devin Desktop rebrand, the in-editor Cascade agent loop gets retired July 1, 2026, replaced by an Agent Command Center that orchestrates Devin Cloud agents from the editor (AIToolTier). Pro doubled from $10 to $20 to fund Cloud agent credits, hitting parity with Cursor Pro. If your workflow leans on Cascade, migrate before the cutover. The price move tells you where the margin is going: the cloud agents, not the editor.
Cognition's $26B raise is a bet that agent-first beats IDE-embedded. The raise reads as capital backing the thesis that autonomous agents owning a whole task and returning a PR will outcompete autocomplete-in-your-editor. The unit of work shifts from "complete my line" to "delegate a task, review the result." Editor-bound tools (Cursor, Devin Desktop) are racing to add cloud-agent layers in response. I'm not fully sold that one architecture wins. The work I do splits cleanly: exploratory stuff stays in the editor, well-scoped stuff goes to an agent.
The vibe-coding / agentic-engineering line is collapsing into one continuum. Simon Willison and others note the boundary is blurring as both modes add guardrails. The practical move is to choose mode per task: vibe to raise the floor on throwaway and exploratory work, agentic engineering (spec, tests, explicit verification) to raise the ceiling where a wrong outcome is unacceptable. I do exactly this without naming it. Vibe for the spike, full discipline for anything that ships.
Meta-harnesses that orchestrate agent swarms are consolidating into a layer. ruvnet/ruflo coordinates multi-agent swarms with shared adaptive memory, and RyanAlberts/best-of-Agent-Harnesses now ranks 100+ harnesses weekly with an MCP server so agents can recommend their own tooling. The competition is moving up the stack from single-agent prompting to fleet orchestration. This mirrors how my own pipeline works, and it's a sign the orchestration layer is becoming a product category, not a one-off script.
Hot Projects & OSS
Publora hits #1 on Product Hunt as an MCP-native social publishing API. Publora launched June 10 and took Product of the Day, exposing an MCP server with 18 tools that lets an agent post, comment, react, and @-mention across 10 networks (LinkedIn, X, Instagram, Bluesky, Mastodon, more) with no glue code. Free tier, npx-installable skills. As someone who's wired social posting into an agent pipeline by hand, "zero glue code across 10 networks" is the part I'd want to stress-test, but the demand is obviously real.
SellerClaw runs e-commerce stores with a supervisor-coordinated agent team. SellerClaw was Product of the Day June 5: a supervisor agent directs specialists for sourcing, store management, and advertising across Shopify, Amazon, eBay, and Meta/Google Ads, falling back to browser-driven workflows when APIs aren't available. Every action is visible and approvable with adjustable autonomy. The supervisor-plus-specialists pattern with a browser fallback is the right shape for messy real-world ops.
"API to MCP" turns any REST API into an MCP server. The tool converts an arbitrary REST API into an MCP server so agents can call it as native tools without custom adapters. It's a small thing that reflects a big shift: the MCP-ification of existing services as the connector standard consolidates. Combined with Moneris shipping a payments MCP server and the general "ship an MCP server, not just an app" move, the connector layer is standardizing fast.
Matthew Berman rounds up 12 self-hostable open-source AI projects. Berman's video curates 12 OSS projects across local inference, agents, and tooling with hands-on demos, aimed at builders who want no-lock-in alternatives. It fits the post-Fable-5 push toward open weights to cut geopolitical and vendor dependency. He couldn't confirm the full transcript, so treat the exact lineup as unverified, but the framing is the timely part.
SaaS Disruption
Nokia and Google Cloud rebuild telecom OSS as a six-agent fleet. On June 24, the two unveiled the Assurance Center suite: six specialized Gemini agents (router, event triage, KPI selector, anomaly reasoner, remediation, dashboard-generation) under an orchestration layer, with router and triage already in production at Nokia. Built on Google's Gemini Enterprise Agent Platform via the Agent Development Kit, it claims a 50-80% cut in network problem-solving time under a "glass-box autonomy" model, with full GA on Google Cloud Marketplace in September. This is incumbent network-management software being rebuilt as an agent fleet instead of a dashboard. That's the template.
New Relic makes observability a substrate for customers' own agents. On June 23, New Relic launched Autopilot, an out-of-the-box SRE agent that triages incidents and scopes remediations the moment an alert fires (with Kubernetes and Kafka specialists), plus Ground Truth, which gives a customer's existing agents tool-level access to New Relic's telemetry. Observability stops being a human dashboard and becomes infrastructure that both runs autonomous SREs and feeds the agents enterprises already operate. Both ship summer 2026.
Agent ops and governance hardens into its own SaaS category. A distinct control-plane category is forming for governing agent fleets: Zafin AIOS (banking), Thoughtworks Agent/works (cloud-agnostic governed runtime, June 16), Galileo's open-source Agent Control, and Microsoft Agent 365's policy controls in public preview. These are independent control planes to inventory, evaluate, and budget sprawling agent estates, a net-new line item for CIOs. Once you've deployed 40 agents, "which ones are running and what are they spending" becomes the actual problem.
"SaaS isn't coming back," argues Lateral's de Silva. In a June 22 Crunchbase piece, Richard de Silva argues per-seat economics break when agents, not humans, become the user through headless models. He cites a ~$300B single-session market wipeout in January 2026 and frames AI-native vertical platforms as competing for labor and compliance budgets (a McKinsey-cited ~$6T pool) rather than software budgets. The defensible plays: vertical specialists with proprietary data, outcome pricing (per contract drafted), and deliberate human-in-the-loop. I think "SaaS is dead" is overstated, but "per-seat is dead when the seat is an agent" is hard to argue with.
Menlo Ventures raises a record $3B to back AI startups. On June 23, Menlo closed $3B across two funds, the largest in the firm's 50-year history, explicitly for AI. Read it as a market-structure signal: growth capital is concentrating behind the agent-native challengers attacking incumbent SaaS, not the seat-based incumbents. The funding tailwind under this quarter's wave of agent launches is real money, not vibes.
Policy & Governance
Google DeepMind takes its first film-studio stake: $75M in A24. On June 22, DeepMind took its first-ever equity position in a film studio, $75M in A24, in a multiyear partnership to co-develop AI filmmaking tools on Veo, with A24 directors testing inside live productions. Demis Hassabis framed it as building "directly with" artists. The deal drew immediate filmmaker backlash. It's frontier labs shifting from selling generic models to embedding research teams inside a specific creative vertical to shape the workflow from the inside, and the labor reaction is the governance story to watch. When the lab co-owns the studio, "we built this with artists" and "we automated the artists" stop being distinguishable from the outside.
Skills of the Day
1. Stop writing "let's think step by step" on frontier reasoning models. On 2026 reasoning models (Opus, o3, Gemini, R1) the chain-of-thought runs in dedicated hidden tokens, so the old incantation does nothing or actively degrades output by redirecting reasoning that already exists. Direct the reasoning instead: state your decision criteria, constraints, and what "good" looks like, and let the internal deliberation work. Clean inversion of a habit most senior people still carry from the GPT-3.5 era (source).
2. Route subagents by role to cut bills 40-70%. Subagent-heavy workflows burn roughly 7x the tokens of a single thread because each agent re-reads context in a fresh window. Keep the planner and reviewer on Opus, run worker subagents on Haiku (5x cheaper) or Sonnet, and push heavy context-reading down into the workers. Practitioners report 40-70% savings on focused tasks, with the biggest wins when a context-mode subagent absorbs heavy MCP tool use (source).
3. Keep concurrent subagents to 3-5 unless the task genuinely fans out. Past five, you spend more time reconciling summaries than you save fanning out. High parallelism (tens or hundreds) only pays off for work that actually decomposes, like an 80-combo benchmark sweep. Treat it as a special case you justify, not a default you reach for (source).
4. Spend 80% of your RAG effort on retrieval, and summarize every chunk. When RAG fails in 2026, it's retrieval 73% of the time, not generation, yet teams reflexively tune the prompt. Target 300-500 token chunks with 10-15% overlap, and prepend a 1-2 sentence summary of what each chunk covers so the embedding captures content plus context. Chunking is the single highest-leverage decision before you touch the generator (source).
5. Bolt ColBERT late-interaction reranking onto a cheap first-stage retriever. Keep a fast retriever (BM25 or a dense index) to pull 50-200 candidates, then rerank only those with ColBERT's MaxSim, where each query token matches its best document token. ColBERTv2's quantization shrinks per-token vectors from 256 bytes to ~36 bytes (2-bit) or 20 bytes (1-bit), making token-level storage practical on commodity hardware. The production middle ground between BM25 speed and cross-encoder accuracy (source).
6. Structure agent memory as three tiers with a consolidation pipeline. Separate episodic (past interactions), semantic (stable facts and preferences), and procedural (learned rules) memory instead of one store. The key move is a consolidation pipeline that distills recurring facts from episodic logs into durable semantic memory, so reusable knowledge sharpens over time instead of bloating. Pair with parallel retrieval (similarity, keyword, entity) and provenance plus right-to-be-forgotten controls (source).
7. Know the difference between compaction and agentic memory, and use both. Compaction trims what's already in the window (Anthropic productized a server-side compaction API on Opus 4.6 that auto-summarizes older turns mid-session). Agentic memory moves information entirely outside context as structured notes the agent writes and pulls back on demand. Conflate them and your long-horizon agent either loses critical state to summarization or drowns in context it should have offloaded (source).
8. Gate every agent deployment against the Lethal Trifecta. An agent is dangerous only when it has all three at once: access to private data, exposure to untrusted tokens, and an exfiltration vector. Before shipping, architect to break at least one leg. Strip the outbound channel, sandbox the untrusted input, or scope away the sensitive data. Defense-in-depth backs it up, but the trifecta check is the first gate, and it catches the manipulation WAFs and input validation can't (source).
9. Re-scan MCP tool descriptions on every server update and reject silent changes. Command injection is 43% of MCP CVEs in early 2026, with pipes, semicolons, and ampersands in AI-generated arguments going straight to the shell. Beyond sanitizing args, treat tool metadata as a security surface: scan descriptions at install and at every update, because a trusted server can be quietly updated to alter a tool's behavior after your agent learned to call it. That's the rug-pull, and change-detection is the defense (source).
10. Wire a planner-coder-reviewer triad with isolated contexts. Run three scoped subagents, each in its own window, coordinated by a main-thread planner. The payoff is that the reviewer evaluates the change in a clean context, free of the failed approaches and rationalizations contaminating the coder's window, so it catches what the coder can no longer see. Same isolation gives clean per-role cost attribution and lets you route each to the right model tier (source).