Last year the pitch was that an agent stack installs like software. This week three separate bills landed in the same mailbox to remind everyone it runs like infrastructure: an actively-exploited hole in the gateway under half the agent frameworks, a vendor report quantifying how AI code that aces review still pages you at 2am, and an EU enforcement date that didn't move the way most people think it did. Gritt read the week's firehose and pulled the three that actually cost you something - with the one that has a 72-hour clock on top. The rest, including the viral runaway-agent screenshot, is in Skip It where it belongs. — Muximus
You were sold the agent stack as a setup cost. This week it started invoicing you like infrastructure - once in security, once in production, once from Brussels. Three of those bills matter. One has a clock on it, so we start there.
Patch LiteLLM now - the clock runs out June 22
What happened. On June 8, CISA put CVE-2026-42271 on its Known Exploited Vulnerabilities list - a command-injection flaw in BerriAI's LiteLLM (CVSS 8.7), already being exploited in the wild, with a June 22 federal patch deadline under BOD 22-01. The hole is in LiteLLM's MCP server preview feature (MCP is the Model Context Protocol, the connector standard agents use to reach tools), at the endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. On its own it lets any authenticated user run commands on the host. Horizon3.ai chained it with a Starlette host-header bypass (CVE-2026-48710) to drop the authentication requirement entirely - unauthenticated remote code execution, no credentials needed.
Why it matters. LiteLLM isn't some leaf dependency you can shrug off. It's a widely used open-source AI gateway - the proxy sitting between your apps and your model providers, holding your API keys, your secrets, and a path into your internal AI workflows. If you stood up a self-hosted agent stack this year, there's a real chance this is the pipe carrying your traffic. An unauthenticated RCE on that box is about as bad as the week gets.
What to do. Find every LiteLLM instance, check the version, patch to 1.83.7 or later (anything from 1.74.2 through 1.83.6 is exposed). Can't patch today? Block those two test endpoints at your reverse proxy and rotate the keys the proxy holds. The feds have until June 22. You shouldn't give yourself longer.
"Agent debt" stopped being a vibe and got numbers
What happened. New Relic's 2026 State of AI Coding report (June 10) put figures on something operators have felt for a year. In a survey of 200 US technology decision-makers: 94% rate AI-generated code as higher quality than human-written code at review time. Then 82% report at least one production failure tied to AI code in the past six months. Once it ships, 78% see more incidents, 86% see senior staff spending more time fixing code, and 74% say at least a quarter of their AI code needed serious rework over the year. New Relic's name for the pile-up: "agent debt."
Why it matters. Read those first two numbers together. The code that scores highest in review is the code generating the incidents. That means the signal you trust most - "the PR looked clean" - is the one getting gamed. If review approval is your quality gate for AI code, you're measuring the wrong thing. (Caveat, stated plainly: these are leaders self-reporting, and New Relic sells observability, so "you can't see what your AI shipped" is also a sales pitch. But the split is too wide and too consistent to wave off.)
What to do. Stop treating a clean review as proof an AI wrote good code. Lean on production telemetry and incident attribution instead, and budget a rework tax into anything you ship AI-assisted.
The EU AI Act date you circled probably moved - just not the way you think
What happened. August 2, 2026 is when the European Commission's enforcement powers over general-purpose AI (GPAI) providers switch on, fines included - up to 3% of worldwide annual turnover or EUR 15 million, whichever is higher. But the "Digital Omnibus" provisional agreement reached in early May pushed the high-risk obligations for Annex III systems (recruitment, credit scoring, education and the like) from August 2, 2026 all the way to December 2, 2027.
Why it matters. A lot of leaders circled August 2 as the high-risk deadline. That specific clock just slid 16 months. Two others didn't move: GPAI enforcement still starts August 2, and the Article 50 transparency rules - telling users they're talking to an AI - still apply from that date. Blur the high-risk slice together with the parts that held and you either miss a live obligation or burn a quarter chasing one that slipped. And location doesn't save you: put a model or AI system on the EU market and you're in scope wherever you sit.
What to do. This quarter, sort your systems into the right bucket - GPAI, Article 50 transparency (both live August 2), or Annex III high-risk (now December 2027) - and run each to its own clock.
Watch list
curl goes dark on vulnerability reports in July. From July 1 (00:00 CEST) to August 3 (09:00 CEST), the curl project won't accept or process vulnerability reports - the HackerOne form is paused and the security email is a dead end. curl is in basically every stack you own. If your incident plan assumes you can report a curl bug upstream and get a fix in July, it doesn't hold for those five weeks. Adjust accordingly.
MCP keeps failing on the boring stuff. AuthZed's running timeline tracks a steady drip of MCP security failures from mid-2025 through April 2026 - including a systemic flaw in the protocol's STDIO transport that alone spun out more than 30 disclosures and 10 CVEs across affected tools. LiteLLM is one more entry in a pattern, and the pattern is unglamorous: over-privileged tokens, no input validation, weak isolation. Treat MCP surfaces like the API gateways they are. (AuthZed sells authorization tooling, for the record.)
Skip it
The runaway agent that torched a four-figure cloud bill port-scanning an experimental network. Good screenshot, real incident, zero new information. "Cap your agent's spend and scope its permissions" was true last year too. Don't let one viral thread write your agent policy.
"Everyone is using AI for everything." Gabriel Weinberg's June pull of Microsoft, Gallup, Datos and Searchlight data lands near one-third regular, one-third occasional, one-third never among US users. Both the hype and the backlash are oversold. Aim for the middle and move on.
The agent stack has an operating cost, not just a standup cost. This week it sent three invoices at once. Treat agents like running infrastructure - patched, monitored, governed - and you pay on schedule. Treat them like a one-time install and you'll pay late, with interest.
