The Engineer

The primitive, not the payload

Fastjson's recurring wound is autoType. It's the polymorphic deserialization feature that instantiates whatever Java class a payload names in its @type field. That one primitive has produced years of gadget-chain bypasses, each closed by blocklisting the newest chain. CVE-2026-16723 is the next entry in that sequence. No blocklist update is coming. SafeMode is the mitigation that holds because it removes the primitive, not the payload: autoType is disabled outright, so no gadget chain has a class-instantiation step to reach. The cost is unavoidable. Any code path that relies on @type to round-trip polymorphic types stops working. Whether that surfaces as a loud exception or a silently null field depends entirely on your error handling.

Why your update pipeline contributes nothing

Nearly every CVE ends in a version bump, and that muscle memory is the trap. There is no maintainer output on 1.x since 1.2.83 in May 2022. So Renovate and Dependabot will never open the PR that fixes this. Coverage is a staffing question, not a pipeline question. The hiding places are transitive: Spring Boot starters, internal shared libraries, and shaded fat jars that never name Fastjson in any build file you'd grep. Scan resolved dependency trees, not manifests. Search shaded artifacts for com.alibaba.fastjson package paths.

The ladder, in the order that survives contact

The workable sequence: virtual-patch the edge immediately, SafeMode everything you cannot migrate immediately, then burn down 1.x over the following weeks. Two operational notes. Deserialization virtual patches are bypassable by construction, so route every rule match into detection alerting instead of silently dropping it. The match tells you who is scanning you and how fast. And triage by attacker reachability, not by service tier: internet-facing JSON endpoints first, then internal parsers reachable through SSRF, then batch consumers of stored JSON.

How much to trust the exploitation claim

One source carried this. The in-the-wild evidence traces to Imperva and ThreatBook telemetry, with exploitation beginning about a day after FearsOff's disclosure. The sector spread is finance, healthcare, computing, retail, concentrated on US organizations. That's vendor telemetry. Read it as the shape of the exposed population, not a target list. The accompanying claim that 1.x is "still probably in every bank and government network you know" is opinion. Your SBOM is the only authority on whether it applies to you.

That asymmetry is the argument for acting before corroboration arrives. A fleet dependency scan costs an afternoon and returns a definite answer. Waiting for a second confirming report costs days, and the automated pipeline does nothing for you in the meantime. This is the broader pattern in miniature: the fixes that matter live in configuration and code you own, not in a version number someone else publishes.

A CVE whose only fixes are a config flag and a migration has no pipeline owner — it has a person, or it has nobody.

Noise as energy, not information

The mechanism tells you where this generalizes. Optimized projection vectors and pure random noise gave statistically identical result distributions (Mann-Whitney p=1.000). That kills any story where the prefix carries information. What is left is stochastic resonance — added noise pushes a weak signal over a detection threshold. The reasoning was already latent. The perturbation supplies energy to get it past the decoder's commitment to a formatting template.

The controls confirm it. Zero embeddings and mean embeddings buy about four points. Remove chain-of-thought and the effect goes to zero, so both diverse prefix values and step-by-step reasoning are required. The prefix is two vectors scaled to the model's native embedding RMS of roughly 0.022, at 0.097% overhead. The failure mode shows up in the token counts. Correct runs average 718 tokens. Wrong runs slam into the 1,024-token ceiling and truncate mid-format. On (45+23)*17-89 the baseline burned its budget formatting; the perturbed run produced 1067 in half the tokens.

The gates that decide whether it works at all

Majority voting collapsing below baseline is the counterintuitive one. When per-seed accuracy is under 50%, requiring a majority throws away correct answers that never reach the threshold.

Selection is the product

The number to build around is not 72%. It is 100% oracle coverage against 51.6% realized accuracy. A correct seed always existed and the scorer failed to pick it. That 48-point gap is pure selection loss. The perturbation loop is five lines of throwaway code. The verifier and voting layer is the real system, and the single point of failure. Instrument oracle-versus-realized before you touch anything else. EOS completion rate works as a cheap health signal.

The economics justify the experiment. Ten seeds cost $0.009 per query against $0.45 for frontier thinking tokens. At 10,000 queries a day that is $2,700 versus $135,000 a month, and under $15,000 versus $675,000 at 50,000 a day. Hardware follows the same logic. A $429 RTX 5060 Ti at 16GB pushes 200 tokens/second; a $1,999 RTX 5090 at 32GB runs about 96. Runpod's 16GB serverless tier is $0.58/hour against $1.58 for 32GB.

Where the evidence thins, and where a second source agrees

Sample sizes are small: 25 arithmetic, 5 planning, 12 legal tasks. The n=3 scout runs overstated gains, falling from 60% to 51.6% at n=10, so expect regression as evals scale. The legal scorer, a 300K-parameter MLP, was non-deterministic and broken on 9 of 12 tasks. On out-of-knowledge legal tasks, every condition fabricated content. Perturbation adds energy, not knowledge, so keep it out of compliance, medical and legal paths.

What raises confidence in the direction rather than the number is a separate release. Poolside's open-weight Laguna S2.1 activates 8B of 118B parameters with a 1M-token context, per TheSequence. Both results say serving configuration now moves cost more than parameter count. They diverge on cost of adoption. The sparse-MoE path needs no new verifier. This one is entirely gated on one you have to build.

The capability was already inside the small model; frontier pricing was paying to fix a decoding bug, not an intelligence gap.

What the regression actually is

The symptoms cluster the same way in every report: more comments, longer comments, large numbers of pull requests merged with no review, and incidents and bugs per developer rising sharply. The named mechanism is the training objective. Current coding models are rewarded for short-term functional correctness — does the test pass, does the task complete — not for the properties that set cost six months out: coupling, naming, error handling, the absence of a second code path that does almost the same thing. An agent optimizing the first will degrade the second. Every merge without review capitalizes that debt silently.

So the control surface is the review gate, not model choice. In pipeline terms, coach mode is three concrete settings: auto-merge disabled for agent identities in branch protection, a required human approver distinct from the agent that authored the change, and a bugs-and-incidents-per-developer series you can compare across an autonomy change. Skip the third and you are arguing about vibes. Keep it and the next autonomy proposal arrives with a number attached.

Your benchmark suite is measuring the wrong horizon

Model selection compounds it. Short-task pass@1 scores — the SWE-bench family, including the 79.2% SWE-bench Pro figure attached to frontier releases — reward exactly the behavior the field data flags. A model tops those and still ships the maintainability regressions that surface as incidents. Two long-horizon suites are named as additions worth evaluating: SWE-Marathon and Frontier Code, both aimed at multi-PR tasks where a change has to survive later changes. Do not replace the suite. Add one long-horizon test and watch whether its ranking disagrees with the short-task ranking. The disagreement is the signal.

Identity is the audit primitive nobody provisioned

Block's Buzz, released Apache-2.0 at github.com/block/buzz, is the most reusable piece of plumbing in the material reviewed. Each agent gets a Nostr cryptographic keypair independent of the platform, plus a second signature binding that agent to its human owner. That produces a verifiable passport and audit trail. Prebuilt harnesses cover Goose, Codex and Claude Code over the Agent Client Protocol. The value is the model, not the platform. Git attribution collapses when three agents and a human share one service account. "Which agent, under whose authority, made this change" becomes unanswerable at the exact moment an incident review needs it. A per-agent key plus an owner-binding signature answers it cryptographically. You can implement that pattern without adopting Buzz.

The containment lesson is the security half of the same posture: treat any agent-executed code as untrusted, with default-deny egress and short-lived scoped credentials.

Where the gate generalizes past code

The Bear Cave supplies the consequence case. Axon's AI-generated police reports get facts wrong in production, a Forbes finding surfaced by short-seller Jim Chanos, while the product is marketed on officer time saved. Fluent output is not correct output. In an evidentiary document a transposed fact is a due-process failure, not an annoyance. The architecture that survives it is the one that survives agent PRs: retrieval-backed grounding, a mandatory human verification gate, immutable audit logs, and a measured error rate against ground truth.

If you cannot state your system's error rate against ground truth, you are not managing the risk — you are hoping about it.

Three independent reads converge on the same conclusion, which is the strongest evidence on offer. The fix for agent-authored defects is not a better model. It is a gate you own, instrumented well enough to argue with.

The abstention is the fact

The coalition letter defending open-weight models drew Meta, Nvidia, Microsoft, a16z, Reflection and Hugging Face. Google, Amazon, OpenAI and Anthropic did not sign. That is a positioning signal with an operational consequence. The four vendors whose business is closed API access will not lobby to keep a self-hostable fallback legal. If restrictions on Chinese AI labs land, the substitution work belongs to whoever runs the systems. It will not arrive as a vendor migration guide.

Two dependencies pointing opposite ways

The incident-response angle makes this concrete. Hugging Face reconstructed its own breach on self-hosted GLM 5.2 from Z.ai. Hosted frontier models refused parts of the forensic workload. Their safety filters could not distinguish a defender from an attacker. Routing the analysis through a hosted API would have pushed sensitive attack data out of the environment. So the same class of weights sits on the critical path for security work and on a candidate restriction list at once. A SOC or on-call rotation that plans to hand a payload to a hosted model for triage has a hard dependency that fails closed at the worst moment.

The hedge is boring. Identify which production paths lean on Chinese-origin weights, and validate one substitute per path, so a swap is a config change and not a project. Poolside's Laguna S2.1 is open weights, 118B total with 8B active per token, 1M-token context, and non-Chinese, per TheSequence. Note the mismatch. It is a coding model, not a forensics model. It does not cover the security use case. A model-abstraction layer that swaps providers without touching business logic just moved from convenience to risk control.

The cost floor under all of it

Self-hosting is priced in memory, and memory is getting more expensive. DRAM and HBM prices have risen enough that Apple is raising hardware prices, with iPhone increases expected this fall, per The Information. That is an industry-wide signal, not an Apple story. It flows into cloud instance pricing and on-prem refresh budgets alike. Re-run capacity math for the memory-heavy services actually in production: vector databases, caches, and large-context inference where the KV cache dominates footprint.

On the accelerator side, AMD shipped a full stack: Helios rack-scale, MI400, EPYC, ROCm. Etched is scaling GPU-free inference against more than $1B in booked orders. Neither has to win for this to be useful. Request one ROCm quote and one non-GPU quote before the next commitment. It costs a week and changes the negotiation, whether or not anything switches. The valuation news attached to these companies is noise for technical planning; the supply optionality is not.

The vendors who sell you inference are not the vendors defending your right to run it yourself.