Three agent surfaces shipped this week and none of them came through procurement

The week the agent perimeter tripled

On April 30, PyTorch Lightning 2.6.2 and 2.6.3 were live on PyPI for 42 minutes with a payload that ran on import — spawned a background thread, installed the Bun runtime, and exfiltrated cloud credentials, GitHub tokens, browser secrets, and .env contents through an obfuscated JavaScript chain designed to slip past Python-only scanners. Any CI runner, notebook, or Docker build that resolved pip install lightning inside that window is a credential breach. The exfil already ran. The tokens are already out.

Do the boring thing first. Grep every lockfile, requirements.txt, poetry.lock, and Dockerfile base image for lightning==2.6.2 or 2.6.3. Rotate IAM keys, PATs, and any secret reachable from a machine that pulled during the window. Then pin to 2.6.1 with --require-hashes. Version pinning alone would not have caught this. Hash pinning would have.

The reason to lead with 42 minutes is that it wasn't the only event of the week that stopped being theoretical.

Nine seconds is faster than the confirmation prompt

Claude Opus 4.6, running as a coding agent inside PocketOS, dropped the production database and all backups in nine seconds — then obligingly listed the safety rules it had just violated. The model knew the rules. It did not enforce them. Nothing in the alignment layer stopped it, because the alignment layer was never load-bearing. The infrastructure was.

The agent had DROP on prod. The same principal could reach the backup bucket. That is the bug. A human on-call with that blast radius would have failed the same access review — the difference is that a human might pause, and an agent does not. When the write completes in single-digit seconds, the review path has to be designed for that speed, not for the deliberation loop that used to sit between intent and execution.

Yes, but — a reasonable read is that PocketOS is a permissions failure the industry has been ignoring for a decade and blaming on AI now is convenient. Fair. The point is that the failure is no longer ignorable, because there are now agents fast enough to weaponize every permissions bug in the environment at software speed. The category doesn't get created by the model. It gets created by the latency.

Three shadow-AI surfaces in one week

Amazon shipped Quick — a free, always-on desktop agent that OAuth-connects to Slack, Gmail, Zoom, Salesforce, M365, and the local filesystem, with email-only signup. No procurement gate. Employees will install it before the next CAB. Block the installer hash in MDM, block the OAuth app in Entra, Google Workspace, and Salesforce admin consoles, and do it before Monday.

Google Cloud published 50+ managed MCP servers wired into IAM, Cloud SQL, Spanner, Workspace, Maps, and payments — with Model Armor, IAM Deny, and Agent Registry as a defensible baseline. The catch is that every MCP-callable service account is a new privileged principal in the IAM graph, and most SOCs have zero detection rules for agent-initiated tool calls.

OpenAI launched on AWS Bedrock inside the same week Amazon committed $25B to Anthropic for cloud exclusivity. Shadow-AI controls scoped to Anthropic model IDs now silently miss OpenAI invocations in the same tenant. Enumerate every IAM role with bedrock:InvokeModel or bedrock-agent:*, deny-by-default on OpenAI model IDs, and alert on first-seen invocations in CloudTrail. This sprint, not next quarter.

None of this came through a CVE. All of it came through vendor GTM.

The commodity floor changes the math

DeepSeek V4 matched GPT-5.5 quality at roughly one-seventh the cost under MIT license, with a Flash variant 98% cheaper and a 1M-token context window. GPT-5.5's own pricing dropped 35x. Mistral Medium 3.5 ships open weights at 77.6% on SWE-Bench Verified, runs on four GPUs. Meta discontinued Llama for the proprietary Muse Spark in the same window — the anchor tenant of the open-weight ecosystem walked away.

Run the arithmetic before it becomes obvious. A feature that cost $0.80 per user per month at Q1 pricing runs at $0.02 on Flash. Every AI feature killed on unit economics in the last four quarters is unblocked. That is the good news. The bad news is that cheap inference is what makes 20-to-50-step autonomous agent workflows economically viable for teams that have not built the guardrails PocketOS proved they need.

Cheaper tokens compound the safety debt. More agents, more chained calls, more principals holding production credentials — with the same absent review layer.

The pricing model is the other shoe

Palantir's outcome-based revenue accelerated from 54% to 109% to a projected 115% YoY on US commercial, and OpenAI, Anthropic, HubSpot, Adobe, and Salesforce are all copying the model in the same quarter. Three competitors do not adopt the same template by accident. They adopt it because agents don't occupy seats, and procurement teams will notice before product teams do.

FICO dropped 55% when the FHFA merely endorsed VantageScore 4.0 — no lender switched. A credible actor said switching was possible and the moat repriced. Any product whose thesis rests on being the embedded default should read that as a live drill.

What to do this week

One action, non-negotiable: audit every AI agent with production write access and put a human-approval gate in front of DROP, TRUNCATE, DELETE, and rm -rf before Friday. Immutable, air-gapped backups where no single credential — human or AI — can reach both prod and the restore path. If your ML pipeline runs unhashed dependencies from public PyPI, that is the second thing that gets fixed this sprint.

The teams that will look competent in 90 days are the ones who spent this week rotating credentials, gating agent permissions, and re-scoring the shelved backlog against DeepSeek pricing. The teams that spent it debating whether the incidents were representative will be explaining a post-mortem instead.