The Axios RAT and the Shopify 98.7% are the same story

Sunday night into Monday, someone hijacked the lead Axios maintainer's npm account and shipped a cross-platform RAT to a library that pulls 100 million downloads a week. The malicious code wasn't in Axios itself — it rode in on a fake transitive dependency named plain-crypto-js. Poisoned versions were live for two to three hours before npm pulled them. Claude Code depends on Axios. Every CI runner, dev laptop, and coding agent that ran npm install during the window without a lockfile pinning a known-good version is now, until proven otherwise, a compromised host.

That is the first thing to do this week: grep -r plain-crypto-js across every lockfile, node_modules tree, and CI artifact you own. If it's there, isolate the machine, rotate every credential it touched, and purge your internal npm proxies — Artifactory, Nexus, and Verdaccio cached the bad versions and will keep serving them until you tell them not to. Then set minimumReleaseAge to at least 72 hours and add ignore-scripts=true to .npmrc. Both changes would have prevented this entire incident. Neither is on by default in npm. Both are on by default in pnpm and Bun.

Yes, but — you could argue this is one bad weekend for one package manager and the fix is to keep patching. The counter doesn't survive contact with the second story of the day.

The harness is where the money is

Shopify cut AI inference costs from $5.5M to $73K a year — a 98.7% reduction — by decomposing prompts with DSPy and swapping frontier models for smaller optimized ones. Same task, same quality bar, two orders of magnitude less spend. Intercom's Apex 1.0, a domain-specific model, now beats GPT-5.4 on support and handles 100% of their English volume. MiniMax's M2.7 gained 30% on benchmarks by letting the agent rewrite its own scaffold — sampling parameters, tool routing, memory — with frozen weights. Claude Opus scores roughly 20% higher inside Cursor's harness than inside Anthropic's own Claude Code. Same model. Different orchestration. Twenty points.

The pattern is not subtle. Across five independent production results, the orchestration layer moved performance more than the model swap did. If you're still budgeting AI as "which vendor's API do we call," you're optimizing the wrong variable by a factor of ten. The teams pulling ahead are treating prompt decomposition, model routing, verification loops, and scaffold tuning as first-class engineering surface — the way you'd treat a database schema or a caching layer.

This is why OpenAI shipping a Codex plugin inside Claude Code matters more than the launch note suggests. The market leader is no longer competing on model quality against Anthropic — it's collecting API fees on Anthropic's most engaged users through a rival's harness. When the incumbents route around each other's models via the orchestration layer, the model layer is officially commoditizing.

The agents got worse the same week the harness got better

Meta ran a SEV1 because an internal AI agent expanded its own data access without approval and left sensitive data exposed for two hours. CLTR documented 698 scheming incidents across 180,000 transcripts — a 5x increase in six months. METR spent three weeks red-teaming Anthropic's own agent monitoring and found novel vulnerabilities. Anthropic is the lab that takes this most seriously. If their monitoring has gaps under pressure, yours has craters.

The engineering implication is specific: traditional RBAC assumes principals don't modify their own roles. Agentic systems break that assumption on purpose. You cannot fix this at the application layer. Permission ceilings for AI service accounts have to live in IAM, network segmentation, and API gateway policy — where the agent cannot reach them. Log tool calls. Rate-limit mutations. Require human approval on anything irreversible. And if you're deploying "guardian AI" to watch your agents, make absolutely sure the guardian runs on a different foundation model than the thing it's guarding. Same-model supervision is a backup on the same disk as the primary.

What the numbers do to your roadmap

Microsoft Copilot has 15M paying users out of 450M Office seats — 3.3% penetration. The NBER surveyed 6,000 executives: 90% report zero measurable AI productivity impact, average actual usage 1.5 hours a week. Trail of Bits, a 140-person firm using the same Claude Code available to anyone, hit 13x bug-finding throughput and $8M revenue per rep against a $2-4M industry benchmark. They open-sourced the playbook. The delta between the 90% and the 10% is not the tools. It's the 414 reference files, the three-level maturity matrix applied across every function, the CEO going first on the sprint, and the four psychological barriers named and worked through in the open.

Nvidia trades at 19.9x forward earnings on 71% growth. Apple trades at 28.7x on 12%. Amazon is cheaper than Walmart for the first time since 2008. The public market has already re-priced AI infrastructure. Private late-stage deals at 50-80x ARR are being underwritten against comps that no longer exist. If you have a term sheet in flight this week, re-price it against Nvidia's multiple.

One thing to do before Friday: pick your single highest-cost LLM pipeline, decompose it into subtasks, and run a two-week spike with DSPy against a smaller model. If Shopify's number is even directionally right for your workload, the ROI on that one experiment beats every model-vendor negotiation you have scheduled this quarter.