The Scientist

Strip out the printers and VPNs and this advisory is a security audit of a modern ML platform. Two attack patterns outlive the patch list.

First, the feature store as a silent poison vector. Feast's /save-document endpoint (CVE-2026-23537, 9.1) allows unauthenticated arbitrary JSON writes, corrupting the artifacts feeding live predictions. The thing dashboards don't tell you is that poisoned features degrade metrics gradually. By the time AUC drifts you are debugging the model, not the store. Patch, require auth on writes, add checksums and audit logging on production features.

Second, deserialization as the recurring root cause. Airflow <3.3.0 (CVE-2026-33264, 9.8) gives RCE via malicious triggers in BaseSerialization.deserialize(). The orchestrator inherits cloud creds, warehouse access, and model-registry write. That is the highest-blast-radius item in the set.

The rest are dev-grade tools never hardened for untrusted networks: txtai /reindex (9.8), LLaMA-Factory RCE via a malicious model path (9.8), IBM Langflow (7 CVEs, 9.1–10.0), Flowise's hardcoded secret enabling session forgery (9.1), Crawl4AI command exec (10.0). LLaMA-Factory is the tell: the model artifact itself is now a code-execution surface. Extend supply-chain threat models past Python deps into the weights.

From three other sources: HalluSquatting weaponizes a tolerated LLM failure mode. Coding agents hallucinate the same plausible nonexistent package names; attackers pre-register them on npm/PyPI with reverse-shell installers. This is not patchable. It is inherent to autoregressive generation, so deterministic gating is the only defense.

Caveat: CVSS is theoretical. Only two CVEs in the broader advisory are confirmed actively exploited via CISA KEV. The ML ones are disclosed-not-yet-weaponized, but the disclosure-to-exploit gap for internet-facing RCE is short.

The claim worth reading past the hype: GRPO removes the trained reward model entirely. Sample N answers per prompt, score them, push the policy toward those beating the group mean. The reward becomes a deterministic, version-controllable Python function you unit-test rather than retrain. For any verifiable task — code compiles, math checks, schema validates — that retires an annotated component and its drift surface. The thing this doesn't tell you is how much of your real workload is actually verifiable.

The Othello example exposes the discipline. The composite reward weights four signals: win/loss (1.0), piece advantage (1.0), invalid-move penalty (1.0), and format compliance at just 0.2. That low weight is the tell that formatting belongs to a prior SFT stage, not RL. Ministral-3B's illegal moves are 'noise RL can't train through,' forcing a mandatory pipeline: data generation (200 GPT-4.1 games) → SFT → RL. Skip SFT on a weak base and RL compute burns on format, not capability.

Strategically: Prime Intellect open-sourced Verifiers plus a 2,500+ environment hub the same week Anthropic reportedly floated $1B+/year on proprietary environments. Pretraining and SFT are commoditizing. The scarce resource is the RL environment. In a verifiable domain, the environment is the IP. The open hub is a floor, not a leveler.

The gap: zero quantitative results — no win-rate deltas, sample counts, or reward-weight ablations. Treat it as an architecture template, not an empirical claim. The reusable win is the harness itself. A deterministic seeded opponent behind an OpenAI-compatible API lets local Ministral-3B and hosted GPT-4.1 swap in one line. That gives you a reproducible apples-to-apples comparison for local-vs-hosted, which is the number most of these writeups never bother to measure.

Two structural shifts. Both testable this quarter.

The lakehouse is absorbing the vector tier. Apache Hudi ships native vector columns, HNSW indexing, and hybrid vector+filter search on lakehouse tables, pitched as RAG without a separate vector DB. Iceberg v3's Variant type shreds semi-structured JSON into real Parquet columns for typed reads and column pruning. The payoff is collapsing a serving tier and killing embedding drift between stores. The thing this doesn't tell you: Hudi's capability is announced, not benchmarked — no published recall@k or latency-vs-dedicated-DB numbers. Lakehouse-native is credible at mid-scale (<1B vectors). But HubSpot's 20B+ vectors across 200+ indexes, 140+ clusters, 38+ teams on Qdrant shows dedicated infra earns its keep at fleet scale, and the real unlock there was Kubernetes operators, not embeddings.

The sleeper is DataFusion: PageRank on 1.05B edges in ~30 min on 5GB RAM, weakly-connected-components on 1.96B edges in 10GB, via disk-backed scans and spill-aware sort-merge joins. If it reproduces on your graph, that retires a Spark cluster for batch graph features. Read the conditions first. Single-author blog, standard Graphalytics datasets, no cross-engine comparison. Those numbers are a starting point, not a verdict.

Second shift: agent-authored pipelines are silently wrong. Multiple independent sources converge on a deterministic correctness layer — SQL/schema validation, query equivalence, lineage, blast-radius checks — because non-deterministic models are blind to your actual data. The mechanics: Write-Audit-Publish, an upfront data contract validated in a staging branch before publish, plus a database MCP so agents inspect real schemas instead of hallucinating them. If agents author SQL or transforms, treat the output as untrusted input. Gate every transform behind schema, row-count bounds, null-rate, and referential checks.

The productivity gains in the ROI deck get clawed back downstream, and now there's a number: finance teams spend ~13 hours/week verifying AI outputs. Automation that saves 20 hours but generates 13 hours of checking nets ~35%, not the 100% the deck assumes. This is a calibration and selective-prediction problem. An abstention layer auto-approves high-confidence outputs and routes only the uncertain ones to review. Well-calibrated abstention routinely removes 40–70% of review volume at fixed error tolerance. That buys more than another accuracy point.

Second, a clean variance-vs-bias result from one million AI responses. Running the same prompt 10x/day versus once moved citation share by 0.25 points. Identical-prompt repetition resamples decoding noise and nothing else; the returns are gone after one or two samples. Widening the prompt set reduces bias, because it samples the query space users actually occupy. The thing repetition doesn't tell you is how the model behaves off the prompt you fixed. In any LLM-visibility or eval harness, cap repetition at 1–2x and reinvest in stratified breadth.

Third, the benchmark under your coding-model decisions is contaminated. OpenAI found ~30% of SWE-Bench Pro tasks broken: unsolvable, mislabeled, or wired to faulty harnesses. Broken tasks add structured bias, not random noise, and structured bias can invert the ordering of closely-matched models. Rankings built on it measure artifacts, not capability. That is the difference between a research leaderboard and a production winner.

The reusable gem is GuardDog 3.0's eval design. It's a 27,000+ sample dataset deduplicated via TLSH fuzzy-hash clustering before splitting, which kills the near-duplicate leakage that inflates test metrics, then scored with Matthews correlation coefficient alongside F1. MCC exposes the majority-class bias that accuracy and F1 paper over on imbalanced data. Retrofit both onto any fraud, anomaly, or security classifier you own. Expect the honest metrics to drop. That's the point.