There is a lot of breathless writing in this industry about how AI is a great leveller, a tool that erases the gap between the expert and the beginner. Sean Goedecke's post LLMs reward expertise — which was Hacker News's top story this week — argues the opposite, and I think he's right. The quality of what you get back from a model scales with the quality of what you bring to the conversation. The gap between an expert and a novice wielding the same model is wider now, not narrower. That's good news for developers who put the time in, and uncomfortable news for the people selling "anyone can build AI apps now."

Also this fortnight: the most detailed account yet of a real AI agent escaping its evaluation sandbox and running a multi-stage intrusion against a production system. The technical write-up from the HuggingFace team is worth reading slowly.

In this edition of AI++ we take a look at MCP 2.0 and what going stateless means for your servers, dig into the growing gap between agent demos and production security, and find out whether manually retyping your AI-generated code will save your soul.

Erick Ramirez | Apache Cassandra committer & Developer Advocate at IBM/DataStax

🛠️ Building with AI, Agents & MCP

MCP goes stateless

The Model Context Protocol got its most significant update since launch. The MCP 2026-07-28 specification moves the transport to a stateless core: no more session initialisation round-trip, no more Mcp-Session-Id header, just a single HTTP request per tool call. Anthropic has already written up what this means for Claude products, covering the new hardened OAuth and standardised extensions that come with it. If you maintain an MCP server, there are migration steps you'll want to read before the rollout completes.

Simon Willison's piece on the stateless spec is the best technical explainer of what actually changed. He built three new tools in the week of the launch, including mcp-explorer and a datasette-mcp plugin, and he includes a clean before/after comparison of the HTTP flow. His broader observation is interesting too: he'd largely moved away from MCP once Skills made a shell-and-curl setup look more flexible, but the stateless transport brings the protocol back to a place where small models running locally can drive it reliably. It's also much easier to audit. Worth bookmarking if you're thinking about where MCP fits in your stack right now.

WebMCP in browsers is advancing alongside this. A practical write-up on WebMCP in Chrome 101 covers how to use the integration today, including what it can and can't do yet.

Context engineering and cost

Anthropic published the new rules of context engineering for Claude 5 generation models and the headline finding is that they removed over 80% of Claude Code's system prompt when moving to their more advanced models. The constraints that helped Sonnet 4 hurt Opus 5. The lesson is familiar but the data behind it is new: adding context to steer a weaker model can actively degrade a stronger one's performance. If you're building agents that you expect to work across multiple capability tiers, you probably need separate context strategies for each.

The cost side of context engineering is getting more attention. LangChain's post Your coding agent bill doubled. Here's how to fix it. traces the specific patterns that cause token spend to spiral in Claude Code, Cursor, and Codex, and shows how to use LangSmith tracing to find and cap the waste. Worth reading alongside the new LangSmith LLM Gateway, which adds runtime spend limits, PII redaction, and trace continuity across providers. Martin Fowler's team contributed something complementary: refactoring an AI-generated codebase cut subsequent token consumption by 83% and improved navigation efficiency. The "ship the slop and clean it up later" argument just got harder to make.

Agent security

In late July, a post appeared on the HuggingFace blog that I think every team running agents in production should read. Anatomy of a Frontier Lab Agent Intrusion is a detailed technical timeline of an AI agent that escaped an OpenAI evaluation sandbox and ran a sustained, multi-stage intrusion against HuggingFace infrastructure: 4.5 days, node impersonation, forged identity tokens, supply-chain write access, and command-and-control staged on public web services. The team published it specifically because the technique matters more than the incident. OpenAI subsequently published their own account of the cyber evaluation incidents and outlined new safeguards. Read both.

The community thread Everyone's agent demo works. The problem starts the day you give it write access. on r/mcp is a good practical complement. Read-only agents are easy to reason about. The moment an agent can write, delete, or commit, the threat surface changes entirely. The post includes a concrete checklist of what breaks first and what to gate. If your agents are still in read-only mode for this reason, you're not being slow, you're being sensible.

On the tooling side, Verity is an Apache-2.0 memory layer for multi-tenant agents that enforces ACLs at retrieval time, inheriting permissions directly from Google Workspace, SharePoint, and Salesforce. Cross-tenant leaks in RAG are a real enterprise blocker and this is one of the more credible open-source approaches to solving them.

Benchmarking what agents can actually do

Two posts from Dan Horthangski at HumanLayer are worth reading together. Why Software Factories Fail argues that harness engineering is necessary but not sufficient: the co-ordination and feedback-loop problems in multi-agent coding are the part that actually breaks at scale, not the prompts. The companion piece Benchmarking Opus 5 on SlopCodeBench tests frontier models on real-world messy code rather than competitive programming problems, and the results are sobering.

The calibration piece of the period is Owen Bryant's 2x, not 10x: coding with LLMs in 2026. The productivity gain is real but it plateaus at around 2× for most engineers, and the bottleneck is no longer generation speed. It's task decomposition and feedback loops. The most polarising take came from Ankur Sethi: prevent cognitive debt by manually retyping LLM-generated code. The argument is that retyping forces you to actually understand what the model wrote. I'm not going to tell you to retype everything, but the 436-comment HN thread surfaced genuine workflows where it makes sense.

🧠 New models

• ​LFM2.5-2.6B from Liquid AI: tool calling, 128K context, 30 tok/s on a phone. Built for agentic edge workloads. The smallest credible tool-calling model for embedded agents right now.
• ​Qwen3.8-Max from Alibaba: 2.4 trillion parameters, strong coding benchmarks, and open weights on the way. The 27B dense variant is immediately usable for self-hosted pipelines. Latent Space's coverage sums it up: Qwen is so back.
• ​Ling-3.0-flash from Ant Group's inclusionAI: 124B total, 5.1B active parameters, MIT licence, ungated on HuggingFace. Cheapest-to-run MoE executor yet. Benchmarks need independent verification, but the licence terms make it worth testing.
• ​DeepSeek-V4-Flash-0731 — Simon Willison's first-look confirms it's fast enough and cheap enough to become the default executor in pipelines that need speed over depth.
• ​GPT-5.6 price cuts of 20–80% on Luna and Terra tiers. The Latent Space coverage frames it more starkly: the cost of GPT-5.4 intelligence dropped 13× in four months. Recalculate your cost model.
• ​llama.cpp MoE expert caching: a PR that tracks which experts are used most often and keeps them hot on the GPU. Reported throughput jump is 33 to 56 tok/s with 8GB VRAM. Free win for anyone running MoE models locally.

🗞️ Other news

• Researchers at Quanta Magazine ask Is AI reasoning right for the wrong reasons? Mechanistic interpretability work suggests some reasoning traces are post-hoc rationalisation, not actual computation paths. Relevant if you're trusting chain-of-thought in production.
• The team at Manifest wrote a post-mortem: Everyone is building LLM routers, we deprecated ours. Their router added latency and complexity without a meaningful quality lift once the models improved. Saves you the experiment.
• Anthropic shared ten advances in mathematics and theoretical computer science made by GPT-5.6 Sol on long-standing open problems. The results matter less than the signal about where frontier reasoning is heading.
• Cursor removed cost information from the usage page and CSV export, to significant user frustration. 336 upvotes on HN and a pointed timing: the same week Anthropic published a cost visibility guide and LangChain wrote up how to fix spiralling agent bills.
• Wealthfront's engineering team published Experiments with AI Code Review, a multi-year production study. The short version: it works, but the skill level of the reviewer changes the outcome significantly. More ammunition for the expertise argument.
• Leo Aido on frame selection for video LLMs: fixed-rate sampling is wrong. Content-aware adaptive selection is what works. Directly applicable if you're building multimodal RAG pipelines.
• ​You Cannot Own a Falling Floor: inference costs will be near-free at any fixed capability level within two years. The post has a concrete model for what this means for API-dependent product strategies.

🧑‍💻 Code & Libraries

• ​LLM 0.32 is a CLI tool for running LLM prompts with support for reasoning traces, server-side provider tools, and an OpenAI-compatible endpoint runner
• ​qm is a multiplayer agent harness for co-ordinating multiple coding agents on the same codebase with human oversight
• ​Verity is an Apache-2.0 permission-aware memory layer for multi-tenant agents that inherits ACLs from Google Workspace, SharePoint, and Salesforce
• ​smevals is a lightweight framework for running evals against AI models of any size with a composable task structure
• ​ReviewBench is a benchmark for evaluating code review agents against real PR feedback from trusted engineers
• ​LangSmith Align Evals is a feature for calibrating LLM-as-judge evaluators against your own team's human ratings

🔦 Langflow Spotlight

​Langflow 1.11 is a big release. The headline addition is Human-in-the-Loop checkpoints: you can now wire approval gates into any agentic flow without building custom polling logic. Agents pause, surface a decision to a human, and continue only when cleared. It also ships native A2A protocol support so your Langflow agents can talk directly to other agents without a custom integration layer. AG-UI streaming is now available for the Workflow API, giving you real-time updates as the flow runs. If you've been waiting for a release that makes Langflow usable in workflows where a human stays in the loop, this is it. The full release notes are worth reading.

🗓️ Events

I am speaking at IBM TechXchange 2026 conference in Atlanta GA, October 26-29, the hands-on conference where developers, engineers, scientists, and researchers build real-world skills across AI Applications, Data Management, Hybrid Cloud Management, Infrastructure, and Security & Governance. From hands-on labs and workshops to technical certifications, roadmap previews, and direct access to product experts, this is where practitioners come to test-real-world approaches and advance their expertise.

This year, HashiConf is integrated with the IBM TechXchange conference, adding deep expertise in infrastructure automation and cloud provisioning along with its strong practitioner community that elevates and expands the hands-on learning experience. IDUG North America and the COMMON User Group will also be co-located onsite, creating one of the largest gatherings of technical user communities in one place.

Build with purpose. Deets and rego @ https://ibm.biz/txc-2026.