Daily AI Engineering Brief

What Happened

The last 24 hours surfaced a structural shift in agent deployment: infrastructure is replacing prompt engineering as the primary security and reliability boundary. Vercel’s scriptc compiler eliminates Node.js runtime dependencies for agent tooling, while MoEngage’s AgentCore Gateway demonstrates permission-scoped tool access at scale. Meanwhile, a cross-framework study revealed MCP tool poisoning achieves 22.9% attack success by injecting malicious content into tool descriptions—no framework validates these inputs. The gap between agent demos and production systems is now defined by secrets management, policy enforcement, and durable execution primitives, not model capabilities.

Why It Matters

Agents are moving from research artifacts to production infrastructure, and the failure modes are different. Prompt injection defenses fail when agents hold long-lived credentials with broad scope. Traditional unit tests cannot catch non-deterministic tool selection in multi-turn conversations. The industry response is clear: treat agents as stateful ML artifacts with versioning, replay, and policy boundaries enforced at the infrastructure layer. This shift affects every team building customer-facing agents, MCP servers, or autonomous workflows. The attack surface is no longer just the prompt—it’s the tool registry, the credential store, and the execution harness.

Key Trends

Tool boundaries are becoming policy boundaries. MoEngage’s deployment of 400 private APIs as agent tools uses Cedar policies and VPC Lattice to filter tool visibility per agent. This solves context window bloat and prevents agents from seeing tools they shouldn’t call. The pattern: generate tool schemas from OpenAPI specs, enforce permissions before the model sees the tool list, and route calls through private networks. No public endpoints, no MCP server sprawl.

MCP’s trust model is broken by design. The tool poisoning study tested 12 frameworks and found zero intentional defenses. Attackers inject malicious instructions into tool descriptions, which MCP carries directly into model context. Of successful attacks, 64.9% triggered attacker tool calls, 23.0% contacted attacker endpoints, and 12.1% exfiltrated secrets. The fix requires validation at the framework layer—sanitizing tool descriptions, enforcing schema constraints, and treating tool metadata as untrusted input.

Secrets management is the new security perimeter. Infrastructure-level controls now define agent security: scope credentials per task, rotate secrets on every spawn, enforce row-level database policies. Recent breaches (OpenAI, WorkOS, GitBook) share a pattern—prompt hardening failed because agents held long-lived credentials with broad scope. The shift: never let an agent prompt touch a long-lived API key. Use ephemeral tokens, database-enforced RLS, and credential vaults that rotate automatically.

Evaluation harnesses are replacing unit tests. Pre-production eval pipelines for contact center agents generate synthetic edge cases, record agent traces, and score them against business rules. Traditional unit tests cannot catch policy violations that emerge from multi-turn conversations or non-deterministic tool selection. The pattern: build a CI/CD pipeline for policy compliance, not prompt engineering. Test tool hallucinations (calling refund APIs outside policy windows), prompt leakage (exposing system instructions), and compliance drift before deployment.

MLOps primitives are being repurposed for agent durability. ZenML’s Kitaru project treats agents as stateful ML artifacts with versioning and replay. If you can version a trained model and replay its training run, you should be able to version an agent’s state and replay its decision path. The gap between agent demos and production is mostly plumbing—durable execution graphs, observability hooks, and artifact stores—and MLOps already solved half of it.

Native compilation eliminates runtime dependencies. Vercel’s scriptc compiler generates native binaries and WASM from TypeScript without Node.js. The scriptc coverage command analyzes how much of an existing codebase compiles, exposing the gap between what agent frameworks assume and what actually runs in production. This matters for MCP servers, edge deployment, and any scenario where you cannot ship a 100MB Node.js runtime. The compiler reports unsupported code at build time with rewrite hints—no runtime surprises.