The Watch

The regression is the finding

Rank the paper's numbers by security value and the headline score comes third. Plan-and-Act (arXiv 2503.09572) trained a planner that had never seen the target websites. It produced fluent steps that matched nothing on the page, and the executor ran them anyway. Result: 20.60% on WebArena-Lite, against 36.97% for a plain ReAct loop with no planner at all. That is a published, reproducible demonstration of zero instruction validation at the executor. A plan is obeyed because of where it arrived from. Nothing compares it to the page or to the user's request.

The trust asymmetry belongs in the architecture review. These runs are web navigation, so the observation returned after every action is the raw HTML of the page the agent is standing on. Plans are derived from attacker-writable content, then consumed as trusted orders. Whoever shapes what the planner reads reaches every tool the executor is permitted to call: form fills, purchases, credential entry, data export, whatever the harness wired up.

Replanning buys accuracy by widening the window

Dynamic replanning is the largest single gain in the work: +10.31 points, 43.63% to 53.94%. The mechanism is that after every step the planner receives the current page state, the previous plans and the actions already taken, then rewrites the objective. The paper's own benign example turns "library at CMU" into "libraries near CMU". Small, plausible, useful. An adversarial revision has the same shape. A static plan gives an attacker one attempt at plan time. Per-step replanning gives one attempt per step, against a component whose job description is to change the goal based on what the page says.

One control arrived free. The executor strips HTML it no longer needs before its next action, and replanning replaces a failed step instead of accumulating it. Both bound how long an injected payload sits in context. Both were funded as latency work. Bounded execution context is the rare security property that pays for itself with a performance argument.

Where this meets today's other story

The executor's failure mode has a human twin in the finance approval chains covered elsewhere in today's brief. A deputy with real authority, executing an instruction whose only credential is its apparent origin. Same defect, different substrate. In both cases the missing control is not stronger authentication of the sender. It is a check that the order still matches the objective the system was asked to serve.

The move

Treat any plan step or tool action derived from third-party content as untrusted input. Allowlist executor actions, validate parameters against the original user request, and hard-deny privileged classes (authentication flows, payments, data export, credential entry) when the step traces back to a replanned instruction. Then gate replanning itself behind an injection suite. The 20.60% run is the business case to carry to the platform lead. Not a hypothesis about model attention. Documented behavior of the architecture they are about to copy.

The best-performing agent configuration in this research is also the least defended one, and the paper's worst score is the proof: the executor follows plan steps that match nothing on the page.

Reconnaissance with a subscription price

Canary Data scrapes corporate leadership pages and diffs them over time. Per The Bear Cave, it surfaced four undisclosed McDonald's departures — one of them the Head of Global Intelligence — with no formal announcement attached, and it caught the Chief Development Officer being quietly deleted from the site. The product is sold as research. The function is the recon phase of a pretexting campaign, priced for anyone with a card.

Turned inward, the finding is less comfortable. Quiet exits are discoverable without a filing. A diff of a leadership page against open job postings tells an outsider which approval chains currently have a hole in them.

The window nobody staffs

The operational pattern across these transitions has nothing to do with the departing executive. An interim or incoming finance leader has no relationship baseline with accounts payable. No history means no anomaly to notice. No familiar phrasing, no known escalation habits, no instinct for what this person would never ask for. Voice cloning has made "urgent request from the new CFO" cheap enough that it is now the opening move, not the advanced one.

The offboarding case worth a tabletop

The Baxter sequence is the scenario most playbooks fail. A chief accounting officer holding interim CFO authority carries legitimate bulk-export rights across ERP, consolidation and forecasting systems, and a lawful reason to be inside them until the final day. Departure Sept 15. Start at a direct rival in November. Two months in between. Most data-loss tooling is tuned to catch an engineer zipping a repository. Very little of it catches a finance executive doing exactly what the role permits.

Nothing here alleges wrongdoing by any named individual, and every one of these transitions is public. The value is the calendar shape and the gap it exposes in your own controls.

The move

Two controls cover most of the exposure. Both are close to free. First, every payment, banking-detail and wire-instruction change routes through out-of-band callback to a pre-registered number, with accounts payable briefed explicitly that an executive transition is never a reason to bypass it. Second, offboarding for privileged finance and engineering roles gets staged privilege reduction across the notice period, plus a retroactive 90-day review of bulk exports and mailbox forwarding, with mandatory escalation when the destination is a named competitor. Neither needs new tooling, budget, or a vendor conversation. Both need a decision this week about who owns the transition window.

Publicly dated executive transitions are a schedule an attacker reads for free, and the control that fails first is the payment approval nobody reassigned.

Three primitives the roadmap hands over

Prefix caching first. The guidance is to turn it on and find the workloads it helps. No tenancy caveat is attached. A prefix cache shared across tenants is a timing oracle: an attacker measures time-to-first-token to infer whether another tenant's prefix — a system prompt, a retrieved document set, a context carrying personal data — is already resident. The measuring instrument is the first metric the roadmap tells the team to instrument. The fix is cheap and specific. Namespace cache keys per tenant and per API key, exclude sensitive prefixes from the shared pool, and prove isolation with a TTFT timing-differential test rather than a config review.

Then autoscaling. Scaling on queue depth is the correct engineering call, and the same roadmap separately recommends per-request token budgets. Ship the autoscaler, slip the budgets, and the result is a denial-of-wallet primitive: cheap attacker requests trigger expensive GPU scale-out and p99 degradation for paying users. Token budgeting is framed as unit-economics hygiene. It is rate limiting wearing a finance label, and it has to land in the same release as the autoscaler.

Then the router. A model router choosing destinations on cost, latency and quality is a silent data-egress control plane. A config edit made purely for cost reasons can move regulated data to a processor that appears nowhere in the subprocessor register, with no security review and no notification. GDPR Article 28 and SOC 2 vendor management both apply to that edit. A merged pull request satisfies neither.

The upside nobody has claimed

The same roadmap sequences observability ahead of optimization: TTFT, inter-token latency, throughput and queue depth in Prometheus and Grafana, reported at p50/p95/p99, means explicitly banned. That is a fully specified abuse-detection telemetry plane, funded and built by someone else, and no security team has asked for a feed from it. Joining while it is under construction costs an exporter and a handful of alert rules. Joining afterwards costs a roadmap negotiation.

• Per-API-key token consumption deviation — token flooding, cost amplification, scraping by agent.
• Queue-depth spikes uncorrelated with legitimate traffic patterns — resource exhaustion attempts.
• p99/p50 TTFT divergence — prefix-cache probing or long-context memory pressure. A mean hides this entirely, which is why the roadmap bans means.
• Plan-diff drift — semantic distance between an agent's current plan and the original user objective. Nobody builds this yet, and it is the only detection that catches an objective rewrite while the run is still going.

Those same signals double as SOC 2 CC7.2 monitoring evidence for AI workloads, which most organizations currently cannot produce at all. That is the argument that gets the exporter prioritized this quarter, not the threat model.

The move

Treat every serving-configuration decision as a security-relevant change, then pick the two that cannot wait. Cache tenancy, because a timing side channel is invisible to code review. The router's destination list, because it moves regulated data with a config edit. Everything else on this list is a detection that can be added incrementally once the metrics are already flowing.

The platform team is instrumenting the best AI abuse-detection telemetry it will ever get and shipping a silent data-egress control plane in the same quarter.