The article argues that large language models lack the structured data, integrity constraints, and deterministic processes that business software provides. Instead of replacing software, LLMs will plug into existing systems via protocols like MCP, serving as a flexible front end while databases and rule engines remain the backbone.

• Structured software (e.g., CRMs) enforces data integrity and constraints—like requiring a company record before logging a deal—that free-form LLM chat can't guarantee or replicate reliably.
• The Air Canada chatbot case, where misleading bereavement fare info led to tribunal costs, shows the real risk of letting LLMs act without deterministic guardrails.
• Protocols like MCP let LLMs plug into existing systems (Salesforce, Jira) to query and act within enforced schemas/permissions, rather than replacing those systems outright.
• The likely future is LLMs as a flexible front end sitting behind deterministic software and databases, not a wholesale replacement of traditional business systems.

Researchers at Tenet Security showed how anyone with a public Sentry DSN can inject a fake error report that coding agents like Claude Code, Cursor, and Codex will treat as a fix instruction. The agent fetches the malicious payload via the Model Context Protocol and runs arbitrary commands on the developer’s machine, exposing environment secrets and credentials. Sentry won’t close the write endpoint, leaving the fix to agent runtimes to filter untrusted data.

• A public write-only Sentry DSN lets attackers inject fake error reports that coding agents (Claude Code, Cursor, Codex) blindly treat as trusted fix instructions, leading to arbitrary code execution on developer machines.
• Tenet's tests across 2,388 organizations (including 71 Tranco top-1M sites) got an 85% success rate with 100+ confirmed code executions, hitting even a developer at a $250B Fortune 100 firm.
• The attack is invisible to traditional defenses (firewalls, EDR, WAFs, IAM) since it never touches victim infrastructure or needs passwords, and prompt-level "ignore untrusted data" instructions failed to stop it.
• Sentry isn't closing the vulnerable write endpoint, so the only real fix is runtime-level gating in the agent itself to sandbox or reject commands sourced from external/unauthenticated data.

Stash is an open-source service that adds continuous memory to any AI model by storing and organizing session data in PostgreSQL with pgvector. It transforms raw conversations into structured facts, relationships, and patterns, so agents recall preferences, avoid repeated errors, and track long-term goals. Integration via MCP makes it model-agnostic, self-hostable, and free of vendor lock-in.

• Stash gives AI persistent memory by storing conversations in PostgreSQL/pgvector and running a 9-stage pipeline that turns raw episodes into facts, relationships, causal links, patterns, contradictions, goals, and failure detection
• Unlike RAG's static document search, Stash learns automatically from conversations and outcomes without manual tagging, improving over time
• It's model-agnostic and vendor-lock-in-free via MCP integration, working with Claude, GPT, or local models
• Setup requires just three commands (clone repo, configure .env, docker compose up), with self-hosting keeping data local

Stash lets your AI agent keep memory across conversations, so you don’t have to repeat context every time. It’s an open-source, self-hosted layer that uses Postgres, pgvector, and an eight-stage consolidation pipeline to turn raw observations into structured knowledge. It plugs into any MCP-compatible agent with a single Docker command.

• Stash gives AI agents persistent memory across sessions using Postgres + pgvector, run via a self-hosted Docker stack (no cloud dependency).
• A background service runs an eight-stage consolidation pipeline (fact extraction, relationship mapping, causal links, goal tracking, failure patterns, hypothesis checks, confidence decay) that only processes new entries, keeping the knowledge base efficient as it grows.
• It works with any MCP-compatible agent (OpenAI Agents, Claude Desktop, Continue, Cursor, Windsurf, Ollama, OpenRouter) via a single Docker command setup.
• It's open source (Apache 2.0), letting users customize consolidation rules, swap models, or plug in custom retrieval logic.

The article argues that the Model Context Protocol (MCP) offers a more effective way to connect large language models (LLMs) to services compared to Skills. While Skills can help with knowledge transfer, they create unnecessary complications, especially when they require command line interfaces (CLIs). The author advocates for using MCP to streamline service integration and improve user experience.

• MCP abstracts away implementation details (no local installs, auth is simpler, updates happen seamlessly), while Skills often push that complexity onto the user
• Skills requiring CLI execution break down for LLMs like ChatGPT that can't run command-line tools
• Skills introduce deployment headaches, secret management issues, and context bloat that MCP avoids
• Skills should be reserved for knowledge transfer, while MCP should handle actual service/API execution