The Edition Where the Layer Below the Model Became the News

That's the share of Anthropic's internal queries now running via Claude — not via SQL. And the company that built the model decided, quietly, that traditional BI is over.

Palana is Grab's answer. A Kubernetes-native execution platform now running hundreds of agents in production — from remote development environments to Slack automations, Hermes agents and OpenClaw workers. The design starts from a radical premise: treat the agent as hostile by default. [ref: grab-builds-secure-agentic-ai-]

And it deserves to be. When an agent can execute arbitrary tools, call external APIs and write code, the threat model is completely different from a stateless service. Grab explicitly listed the threats in scope: prompt injection, logic hijacking, dependency compromise, objective escalation, credential exposure. This isn't paranoia — it's serious threat modeling for teams running fintech in production.

Each agent runs in its own Kubernetes namespace, with restrictive RBAC, resource quotas, custom network policies and isolated service accounts. But the most elegant detail is credential handling. Version control tokens, model gateway API keys — they live in HashiCorp Vault and never reach the agent container. The agent receives only abstract placeholders. When it initiates an external call, a secure proxy intercepts, validates the destination and swaps the placeholder for the real credential. The secret never touches execution memory or container logs. [ref: grab-builds-secure-agentic-ai-]

The kill switch follows the same philosophy. Asking an agent to stop is a feature — not a security control. A compromised agent cannot be trusted to shut itself down. Palana's kill switches operate in the control plane: network policies are disabled directly outside the runtime, and an external reaper handles idle shutdowns without touching the agent process.

That's exactly the saga rollback question. Cloudflare delivered an elegant answer on June 25: you declare compensation logic directly inside the step definition. Not in the catch block — in the step itself. [ref: cloudflares-saga-rollback-patt]

The catch block accumulates state. As the workflow evolves, compensation code drifts out of sync with the forward path. With Cloudflare's saga pattern, the rollback lives alongside the operation it needs to undo. You pass an options object to step.do() with the rollback function. It receives the forward step's output — but must handle output equal to undefined, because a payment provider might capture a charge before confirmation reaches Workflows. The step failed, but the transaction already processed. The rollback still runs.

It gets subtle. Sequential steps rollback in reverse order — straightforward. Parallel steps complete in unpredictable order, so Cloudflare sorts by reverse start time, not completion time. This makes the sequence deterministic regardless of which branch finished first. Critical when two parallel steps write to shared resources that need to be undone in a specific sequence.

The API takes four arguments: model factory, tools list, special instructions and cuga_folder path. You call await agent.invoke() and the harness handles the planning loop, execution, tool dispatch, state tracking and a reflection step that catches bad tool calls and replans without surfacing the failure to the user. In a 20-step task, most harnesses lose track of intermediate results. CUGA keeps them in a variable manager at the orchestration layer. [ref: cuga-20-production-agentic-app]

In production that matters a lot. Most harnesses bake the cost-performance tradeoff into agent code. Changing it requires rewriting. In CUGA it's a key in settings.toml. The hosted gallery runs on gpt-oss-120b via Groq — not on a frontier API — because open-weight models cost 80 to 90 percent less than closed alternatives, according to IBM itself.

Four isolation tiers: process isolation for latency-sensitive, lightweight workloads, session isolation that separates the agent from interactive desktop and user clipboard, micro-VMs via Hyper-V for higher-risk code, and Linux containers via WSL for ML toolchains. GitHub Copilot CLI already uses the process isolation tier to restrict dynamically generated code. [ref: windows-platform-security-and-]

Outbound network filtering doesn't work in the current version. That's a serious gap — agent compromise typically manifests as data exfiltration to attacker endpoints. Microsoft's own documentation states that MXC profiles should not yet be treated as security boundaries. Teams deploying agents in regulated environments need to add explicit network controls on top of MXC, and treat the SDK as a first layer of control, not as a security boundary.

The data comes from TrendForce, reported by Tom's Hardware. And the cause has nothing nostalgic about it. Samsung, SK Hynix and Micron rerouted wafer capacity from DDR to HBM and server DRAM to feed AI infrastructure. Micron stated a conversion ratio of three to one: each HBM ramp slot retired three DDR5 slots. As server DRAM absorbed production from the fabs, DDR4 tightened. OEMs and ODMs began specifying DDR3. Some DDR3 designs were reworked to use DDR2. The cascade reached the bottom of the legacy memory stack. [ref: ai-chip-shortage-ripples-backw]

That says everything about the current state of the market. The normal price hierarchy broke. Mediatek CEO Rick Tsai put it directly at ISSCC in February: memory represents roughly 50 percent of the total BOM in XPU development. HP's CFO reported in early 2026 that memory and storage climbed from 15 to 18 percent of PC BOM to roughly 35 percent.

Significant new DRAM capacity doesn't arrive before the end of 2027 at best. Micron's new Idaho fab won't be operational until 2027. For any inference stack depending on long-lived network equipment, embedded controllers or edge hardware with fixed memory specs: the capex impact is already arriving. Audit BOM now, not at contract renewal.

The mixture is 75 percent water and 25 percent propylene glycol flowing through cold plates directly over each processor. The liquid enters at 45 degrees and exits at roughly 55 degrees, having pulled the heat load from the die surface. Because thermal work happens at the source, the ambient air around it doesn't need to be cold. Ambient temperature decouples from the server thermals, eliminating the hot-aisle/cold-aisle layout required in air-cooled facilities. Heat goes to external dry coolers — large radiator arrays — where it's rejected to outside air without water evaporation loss. [ref: nvidias-45c-breakthrough-cuts-]

Conventional data centers with cooling towers consume roughly 2.6 million gallons of water per megawatt per year. The DSX design cuts that to nearly zero — up to 100% reduction — in climates where outside air can do the heat rejection work without mechanical chillers. Ali Heydari, director of data center cooling and infrastructure at NVIDIA:

Chillers are needed for only about 1% of the year in most geographies. For a 50-megawatt operator, the combined savings from cooling energy and water exceed four million dollars per year. Rubin generation is 100% liquid-cooled — every chip, every network component, zero fans anywhere in the system. Which means any cloud provider building on it has no choice: the transition to liquid cooling is mandatory.

In regions where outside air temperature is persistently high, the 1% chiller use estimate extends. Operators in warm climates need to model local wet-bulb profiles before removing mechanical cooling infrastructure. The DSX reference design is a blueprint, not a universal guarantee.

The framework runs models from 3 billion to 70 billion parameters entirely on device, on iPhone, iPad, Mac and Apple Vision Pro, with zero server dependencies and zero cost per token. It's the same runtime Apple uses internally for Apple Intelligence, now exposed to third-party developers. The Swift API is memory-safe and zero-copy. Ahead-of-time compilation compiles models once and loads them nearly instantly on subsequent runs. [ref: apple-core-ai-framework-pushes]

850 million parameters, symmetric int4 quantization per channel, 3 gigabytes reduced to 430 megabytes — 86% size reduction with "minimal accuracy loss" according to Apple's docs. Teams should validate that claim on their own eval sets before going to production. Apple's AFM Core Advanced — their own foundation model — is a sparse MoE with 20 billion parameters that activates only 1 to 4 billion per inference, following a DeepSeek-style architecture. And the ceiling demo: a 1 trillion-parameter model — Kimi 2.6 — running distributed across four Mac Studios via macOS Tahoe 26.2 network. Proof of concept, not production configuration. But it signals where Apple wants to go with multi-device orchestration.

One command. hf jobs run. GPU a10g-large, one dollar and fifty cents per hour, billed per minute of hardware usage. The server speaks the OpenAI Chat Completions API, secured by HF token — private by default. The most ambitious demo: Qwen 3.5-122B on a dual-H200 flavor with tensor-parallel-size 2. The standard context window for Qwen 3.5-122B is 256 thousand tokens, which exhausts VRAM in vLLM's default configurations — you need to cap max-model-len and max-num-seqs before scaling up the flavor. [ref: hugging-face-and-vllm-partner-]

And the takeaway from this entire block: inference capex is splitting into two extremes. Cheap edge — a dollar fifty per hour or zero cost on Apple device. Ultra-dense cluster — Rubin 100% liquid, rack at density limit. And legacy memory is eating margin in the middle, with no capacity relief until 2027.

A raw LLM pointed at a data warehouse answers analytics questions correctly 21% of the time. That's the starting number. The Anthropic team identified three failure classes. Concept-entity ambiguity: the term "revenue" maps to 40 plausible tables in their warehouse — the word itself doesn't resolve the data. Staleness: metric definitions change daily, and docs that were 95% accurate at launch fell to 65% in a single month when maintenance got deprioritized. And retrieval failure: the right data exists, but in a warehouse with a million fields the agent walks past it. [ref: anthropics-95-claude-analytics]

Four layers: data foundations with dimensional modeling and shift-left testing; a sources-of-truth layer with canonical metric definitions and a knowledge graph of the company indexing docs, roadmaps and decision logs; a skills layer — markdown folders that Claude reads on demand, with roughly 30 reference files per domain describing tables, columns, joins and gotchas before any SQL is written; and a validation layer with eval suites in CI and adversarial review of each response.

Six percent accuracy gain. 32 percent more tokens. 72 percent latency increase. That's the real cost of each percentage point above 95%. And the most critical risk isn't the model — it's skill decay. Accuracy fell from 95% to 65% in a single month when skill files got out of sync with schema changes. The solution: put the markdown skill files in the same repo as your dbt transformation models. The PR that changes a model is the same PR that updates the skill. Ninety percent of data model PRs now include a skill change in the same diff. [ref: anthropics-95-claude-analytics]

Not automatically. Anthropic is describing what worked with their own model, their own data, and a team that treated skill maintenance as continuous engineering discipline. A 5% error is unacceptable for business-critical reporting in many contexts — financial analytics, compliance, SLA metrics. This isn't a blueprint you fork and deploy.

Meta published a case study of the asset classification infrastructure that feeds their privacy stack. The centerline is direct.

Meta uses LLMs at the edges — cold-start classification, semantic interpretation from code and documentation context, policy reasoning for cases that don't match known patterns. Deterministic rules handle the production volume because they're low-latency, repeatable and auditable. And as patterns stabilize, the LLM's decisions are distilled into human-approved versioned rules. [ref: privacy-aware-infrastructure-i]

Before calling an LLM, the system assembles an "evidence brief" — supporting signals, contradicting signals, metadata provenance and code resolution. Code resolution tracks the actual runtime source of a field value. If the `age` field in a cache pipeline comes from a TTL config object, not a user profile, that tracking eliminates an entire class of false positives. Hours of prompt optimization produced marginal gains when the model reasoned about raw, noisy fields. The fix was structural — it wasn't a prompt problem.

Adjudication of reference labels and approval of rule promotions. A new rule that expands or contracts data protection scope requires human approval. The rest is automatic. It's the opposite of "human-in-the-loop everywhere" — it's concentrating accountability where the consequence is real.

Databricks and NVIDIA open-sourced Genesis Workbench: a modular reference stack that connects GPU-accelerated biology models directly to the Databricks platform for computational drug discovery. Genomics, single-cell analysis, large-molecule design, small-molecule docking and fine-tuning — each as an independent, separately deployable module. A React point-and-click UI so bench scientists can run complete pipelines without writing code. A single script to deploy the entire environment. [ref: genesis-workbench-databricks-n]

Binding predictions with 94% accuracy in 30 minutes. Compare that to 48 hours with roughly 50% accuracy using standard vendor software. Candidate quality improved from 25% to 50%. Lead identification accelerated up to 50%. Cell line development — normally six to eight months — fell to 2.5 months using NVIDIA VISTA-2D and Geneformer on BioNeMo. These are numbers from one specific configuration at one specific site — but they establish the ceiling of what the stack achieves when data governance is tight.

Sequences, compound libraries and assay results never leave the governed perimeter. Unity Catalog handles access control and audit. MLflow tracks every model artifact. GPU Model Serving runs inference inside the client's own workspace. Adopting a newer model — GenMol, Protein-Complex — is a deployment step, not a rewrite, because each model is an independent submodule in the same registry and serving substrate. And Genesis Workbench exposes everything as MCP tools — any MCP-compatible client, including Claude, can call the models and workflows as tools.

The answer that emerges isn't "LLM or no LLM." It's a triage. LLMs where semantic ambiguity is the real problem and structured context doesn't solve it alone. Deterministic rules where latency, auditability and repeatability are non-negotiable. And a clear path to distill LLM decisions into rules as patterns stabilize — with human approval on promotions that change protection scope. Genesis Workbench is the answer for regulated verticals that need the model but can't send proprietary data outside the perimeter. Meta is the answer for scale. Anthropic is the blueprint for teams willing to treat context maintenance as permanent engineering discipline, not initial configuration.