Four CVSS 10.0 Bugs Hit Axios, Kafka, Go, and Nexus at Once

A Dense 27B Just Beat a 397B MoE

Alibaba's Qwen3.6-27B is a dense 27B parameter model that outperforms its own 397B MoE predecessor (Qwen3.5-397B-A17B) across all major coding benchmarks: SWE-bench Verified (77.2 vs 76.2), SWE-bench Pro (53.5 vs 50.9), Terminal-Bench 2.0 (59.3 vs 52.5). It matches Claude 4.5 Opus on Terminal-Bench. This is a 14.7x parameter reduction with no performance loss — and it ships under Apache 2.0 with day-0 vLLM, llama.cpp, and Ollama support.

The practical implications for your inference economics are immediate. Dense models have fundamentally simpler serving characteristics than MoE: no expert routing, no load imbalance, predictable memory bandwidth. At 55.6GB (FP8), this fits on a single A100-80GB. Unsloth published 18GB GGUF quantizations that run on consumer GPUs. If your team has been paying per-token API costs for coding agents, this is your signal to benchmark self-hosting economics seriously.

Perplexity is already running a post-trained Qwen model in production for tool routing and summarization, claiming GPT-matching factuality at lower cost using a search-augmented SFT+RL pipeline.

The Scaffold Is the Real Lever

The most consequential finding this week isn't any model release — it's that Qwen3.6-35B jumped from 19% to 78.7% on the Polyglot benchmark by changing only the agent harness (from a generic scaffold to little-coder). That's a 4x capability swing from pure infrastructure changes. If you're running model comparisons in a single scaffold and making infrastructure decisions based on the results, you're benchmarking the scaffold, not the model.

Multiple independent signals reinforce this pattern. Shopify CTO's 'tasteful tokenmaxxing' framing identifies that serial autoresearch loops (depth) — where each step refines context — produce better results than parallel fan-out (breadth) that wastes tokens on redundant exploration. Garry Tan's 'skillification' pattern encodes deterministic agent subtasks as local scripts rather than re-prompting the LLM each time — saving tokens, reducing latency, and improving reliability.

The Two-Stage Training Pipeline

Perplexity's published architecture is worth studying: SFT first for compliance/formatting, then RL specifically for factual accuracy and tool-use efficiency. This separation avoids the common failure where safety fine-tuning degrades task performance. They built this on open-weight Qwen models and claim superiority over GPT-5.4 on FRAMES and FACTS OPEN benchmarks. Multiple studies independently confirm that RL outperforms SFT, DPO, and rejection sampling for behavioral alignment without catastrophic forgetting.

Self-Hosted vs. API: The Decision Framework

The hybrid approach is likely correct for most teams: self-hosted Qwen for high-volume coding tasks, API for complex reasoning and low-volume tasks.

Goodhart's Law Hits Industrial Scale

Three of the five largest tech employers — Meta, Microsoft, and Salesforce — independently converged on the same antipattern: making AI token consumption a visible, ranked metric. The result is predictable and now measurable. Meta burned 60.2 trillion tokens in a month while engineers deliberately inflate numbers. At Microsoft, engineers ask AI questions already answered in internal docs and prototype features they'll never ship — because low token usage feels like a career risk during layoff season. At Salesforce, a Mac widget updates every 15 minutes showing your spend against a minimum target of $170/month.

This isn't adoption — it's performative compliance. And at Meta, production SEVs have been directly traced to careless AI-generated code from developers optimizing for volume over quality.

The Real Cost: Not Just Dollars

The engineering cost goes beyond the estimated $100M+/month in wasted compute. Meta's 'Trajectories' tool reveals top leaderboard users are producing throwaway, wasteful work. A provocative theory from a long-tenured Meta engineer: the leaderboard may be intentional — not to boost productivity, but to generate 85K developers' worth of real-world coding traces for training Meta's next coding model. If true, the training data is now contaminated with tokenmaxxing artifacts, training the next model to generate plausible-looking busy work.

Shopify's Circuit-Breaker Pattern

Shopify built what may be the industry's first token leaderboard in 2025, watched competitive dynamics form, and proactively course-corrected with three specific moves:

1. Renamed 'leaderboard' to 'usage dashboard' — small semantic change, real behavioral impact
2. Circuit breakers: per-developer spend spike detection auto-kills access when an agent goes runaway, with manual re-enable requiring human confirmation. Catches both gaming and genuine infrastructure bugs.
3. Per-token cost analysis over volume: Farhan Thawar's key insight is that engineers using expensive model tiers are making deliberate choices about complex problems; engineers burning cheap tokens at volume are padding stats.

The 75% Number in Context

Google's claim that 75% of new code is AI-generated (up from 25% two years ago, 50% six months ago) is real but needs context. Google has enormous auto-generated code: protocol buffers, build configs, API bindings, test scaffolding. The meaningful question isn't the percentage — it's the review model. At 75% generation rate, the engineering role shifts decisively toward review, specification, and system design. Combined with research showing AI coding assistants reduce developers' independent problem-solving persistence, 'cognitive debt' — code that works but no human on the team fully understands — is emerging as a distinct maintenance risk category.

Vercel's CTO reports 60% of admin app traffic is now bots, not humans. This confirms agents are becoming the majority consumer of developer infrastructure. Your API design, error responses, and rate limiting policies all need to account for this new reality.