The week AI moats melted, agents got permissions, and Cisco burned for eight days

A Cloudflare engineer used Opus 4.5 to rewrite the core of Next.js in one week for $1,100 in tokens. The result — vinext — is 67,000 lines against Next.js's 194,000, covers 94% of the API surface, and ships with an Agent Skill that migrates your project with one command across Claude Code, Cursor, and Codex. Vercel's CEO called it "insecure vibe-coded slop." That defense buys quarters, not years.

In the same week, Google Workspace CLI launched with 100+ pre-built Agent Skills and hit 8,800 GitHub stars on day one. Vercel killed its embedded agent and shipped an MCP server instead. WordPress added Markdown output for agent consumption. SAP started talking about a "Terminal Renaissance" where interfaces get generated on demand. Five platforms independently deciding your product's next user is a software agent isn't coincidence. It's the moment the assumption changed.

And while all of that shipped, CVE-2026-20127 — a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN — sat in CISA KEV for eight days with active exploitation. Full WAN fabric takeover. If your patch cadence is monthly, it already happened.

These three stories are the same story. The cost of replication collapsed, the identity of the user changed, and the time budget to respond went to zero. Whatever you thought was durable about your product last quarter needs to be re-examined against all three at once.

The moat you thought you had

The uncomfortable detail in the vinext story is what made it possible: Next.js's comprehensive test suite. That test suite is the specification an AI needs to build a clean-room implementation. Every engineering best practice you've been told to follow — exhaustive tests, clear API contracts, good docs — is now a blueprint for anyone with $1,100 and a week. SQLite keeping TH3 closed-source looks less like paranoia and more like foresight.

Yes, but — the 94% coverage number hides where production actually lives. Enterprise migrations fail on the last 6%: the security hardening, the edge-case reliability, the ecosystem of plugins that assume specific internals. Figma's response is the tell. Rather than race on features, they repositioned as an MCP-connected orchestration node — defensibility through routing density, not code complexity. That still works. What doesn't work anymore is "we wrote hard code that took years."

The same pattern shows up in the numbers no one wants to look at. Claude Code now authors 4% of public GitHub commits, projected past 20% by year-end. Applicant-to-recruiter ratios hit 500:1. A Freelancer.com natural experiment showed the correlation between cover-letter customization and offer probability dropped 79% after AI writing tools shipped. Effort is no longer a quality signal. Every metric your org uses that treats volume or polish as a proxy for care is now measuring noise.

Your next user has an API key

The agent-interface convergence is the practical follow-through. If Google Workspace CLI lets an agent read Gmail, update Calendar, and manipulate Sheets directly, any product sitting in a Workspace workflow can be routed around. Your integration is no longer the destination — it's a speed bump between the user's agent and their data.

The problem is that the identity model hasn't caught up. Snyk's telemetry across 500+ organizations claims one in five are running autonomous agents in production, and orgs tracking only "AI models" miss roughly two-thirds of their actual AI surface area. MCP servers, coding-assistant OAuth tokens, agent service accounts — most of these were provisioned by an engineer solving a Tuesday problem, not by anyone with an IAM charter. There is no human sponsor. There is no rotation policy. There is no audit trail your existing tooling understands.

And the protocol is now dual-use. CyberStrikeAI shipped this week — open-source on GitHub, 100+ offensive tools orchestrated over MCP. Every MCP server endpoint you stood up is now something offensive AI knows how to talk to. Treat them like public REST APIs: authentication, input validation, rate limiting, audit logs. Most current implementations treat security as an afterthought because the protocol was designed for trusted local tool use. That assumption is broken.

Six minutes

While the moat and identity stories played out, the defensive timeline collapsed underneath them. CrowdStrike's average lateral movement time is now 30 minutes, down from 100 in 2021. ReliaQuest's fastest observed breakout-to-exfiltration is six minutes. Chatty Spider exfiltrates to attacker-controlled Google Drive in four minutes flat.

The Cisco SD-WAN CVE is just the loudest of a stack. Rollup path traversal to RCE in every Vite-based build pipeline. Kubernetes PersistentVolume host-path escape at CVSS 9.9. OpenSSL buffer overflow across 3.0–3.6. Caddy case-sensitivity bypassing path-based auth. Copeland XWEB Pro at CVSS 10.0 in ICS. If your SOC's mean-time-to-contain is measured in tens of minutes and your patch SLA is measured in weeks, the math no longer works.

What to do this week

Pick three things and get them on someone's calendar before Friday.

First, run npm ls rollup across every project and bump to 2.80.0 / 3.30.0 / 4.59.0. Patch Cisco SD-WAN. Push the Firefox and Android March updates via MDM. This is the emergency-triage tier — no strategy, just close the doors that are open.

Second, inventory every AI agent identity in your environment: MCP connections, OAuth tokens granted to CLI tools, service accounts, API keys used by coding assistants. Assign a human sponsor to each. If you can't answer "how many agents have access to our systems," you don't have a governance problem yet — you have a visibility problem, and visibility comes first.

Third, pick one competitive advantage in your product's positioning doc and stress-test it against the vinext scenario. If a competitor with a coding agent and your test suite could replicate 90% of it in a week, name the last 10% out loud. That's your actual moat. If you can't name it, that's the answer too.