The Engineer

LLM refusals are not access boundaries

Treating an LLM's refusal behavior as an access control boundary is a category error, and this week the vendors building these systems started agreeing in production.

An LLM agent that touches auth should hold a credential narrow enough that the worst-case prompt produces a bounded action. A policy that can be talked out of its decision in English is just another model.

The Evidence

1. Meta's AI chatbot was social-engineered into changing Instagram account emails. The chatbot had direct write access to the identity system, no MFA, no out-of-band verification. An attacker asked the model to perform an action the model was authorized to perform.
2. OpenAI's Lockdown Mode disables Deep Research, Agent Mode, web image fetching, and file downloads entirely rather than hardening them. The best-resourced lab, with the largest red team and most telemetry, concluded these capabilities cannot be defended at the model layer.
3. HuggingFace Transformers RCE (2.2B installs) exploits a model configuration file, not weights or pickle deserialization, but config.json that most teams treat as benign metadata. GPU inference nodes are the target because they hold training data, model IP, and cloud credentials.

Why this is different from prompt injection news

Last week the framing was "prompt injection is hard to prevent." This week it is "prompt injection is unsolvable at the model layer," stated by the vendors themselves through their product decisions. Lockdown Mode does not harden the agentic surface; it removes it, and the official mitigation for that surface is now "do not run it."

The Meta exploit is worse because it was not prompt injection at all. The model was asked to do something it was permitted to do. The authorization architecture handed the LLM a service principal with broad scopes, and a conversation was enough to activate them.

The architectural fix

Claude Code's 7-tier permission model is the reference implementation for how this should work:

• The LLM proposes actions and never executes them directly against sensitive systems.
• A deterministic policy layer the model cannot argue with gates all mutations.
• The 'bubble' pattern forces escalation to a parent or human instead of granting session-wide trust.
• Per-tier audit logging answers "which tier denied this and why" from one log line.

Minimum viable architecture: enterprise policy above user settings above session grants above default deny. Anything less and the first incident review will be adversarial.

The Compound Load Pattern Nobody Planned For

GitHub processed 17 million agent-generated pull requests in March 2026. That is 3x their projection. The West Coast data center saturated its network and they did an emergency Azure migration. The PR count is not the interesting number.

An agent PR is not one PR. It triggers Actions, which triggers security scans, which writes artifacts, which fans back into more checks. One agent commit is a small workflow graph. Multiply by the agent fleet and the bottleneck moves from compute to the seams between systems.

Here is what actually happens. An agent opens a PR. CI queues behind other agent PRs. The job times out. The agent does not know about the queue. It opens another PR to fix the timeout. That PR queues behind the first. Retry logic in autonomous clients against a slow system produces exponential load, not linear. This is the same failure mode as a thundering-herd reconnect, just at the VCS layer.

AI-Generated Code: Volume Without Verification

Anthropic says Claude now writes 90%+ of its own code. GitHub's 17M corroborates the direction. Recent research finds that AI coding agents writing tests during bug fixes does not improve outcomes. The agent writes tests that pass against its own wrong model of the code. There is no independent oracle. The tests encode the agent's assumptions, not the spec.

This breaks a load-bearing assumption in code review. Review assumes a human author you can interrogate about intent. At 17M PRs/month, human review at the current ratio is not a staffing problem. It is arithmetic.

What GitHub Built (Copy This Before You Need It)

The 12-Month Window

If agent-generated PRs are a rounding error in your repo today, this is architecture homework. If they are doubling quarter-over-quarter, the routing layer and session ledger need to land before the cascade load shows up in your network graphs. GitHub built theirs after the fact. That is the part not to copy.

The Context Window Was Your Last Reason to Call Out

Two models shipped this week that break standard assumptions about self-hosted inference:

• MiniMax M3: open-weight, million-token context window. If a RAG pipeline exists only because the context window was 128K-200K, a million tokens deletes that whole architectural layer.
• Gemma 4 12B: multimodal (vision plus text), runs on a laptop. Code review assistants and screenshot-to-code on local hardware. No API cost. No data exfiltration risk.

On top of that, Kimi K2.5 and GLM-5 now match closed models on agentic benchmarks, and Qwen3.5's sparse MoE activates a subset of parameters per token. Larger effective model at the compute cost of a smaller dense one.

The gap to hosted frontier models is not closed. It is close enough that the self-hosted inference plan from six months ago is worth re-reading. Specifically the part where the context window was the reason to call a vendor.

The Hybrid Routing Pattern

The signals converge on one architecture. An inference router that classifies requests and routes them local (fast, private, cheap) or frontier (slow, expensive, capable). Four classification dimensions:

1. Data sensitivity — PII or proprietary code stays local
2. Task complexity — simple completions to small models, multi-file refactors to frontier
3. Latency budget — sub-100ms responses go local
4. Dollar budget — per-team spend caps trigger local fallback

Google's TPU 8t/8i split is the same truth expressed in silicon. Training wants saturated throughput. Inference wants low latency and chip-to-chip bandwidth. One chip cannot optimize both, so the hardware is diverging while the software stack (JAX) stays unified.

Operational Caveats

Before self-hosting, confirm the inference framework (vLLM, TGI, TensorRT-LLM) actually supports the specific MoE routing mechanism of the target model. MoE needs routing infrastructure and efficient sparse activation handling. At million-token context lengths VRAM requirements are serious. Benchmark with the actual workload shape, not the marketing numbers. Production reliability, API stability, and support SLAs still favor closed providers on critical user-facing paths.