Four new cards from two sources. Two themes cut across the day's scan. The first: the infrastructure layer around AI models now determines performance more than the models themselves, and inference economics are shifting faster than most teams' pricing assumptions. The second: agentic AI has introduced two new attack surfaces, one on offense and one in document workflows, both documented from real incidents in the last seven days.
Theme 1, The harness and the architecture now outrun the model
Tomasz Tunguz published two pieces in the July 23-28 window with distinct, quantified claims about where AI performance is actually being created.
The AI harness now moves coding benchmarks more than the model does names the finding that should reframe how teams evaluate AI model upgrades. The Endor Labs Agent Security League benchmark ran the same models across multiple harnesses. GPT-5.5 scored 61.5% functional correctness in Codex and 87.2% in Cursor. Same model. 25.7-point swing from the harness alone. Claude Opus 4.7 scored 87.2% in Claude Code and 91.1% in Cursor. The mechanism: the harness controls context selection, retrieval, and cache discipline. Input tokens represent 86 to 98 percent of total LLM costs across OpenRouter; a harness with strong cache discipline drops per-task cost by 40 to 80 percent while simultaneously improving output quality by shaping what the model sees.
"The harness has shed its critique as a model wrapper; it's a jockey pushing AI performance further than the breeder imagined."
The operational implication: when evaluating model upgrades, run both models through your production harness before attributing score differences to the model. The harness may be responsible for most of the gap.
Sparse mixture-of-experts architecture collapses the frontier accuracy floor to small-model inference cost documents the architecture change collapsing the cost-accuracy frontier. Laguna S 2.1 carries 118 billion total parameters but activates only 8 billion per forward pass, matching the decode speed of a 26-billion-parameter dense model. On OpenRouter, GPT-OSS-120b, released August 2025, captures 36 percent of Claude Opus 4.8's daily volume despite Opus being newer and frontier-class. Tool-call failure rate: Laguna S 2.1 at 20.1 percent versus Gemma 4 26B at 27.1 percent, at comparable decode speed. Dense models activate all parameters for every token. Sparse MoE activates only a fraction, making inference cost scale with active parameters rather than total parameters.
The two cards are complementary. MoE collapses the cost floor for capable models. The harness determines whether a given model's capability translates into production benchmark performance. Together they mean that a team optimizing harness and running sparse MoE models can land better outputs at lower cost than a team on frontier dense models with no harness discipline.
- Tomasz Tunguz, The AI harness now moves coding benchmarks more than the model does. The harness now moves coding benchmarks more than the model; a 25-point swing from harness choice on the same underlying model makes harness selection the faster-moving variable in AI coding capability.
- Tomasz Tunguz, Sparse mixture-of-experts architecture collapses the frontier accuracy floor to small-model inference cost. Sparse MoE architecture achieves frontier accuracy at small-model inference cost; Laguna S 2.1's 8B active parameters from a 118B pool deliver Gemma 4 26B decode speed with lower tool-call failure rates.
Theme 2, Two new attack surfaces from machine-speed AI: lateral movement and document propagation
Simon Willison published on back-to-back days documenting two distinct AI-enabled attack surfaces. Both are new in kind, not just new in instance.
AI-powered attackers win through machine-speed iteration on known vulnerabilities, not novel exploit discovery covers the Hugging Face intrusion timeline. The attack involved approximately 17,600 actions compressed into five days, July 9 to 13, 2026. The techniques were documented vulnerability classes: Jinja2 template injection, container escape, Kubernetes token theft, DNS bypass via monkey-patching, exfiltration via Tailscale VPN. Eight CVEs were credited in JFrog Artifactory 7.161.15. What made the attack exceptional was not the technique novelty but the iteration speed. A human penetration tester runs sequential experiments. An autonomous agent parallelizes hypothesis testing and retries immediately on failure. Willison: "the key difference here was speed."
The detection signal this creates: security monitors should flag unusually high failure rates on a single service within a narrow time window as a possible indicator of agentic probing rather than manual testing. Attacks that complete lateral movement within hours suggest automated iteration on known vulnerability chains.
Prompt injection in document-processing AI can self-replicate across document ecosystems without attacker involvement covers Håkon Måløy's controlled demonstration of self-replicating prompt injection in Copilot for Word. The mechanism: an attacker embeds hidden instructions in a source document. When a target uses that document as source material in Copilot for Word, the model interprets the hidden instructions as user commands, inserts them into the newly generated document, and that document is now infectious. Måløy demonstrated three-generation propagation before manual intervention. No attacker involvement is required after the initial document is released.
The two cards belong together. Willison's machine-speed attack card names the offensive pressure: agentic AI compresses human-scale attack timelines by orders of magnitude. The document worm card names a separate surface: AI-assisted document workflows introduce a new propagation vector that exists independent of network access or code execution. Both surfaces were absent from security threat models two years ago.
- Simon Willison, AI-powered attackers win through machine-speed iteration on known vulnerabilities, not novel exploit discovery. AI-powered attackers win through machine-speed iteration on known vulnerability classes, not novel exploit discovery; 17,600 actions in five days compress what would require weeks of manual testing.
- Simon Willison, Prompt injection in document-processing AI can self-replicate across document ecosystems without attacker involvement. Prompt injection in document-processing AI can self-replicate across document ecosystems without attacker involvement; three-generation propagation was demonstrated in a controlled setting.