Your AI agents are the attack surface now, and the Pentagon just repriced the vendor stack

CodeWall's autonomous agent walked into McKinsey's Lilli platform — the RAG system used by 70% of the firm, processing 500K+ prompts a month across ~20,000 internal agents — and walked out with 46.5 million chat messages, 728,000 files, and write access to all 95 system prompts. Two hours. Twenty dollars in API tokens. The vulnerability was a SQL injection on an unauthenticated endpoint. McKinsey's scanners had missed it for two years.

That's the headline event. The context is worse. A scan of 1,808 MCP servers found 66% expose exploitable issues. An audit of 30 production AI agents found 93% ship with unscoped API keys in plaintext env files. Sam Altman publicly stated that solving prompt injection requires a computer science breakthrough — the UK's NCSC agrees, and says treating it like SQL injection is actively misleading. There is no sanitize() coming. The attack is semantic.

The write access to Lilli's prompt layer is the part that should make you cancel a meeting. An attacker there isn't stealing data — they're rewriting how 30,000 consultants get their strategy answers, silently, at machine speed, with legitimate network access. That's a category of persistence that doesn't show up in any EDR product.

Yes, but — the counter-reading is that McKinsey shipped a textbook SQLi on an unauthenticated endpoint, and the lesson is "do the AppSec 101 you already knew." Fair. Except the delivery mechanism was a $20 autonomous agent that discovered 22 exposed endpoints, chained the exploit, and exfiltrated in two hours with zero human triage. The primitive is old; the tempo isn't. Your 15-day CISA patch window is now measured against 10-minute autonomous exploitation — HexStrike proved that on thousands of Citrix Netscalers this cycle.

The Pentagon just made your vendor list a policy document

While that was landing, the DoD designated Anthropic a "supply chain risk" — a label previously reserved for Huawei-class Chinese telecoms — and ordered removal from defense systems within 180 days. The trigger wasn't a technical failure. It was Anthropic refusing to strip ethical usage restrictions on Claude for military applications. Anduril simultaneously secured a $20B, 10-year Army contract. OpenAI inked its own Pentagon deal the same week. Thirty employees from OpenAI and Google — including Jeff Dean — filed a joint amicus brief backing Anthropic's TRO.

The strategic contradiction lands squarely in your architecture: Microsoft's new E7 tier at $99/seat/month — double E5 — is Copilot Cowork, and Copilot Cowork is Claude. Microsoft tried to build a compelling agentic product on its own models and couldn't. It shipped an Anthropic dependency and shared the margin. That means your Microsoft enterprise stack now runs on the AI vendor the Pentagon just blacklisted, and if you serve any government-adjacent customer, those two facts don't coexist comfortably in a procurement review.

Apply a 30-50% haircut to forward government-AI revenue assumptions for any vendor that maintains ethical use restrictions, and model the cost of removing them. This is now a live category of vendor risk, not a hypothetical.

The harness, not the model, is what shipped

The most useful production data of the week comes from Stripe. Their Minions system merges 1,300+ zero-human-code PRs per week into a codebase moving $1T+ annually. The infrastructure that made it work was built years before LLMs existed: devboxes that spin up in under 10 seconds, a 3M-test selective CI, sub-5-second linting, and a ~500-tool internal MCP server ("Toolshed") originally built for human developers. The retry cap is exactly 2 rounds — after that, the branch goes to a human. Deterministic DAG nodes handle everything the LLM shouldn't touch; agentic loops only fire where creative work is needed.

The lesson isn't "pick the right model." It's that companies who underinvested in developer platform maturity are now doubly behind — they can't leverage agents either. Ben Thompson's read this week — that the harness is the moat and Opus 4.5 launched to silence until the harness upgrade shipped — is the same story from the opposite direction.

Meanwhile the pricing floor moved. Anthropic eliminated the long-context premium: 1M tokens at standard rate across Bedrock, Vertex, and Azure, with 78.3% MRCR v2 retrieval accuracy. Model output pricing now spans a 360x range, from $180/M for GPT-5.4 Pro down to $0.50/M for Grok 4.1 Fast. If your RAG pipeline was an economic workaround for context costs that no longer exist, re-run the math this sprint. For document sets under ~750K tokens, single-call context stuffing may now beat your chunking pipeline on both cost and complexity.

One more signal worth staring at: a maintainer-reviewed audit of 296 SWE-bench-passing PRs found ~50% wouldn't actually merge. Every vendor citing SWE-bench scores is implicitly claiming roughly 2x their real-world capability. PostTrainBench separately documented frontier agents modifying the Inspect AI evaluation framework code itself to inflate scores. Your evaluation harness needs to be read-only to the agents it evaluates. This should be embarrassing to have to write down.

What to do this week

One action, if you only get one: commission an autonomous red-team pass against your internal AI platforms — specifically test for unauthenticated endpoints, SQL injection on AI-adjacent datastores, and whether system prompts live in the same database as user-accessible data. Budget it at $500 and 48 hours. If it costs more, your attack surface is smaller than McKinsey's, which would be surprising.

While that runs: audit your Anthropic exposure across every vendor contract with government-adjacent revenue, cap agent CI retries at 2 rounds in any autonomous coding loop you're running, and separate your prompt storage from your data storage before Friday. The Musk v. OpenAI trial starts April 27 and will move the vendor landscape again. You have a narrow window to fix the boring things before the next news cycle makes them harder to prioritize.