ROI takes, build-vs-buy framings, and honest reads on AI coding tooling. Written for founders and engineering leaders, not implementers.
· Paul Lukic
In early June 2026, the Miasma worm stopped bothering with npm install. It started committing poisoned .claude/settings.json, .cursor, and .vscode files straight into GitHub repos — including 73 Microsoft repos. Open the repo in Claude Code or Cursor and the malware runs before you type anything. Here's why agent config is now code, and how to treat it that way.
Read postTesla reportedly capped per-engineer AI spend at $200 a week. Uber is tightening limits too. Caps ration the work—cutting context waste is how you keep shipping under one.
On July 13, Claude Fable 5 switches from plan limits to usage credits at $10/$50 per million tokens. The habit that costs you most? Agents that read 20 files when 4 would do.
Cross-tool poisoning means your AI agent is only as secure as the worst MCP server you've connected. Here's the risk, and how to shrink it.
Building in-house code graphs costs $250k+ and 6 months. Adopting Coograph cuts AI spend 80% while freeing engineers to ship product.
Claude Code's weekly cap and Copilot's new per-credit meter punish the same thing: agents that read 20 files when 4 would do. The fix isn't a bigger plan—it's a smaller context.
An MCP server standardizes how AI agents read your codebase. On a representative task, graph-based context cut tokens ~80% and tool calls ~4x — here's why that matters and how to think about build vs. buy.
The hidden Claude Code slash commands experienced terminal devs actually use daily — /statusline, !, @, /add-dir, /btw, /branch — what each saves, where /add-dir breaks at scale, and the Codex CLI gotcha that ruins muscle memory.
GitHub Copilot switches every paid plan to usage-based AI Credits on 1 June 2026. Token waste that was hidden inside a flat $10/month bill now eats your credit balance in real time. Here's the math, and how a code-graph cuts it by ~80%.
Coograph's skills and slash commands used to live under three different prefixes. As of today, every shipped command starts with /coograph-. Here's why, what changed, and how existing projects pick it up automatically.
A single rolling audit log of every shell command your AI coding agent ran is good. A per-session log is better. Here's why scope matters, what changed in Coograph this week, and how to roll the same pattern into your own setup.
On 11 May 2026, 84 malicious versions of 42 @tanstack/* packages hit npm and started stealing AWS, GCP, Kubernetes, Vault, GitHub, and SSH credentials. If your AI coding agent ran npm install during that window, you may never know. Here's why agent command logging is now non-negotiable.
Most AI coding agents pull too much code into their context window, inflating token costs by 5x. Here's what that costs and how to fix it.