# Field notes · Asharaf Ali Field notes on enterprise AI architecture, sovereign deployment, and the trade-offs of building Generative AI inside regulated walls. - [The gate votes on what it sees, not what runs](https://www.asharafali.com/notes/typesafe-tool-gate-ordering/) · Sep 22, 2026 LangChain is adding a classifier that can veto an agent's tool calls. The first bug filed against it teaches more about agent security than the launch does. - [Fork the workers, isolate the judges](https://www.asharafali.com/notes/forked-context-subagents/) · Sep 15, 2026 Every subagent that starts from a blank context is a cost and safety decision, not a neutral default. LangChain just made it a one word flag per subagent. The question is which word for which role. - [The scope line is a security control](https://www.asharafali.com/notes/gpt6-astra-critical-cyber/) · Sep 08, 2026 OpenAI just rated a model Critical for cyber and shipped it anyway. The useful part of the GPT-6 Astra system card is buried in the eval tables, not the headline. - [One drafter, two engines](https://www.asharafali.com/notes/dflash2-cross-engine/) · Sep 03, 2026 The same speculative decoder landed in vLLM and llama.cpp in the same week. When two engines that agree on almost nothing both merge it, I read the PRs. - [Your model weights should outlive the process](https://www.asharafali.com/notes/sglang-weight-cache-daemon/) · Aug 25, 2026 Your model weights should outlive the process that serves them. SGLang shipped that idea on August 21. - [Where do the pixels actually go?](https://www.asharafali.com/notes/multimodal-as-tool-boundary/) · Aug 12, 2026 "Multimodal-native" has quietly come to mean a tool call rather than a model property. Qwen's new plugin repo is honest about that; a lot of the commentary around it is not. - [Prefill and decode are two different workloads](https://www.asharafali.com/notes/disaggregated-prefill-decode/) · Jul 29, 2026 Prefill and decode are two different workloads. On July 23 the hardware stopped pretending otherwise. - [MCP just deleted its session handshake](https://www.asharafali.com/notes/mcp-stateless-spec/) · Jul 21, 2026 MCP just deleted its session handshake. That one change does more for enterprise agent deployment than any model release this month. - [The attacker went agentic before you did](https://www.asharafali.com/notes/jadepuffer-agentic-ransomware/) · Jul 14, 2026 The first fully agentic ransomware just ran. It used the same primitives you build defensive agents on. - [Route by task, not by loyalty](https://www.asharafali.com/notes/capability-routing-sonnet5/) · Jun 30, 2026 The biggest cost lever in an agent stack right now is a router that knows when not to call the frontier model. - [Everyone quantizes the weights and forgets the KV cache](https://www.asharafali.com/notes/kv-cache-quantization/) · Jun 23, 2026 Everyone quantizes the weights and forgets the KV cache. On long context, that cache is what blows your VRAM budget. - [Open weights just hit the frontier. Read the token bill.](https://www.asharafali.com/notes/glm-5-2-open-weight-frontier/) · Jun 16, 2026 An open-weight model just matched the frontier on long-horizon agentic coding and MCP tool use. If you run air-gapped, the build-vs-buy math quietly flipped this week. - [Prompt injection is permanent. Design around it.](https://www.asharafali.com/notes/prompt-injection-permanent/) · Jun 11, 2026 Prompt injection isn't a bug you'll patch. It's a property of how the model reads, and OWASP's new report stops pretending otherwise. - [Your agent's tools are your new perimeter](https://www.asharafali.com/notes/mcp-server-security/) · Jun 03, 2026 Every MCP tool you wire into an agent is a new unauthenticated door into your network — and the data says most teams forgot the lock. - [Gemma 4 12B deleted the encoders](https://www.asharafali.com/notes/gemma4-encoder-free/) · Jun 03, 2026 Gemma 4 12B just deleted the vision and audio encoders. Most multimodal models still bolt on three separate networks. Google ships one weight space. - [The model got the headline. The pattern is the product.](https://www.asharafali.com/notes/multi-agent-fan-out-orchestration/) · May 28, 2026 The headline last week was a new model. The lesson was an architecture. - [Subquadratic sparse attention finally shipped](https://www.asharafali.com/notes/subquadratic-sparse-attention/) · May 2026 Your next long-context model probably won't run quadratic attention. - [The LLM eval harness rubric](https://www.asharafali.com/notes/eval-harness-rubric/) · May 2026 Most production LLM eval harnesses ship with one column: accuracy. That's a vibes check, not an eval. - [Your agent doesn't have a JSON problem. It has a decoding problem.](https://www.asharafali.com/notes/grammar-gated-routing/) · May 2026 Your agent doesn't have a JSON problem. It has a decoding problem. - [TGI went into maintenance mode. Here's the on-prem 70B picture now.](https://www.asharafali.com/notes/on-prem-70b-numbers/) · Apr 2026 HuggingFace quietly put Text Generation Inference into maintenance mode in December 2025. - [The tools are the product](https://www.asharafali.com/notes/pentest-agent/) · Apr 2026 Autonomous agents touching production is a terrible idea.