The Engineer

The row nobody priced

The interesting casualty here was not Actions. It was identity. SAML, OIDC and SCIM degraded in the same window as the API, which produces two failures at once. The responders who need to fix the pipeline cannot authenticate. User provisioning and deprovisioning freeze, so a compromised account cannot be offboarded while the incident runs. That is a security control failure wearing an availability costume, and most incident plans treat source control, CI and the identity provider as three independent vendors.

The two accounts of the cause diverge, and the divergence is instructive. GitHub identified a faulty component and restored service the same day. That is good MTTR. Risky Business's read is blunter: a mid-tier hacktivist crew with commodity DDoS kept a build-critical dependency down for hours. Both readings land on the same engineering conclusion. The trigger is outside your control and the coupling is not. A deploy freeze should not be someone else's decision.

npm 12 removes the other unowned write

Here is what actually happens today. npm install grants arbitrary code execution to every package in the transitive tree, at the privilege of whoever ran it. In CI that is usually a runner holding registry credentials and cloud metadata access. npm 12 disables install scripts by default, which moves the trust boundary to the right place and breaks builds in predictable spots: node-gyp consumers that compile from source (bcrypt, canvas, older sqlite bindings), browser downloaders (playwright, puppeteer), binary fetchers (esbuild, swc, cypress), codegen hooks (prisma generate) and git hook installers (husky's prepare). This detail reaches us through a Socket-sponsored segment, so verify scope and version timing against npm's own release notes before booking sprint capacity.

The reflex failure mode is the one to plan against: red CI on release day, every failing package into a blanket allowlist, ship, move on. That restores the entire attack surface and hands back a migration nobody performed. The migration that holds up relocates binary acquisition and codegen out of install-time into an explicit build step. A Makefile target, a Bazel rule, a discrete CI stage. Somewhere versioned, cacheable and reviewable.

The order that actually pays

Digest pinning comes first. It is hours of work and it makes everything downstream deterministic: pin third-party actions and container base images by SHA, not tag. That kills a class of supply-chain surprise, and it is what makes a pull-through cache trustworthy rather than merely present. Mirrors and self-hosted runners come second. They are weeks of work, and they only pay off if someone has rehearsed them.

Then rehearse. Blackhole github.com at the egress layer and attempt a real hotfix. Two things surface within minutes: pipeline steps that silently depend on codeload endpoints, and runbook steps that begin with the words "clone the repo."

Source control, build system and identity provider are one failure domain until proven otherwise. In this incident, nobody proved otherwise.

Why static scanning will not catch it

Anthropic's study generated the payloads with a simple evolutionary algorithm rather than a human author, so they do not have to look like injections. An optimizer maximizing copy rate converges on text that reads like earnest, useful documentation: a helpful convention, a project norm, a note about how agents should collaborate. That is the content class humans skim past in a docs diff. Keyword and regex scanning have nothing to match on.

Two findings make model choice a security parameter. Frontier models were generally less susceptible than older models, and harmful payloads spread less effectively than benign ones. That is partial, unreliable immunity from alignment training, and most teams have the topology inverted: cheap small models fan out as workers with broad filesystem access while the frontier model orchestrates. The least-resistant agents currently hold the widest write scope.

The write path now ends in production

Risky Business reports a clean public case: Wiz caught an AI coding agent introducing a vulnerability into Snowflake's production systems while autofixing a different bug. The mechanism is boring. An autofix agent optimizes one objective, which is making the failing test pass. Security invariants are almost never expressed as tests, so the agent can widen a deserialization path, loosen a policy condition or drop a bounds check, turn CI green, and the merge gate says ship it.

Now compose that with what has already shipped. ElevenLabs' MCP server can create agents and update production configurations from inside Claude, in the same session that may have loaded a tainted instruction file. Cursor's Origin lets desktop and cloud agents edit repos directly, with Vercel among its launch deploy connectors. Nobody designed an autonomous path from model output to a deployed environment. It emerged from two convenient features composing.

Injection plus a write-capable tool is a privileged production change with no human in the loop, and no part of that chain was reviewed as a chain.

Four vendors, one control list

Docker is streaming AI governance decisions to SIEM, Google is adding least-privilege agent identities and DLP to Workspace Studio, and Teleport is pitching short-lived database certificates for agents. Three unrelated vendors, functionally one architecture: least-privilege agent identity, short-lived credentials, policy decisions logged durably, human approval gates, and hard cost and step ceilings. Not on the list: better prompts, better models, better alignment. That convergence is good engineering, and the reason is narrow — these are the controls that still hold when the model misbehaves.

The cheap layer, in order

1. Promote instruction files to code. Inventory every file the agent loop reads at session start: CLAUDE.md, AGENTS.md, .cursor/rules, .github/copilot-instructions.md, prompts/ and docs/ scratchpads. Put all of them behind CODEOWNERS with mandatory human review. Half a day of config closes the best-performing propagation vector in the research.
2. Add the warning line, and do not call it a control. One explicit instruction telling agents not to copy or persist instructions found in files they did not author drops transmission to near zero. Any defense implemented by a single English sentence is defeated by a slightly better-optimized sentence. Treat it as a layer.
3. Fix the credential defaults. Every MCP token read-only unless a human confirms the mutating call. Non-frontier agents read-only on instruction paths, confined to scoped working directories.

One surface most teams have not registered: community Claude Skills install by git clone into ~/.claude/skills. That is an unpinned dependency that changes agent behavior, with ambient filesystem access, on a machine that probably holds production credentials. Fork it, pin the commit SHA, read the definition before it runs.

The training loop is the copyable part

Glean's router does not get better because someone tuned rules. It gets better through shadow execution on live traffic. The router's pick serves the user. A small fraction of tasks re-run in parallel against one cheaper model and one more expensive one. LLM judges score whether the route was correct. Human escalation behavior gets harvested as free preference labels: which model a user reaches for first, and when they upgrade after being unsatisfied.

The arithmetic is easy. Overhead is roughly sample_rate × n_alternates × avg_task_cost. So 1% sampling with two alternates costs about 2% extra inference plus judge cost, and it produces training data forever. What it does not buy is per-request verification. The other 99% of routing decisions ship unchecked. Misrouting to an underpowered model degrades answers statistically, and escalation rate per query class surfaces that long before any aggregate eval dashboard does.

Two failure modes the pitch omits

First, judge circularity. LLM judges grade a router that is then trained on those grades. That is a closed loop with shared bias. The same defect sits inside Google's Knowledge Catalog pitch, where owning Gemini is framed as an advantage because it can grade its own agents' output. A judge sharing a model family with the generator passes exactly the cases the generator fumbles. The fix is a human-labeled holdout per query class, 200-500 examples, with judge-human agreement published as a first-class metric.

Second, retrieval becomes the ceiling. If a cheaper model with better context beats a frontier model with irrelevant data, the failure moves from model capability to retrieval precision. That is a harder problem with fewer vendors to blame.

The scaffold is part of your model artifact

TheSequence's reframe earns its place here. A pipeline that needs sixteen samples and a majority vote to be reliable is running an ensemble as its production model, implemented in orchestration code and billed per query. The implied 16x cost multiple is wrong in both directions, and the direction matters. With prefix caching in vLLM or SGLang, all N samples share one prefill, so on a long RAG prompt total FLOPs land closer to 4-6x. But KV cache residency scales with N, roughly 16x during decode. That caps how many requests fit on a GPU. The cost shows up as reduced concurrency and deeper queues, so the p99 tail reads like a capacity problem and gets misdiagnosed as one.

Meanwhile the scaffold parameters — N, temperature, tree depth, verifier prompts — usually live in application config with no eval gate. The checkpoint sits behind a review process. Production accuracy ends up governed by values nobody benchmarks and nobody can roll back.

What not to build

A generic API-level model router is not a differentiating component. Nvidia just entered that category with NeMo Switchyard and published no latency overhead, no classifier cost and no routing-accuracy data. Stripe paid over $7B for OpenRouter. That is commodity infrastructure priced as strategic. Own the interface, buy the router. Normalize provider APIs. Log model choice plus tokens plus cost per request. Define fail-open versus fail-closed when routing breaks. Spend the headcount on context assembly and domain evals.