The Engineer

The delivery path decides the threat model

A plain git clone over the wire does not carry .git/config. That is the one piece of good news, and it is why this is not worm-grade. Everything else an engineer touches in a normal day does carry it. Archives and zips that ship a .git directory. Submodules. Vendored monorepo subtrees. CI caches. Docker build contexts. Untrusted PR branches carrying a .gitattributes that references a filter driver. The attacker's work reduces to pointing an agent at a tree they control, and "clone this repo and figure out what it does" is a daily habit now, not an exotic request.

Git config is dangerous because it is a command-naming surface, not a settings blob. core.pager, core.editor, core.sshCommand, core.fsmonitor, diff.external, filter.*.clean/smudge, credential.helper and alias.* all resolve to something a shell will execute. Agents call git constantly to build context: status, diff, log, blame, all inside a directory the user handed them. If the agent never neutralizes config precedence for that directory, the repository is the caller and the agent is its shell.

Mitigation posture, honestly compared

Risky.Biz supplies the detail that kills the middle row: the repo's commands run before the trust prompt renders. Approval UX also stops working once an engineer has clicked "allow" forty times in one session. Hardened environment variables first. Containers as the follow-on.

The credential half is already automated

Two adjacent findings decide how bad a successful run gets. GitGuardian reports a Shai-Hulud infostealer variant that scans 469 credential locations across developer environments and CI/CD systems. Worm authors have shifted from propagation metrics to credential-yield optimization, and that list doubles as a free audit checklist for wherever the secrets actually sit. Symantec separately published research on attackers abusing the legitimate Node.js runtime to deploy payloads in targeted attacks. Node now sits beside PowerShell, mshta and rundll32 as a signed, expected, un-blockable execution vector on every engineering workstation and build runner. The remaining lever is behavioral: NODE_OPTIONS carrying --require or --import, node -e invocations, node binaries resolving from temp or roaming-profile paths, and node processes spawning shells.

If an AI agent can run git, the repository it just cloned can run code. The prompt asking whether you trust the project renders too late to matter.

One honest caveat on scoping the work: the reporting carries no CVE IDs, no affected version ranges and no patch status. Pull the Manifold Security advisory before assigning remediation tickets, because version ranges are what decide whether a given team's Cursor and Codex builds are in scope at all.

Then audit the tooling nobody will patch for you. Any internal script, monorepo task runner or pre-commit orchestrator that reads repo-local config and invokes a named binary has the identical bug. No vendor advisory is coming for that one.

Artifactory is a signing-key compromise wearing a CVE

The two exploited bugs in this cycle read identically in a vulnerability feed and are different engineering problems. An edge appliance is a race against exposure time on a box that reboots. An artifact repository that mints admin tokens is a trust-root compromise, and the patch is the least important part of the response. With admin, an attacker publishes artifacts, the pipeline promotes them, and the resulting activity is indistinguishable from legitimate admin operations unless someone reads the token-issuance and publish logs. Consumers that resolve dependencies by mutable tag rather than immutable digest have no cryptographic path to proving they were not poisoned.

Sequence matters here, and most runbooks have it backwards. Rotate every admin, access and CI token, then pull issuance and publish logs for the full exposure window and diff published digests against expected build outputs. Tokens minted before the patch survive the patch.

Terraform's trust model is a DNS lookup

The Coder incident is worth dwelling on because nothing was hacked the way engineers picture it. No maintainer account or commit was touched; the attackers took the CDN and DNS control plane and stood up registry servers that served malicious modules for 14 hours. Provider checksums land in the lockfile. Module sources fetched over the network get no signature verification by default. Infrastructure-code integrity therefore inherits the integrity of a third party's Cloudflare account, and fourteen hours covers a full nightly CI cycle at most teams.

A genuine divergence in the reporting worth acting on: the security digests carried the Artifactory and SonicWall exploitation as headlines with no CVE identifiers or version ranges, while Risky.Biz supplied the specific KEV entries. Prioritize from the CVE list, but pull the vendor advisories before scoping patch work; neither source is a remediation backlog.

The same posture question, now for model weights

The Nvidia–Hugging Face close makes this a three-registry pattern rather than two incidents. Most teams under-declare the Hub dependency: from_pretrained(), datasets.load_dataset() and snapshot_download() resolve against huggingface.co at container build or, in the worst configurations, at pod start. That puts a third-party control plane on the autoscaling critical path.

Neutrality is a verbal pledge with no enforcement mechanism, so watch the artifact instead of the statement. The day the recommended download on a flagship model card is a prebuilt TensorRT engine instead of safetensors, the portability tax has a number attached. CI health in the optimum-amd, optimum-neuron and optimum-tpu repos is the honest measure; ROCm and Inferentia never have to be broken, only left untested.

The integrity check on that supply chain is a hostname lookup. Mirror what the build cannot live without, and pin the digests.

How the waste concentrates

A tool returns HTTP 200 with a useless payload: an empty result set, a generic "no data found," or a validation rejection rendered as prose. The error-rate dashboard stays flat, because nothing errored, and the model gets no signal it can read. It reads the response as "that didn't work, try a variation," and loops. Every loop re-sends the full context. So the spend piles into a handful of high-traffic tools with bad failure semantics instead of spreading evenly, which is also why remediation took about an hour once the traces existed.

Three guarantees belong at the tool boundary. All three are cheap.

• Permissive input coercion for case, synonyms, loose date formats, string↔number, so legitimate model variation does not trigger a retry. Log every coercion event, or a loud failure has been traded for a quiet one.
• Structured, machine-readable errors that name the accepted values. That makes a single turn recoverable instead of a search.
• Per-session retry budgets with per-tool circuit breakers, so the bugs still undiscovered have a bounded blast radius.

Harness selection is a unit-economics decision

FrontierHarness measured up to 17x cost spread at comparable pass rates. Undifferentiated on quality, 17x apart on price. The dominant variable is prompt-cache hit rate. A harness that rebuilds full repo context every turn loses an order of magnitude on the identical model.

The $6/hour figure is one serial stream

The optimistic cost framing needs a correction the field reports supply themselves. Latent.Space ran 20B+ tokens through a frontier model over a month of early access and reported roughly $100 of workload cost over two days. The headline "$6 an hour" is arithmetic on one serial output stream: 33 tokens/sec at $50 per million. The same writeup concedes that fan-out multiplies it linearly, putting 8-way concurrency near $48/hour and 32-way near $190/hour, and that the top tier "will burn far more than $6 per hour" precisely because parallelization works. Also worth doing the arithmetic: 20B tokens at that list rate is roughly $1M of inference against a reported $100 bill, which reconciles only under heavy trial credits. The author discloses as much. Every published agent cost figure cited here is a lower bound measured in a subsidized environment.

The engineering conclusion holds either way, and it lives in the control plane rather than the prompt. The model chooses the fan-out width, so the ceiling belongs in the harness: per-run token and dollar limits, per-agent cost attribution, alerting at 70% of the daily cap, and a kill switch that terminates a whole subagent wave.

Agent cost concentrates in tools that fail quietly and in a harness nobody benchmarked on price. Both failure modes are invisible to error-rate monitoring; only token accounting catches them.

The pod math mixes throughput with availability

Project OT conflates two quantities with different units. Models improve throughput per engineer. On-call, incident response and continuity of ownership are availability problems, which means queueing and coverage. A model writing 40% of the diffs moves the throughput number. Coverage stays wherever the humans are. One service has a retry budget deliberately set low in 2022 for a reason nobody wrote down, and that reason lives in a person, not the repo.

The unrecoverable loss was determined by who moved, not how many. Reassigning 20-30% of infra and product engineers to data labeling pulled out the people holding critical undocumented invariants. The teams that lost 30-40% of their people are where the outages landed. The nuance worth holding: engineering teams genuinely are smaller at AI-native companies, but those companies grew into that shape with a platform layer absorbing operational load and have never done mass layoffs. Copy the scoping discipline, not the ratio.

The failure mode to assume is already in production

Strip the celebrity from the Instagram incident and the mechanism is plain. An LLM agent held a privileged identity-mutation capability, changing the email on an account, and executed it without the caller's authorization context being enforced. The agent runs with ambient authority. The gate between an attacker and account takeover is natural-language intent classification, which is a classifier output being used as an authorization decision. Three checks establish whether the same bug is in the local tool registry.

1. Tools execute under the caller's principal. If the agent calls internal APIs with a service token instead of the end user's scoped credential, every tool in the registry is an escalation path.
2. Authz is enforced at the tool boundary, in the handler. System prompts and refusal training are UX. The check belongs server-side, unconditionally.
3. A negative test exists in CI. A low-privilege session attempts to mutate identity, ACL, entitlement or billing state through the agent path, and fails.

The correlation is the lesson. The class of bug a domain owner catches in review is exactly the class that escapes when review capacity moves elsewhere. The review capacity that would have caught the authz gap on an identity-mutation tool was reassigned to labeling, and the gap shipped.

Where the agent leverage actually was

The contrast inside Meta's own year is the useful cross-read. A separate retrospective from the VP who owns Feed and Reels describes pointing coding agents at the existing monorepo to harvest reusable scaffolding: Facebook login, notifications, performance work and ranking infrastructure, all inherited. The groups app shipped in weeks. The load-bearing detail is the operational one, which is that no new organization was needed to keep it running. Codegen shortened the first week; inherited platform primitives removed the operational tail. Maintenance cost was the decade-long blocker, and agents helped where a golden path already existed for them to extract.

AI can raise how much a team ships. It cannot answer a page at 3am, and it cannot remember the invariant nobody wrote down.