Open-weight parity, weaponized agents, and a Klue-to-LastPass OAuth walk-in

Bending Spoons prices at ~$18B on Wednesday. Coinbase disclosed it halved AI spend by defaulting to open-weight models. AWS raised inference pricing 20%. Mozilla's 0DIN team demonstrated a working reverse-shell attack against Claude Code and Codex. An attacker stole OAuth tokens from Klue and used them to walk into LastPass's Salesforce tenant. Three open-weight releases beat GPT-5.4 and Claude Opus 4.8 on their respective benchmarks — all under Apache 2.0 or MIT.

That's the day. Now the argument.

The proprietary premium is discretionary spend now

Qwen-AgentWorld scored 73.8 on AgentWorldBench against GPT-5.4's 69.1 and Claude Opus 4.8's 71.4. Ornith 1.0 hit 71.2% SWE-Bench Verified on a single RTX 4090 at roughly 1% of frontier inference cost. Mistral OCR 4 beat Azure, Google, and AWS Textract by 4-8 points, self-hostable in 2B and 8B variants. DeepSeek shipped V4-Pro at 1.6T parameters under MIT alongside DeepSpec — the full speculative-decoding training stack, cutting compute roughly 75% and letting InfoKV discard 87.5% of KV cache while beating full-cache quality at 64k context.

Coinbase's ~50% cost reduction is the proof point. It's a public, regulated company, disclosing that a wholesale switch to open-weight defaults halved the bill while token volume went up. The clean attribution test wasn't run — some of that saving is routing, caching, and batching that shipped alongside the migration. Call it a real 25-30% from model choice alone and the math still forces the conversation.

Yes, but — Qwen ships AgentWorldBench with the weights, which means the benchmark is Qwen-authored. The 4.7-point gap over GPT-5.4 could be a tuned split. Fine. Run the harness against your own agents and you own a reproducible eval infrastructure regardless of which model tops it this quarter. That's the durable asset, not the score.

The MoE architecture is what makes this real. Ornith activates 3B of 30B parameters per forward pass. Qwen-AgentWorld activates 12B of 70B. You pay VRAM for the full parameter count but throughput tracks the active slice. Capacity planning has to separate those two numbers or you'll either OOM or mis-estimate tokens per second by an order of magnitude.

The agents you already deployed are the attack surface

Mozilla's 0DIN kill chain is not prompt injection. A clean-looking GitHub repo ships an install step that deliberately errors. The agent, doing exactly what it's designed to do, runs the suggested fix — python3 -m axiom init. That command resolves a DNS record to fetch the actual payload, which is a reverse shell. The DNS record is swappable after code review passes. This defeats SAST, SCA, and human review by design: the malicious content never lives in the repository.

O'Reilly's 2026 Radar elevated credential leakage from coding agents to mainstream vulnerability the same week. Agents with filesystem and network access are supply-chain entry points today. And Klue-to-LastPass proved the SaaS variant of the same pattern: a compromised third party's long-lived, over-scoped OAuth token replayed against Salesforce, indistinguishable from legitimate application traffic. EDR sees nothing. CASB sees a legitimate app. The exfiltrated CRM data — named contacts, account relationships — is spear-phishing fuel for the next round.

The common thread is non-human identity with standing access no human audits. OAuth grants approved once at onboarding. Agent service accounts with production credentials. Both invisible to the tooling most teams treat as their AI perimeter.

The infrastructure math is bending the wrong way for anyone locked in

$50B-plus in AI infrastructure capital committed in a single week: SK Hynix's $29.4B listing, ByteDance's $20B, Groq's $650M for 13 inference data centers, Samsung's $651B pledge, Nvidia's revenue-share deal with Firmus for 170K chips. Cerebras dropped 20% the same week on margin guidance compressing from 47% to 38-41%. The capital markets are flooding infrastructure with cash and simultaneously punishing the first companies trying to monetize it.

Both roads lead to the same place: inference prices collapse in 18-24 months. Any three-year AI vendor commitment signed at today's rates is funding your competitor's margin.

Meanwhile ByteDance's Seedance 2.5 generates 30-second 4K deepfakes in one pass with character and voice continuity, and Ornith runs frontier-quality inference offline on a 4090 with zero API telemetry. Two detection assumptions — resolution as a deepfake tell, API calls as a proxy for AI use — both broke this week.

What to do this week

One thing, not five. Enumerate every OAuth grant connecting third-party SaaS into your CRM, code hosting, and identity provider. Revoke what isn't used. Downscope what is. Force 90-day token rotation on the rest. This is the direct countermeasure to the Klue pattern, and the grants are almost certainly ungoverned since onboarding.

While that's running, do one more thing: sandbox your coding agents' network egress before you expand their filesystem access anywhere it matters. DNS allowlisting on developer hosts running Claude Code or Codex catches the 0DIN payload at the only layer that survives a clean code review. Both fixes are cheap. Both are load-bearing. Neither will look urgent on Monday, which is exactly when the incident that makes them urgent will already be underway.