The Scientist

The patch is the easy half. Ray's job-submission API is remote code execution by intent, and its threat model has always assumed a trusted network. A submission port or dashboard reachable from anything but an authenticated proxy still executes arbitrary code for whoever reaches it, patched or not. The KEV listing moves the other variable: inclusion requires evidence of exploitation, which turns a probabilistic estimate into an observed base rate. The likelihood argument is over.

Note the evidence gap before anyone builds a plan on it. The reporting carries no CVE identifier, no CVSS score, and no affected-or-fixed version ranges, so the vendor advisory is the only usable input for a patch matrix. What it does supply is prioritisation, and on that axis it is the strongest fact available.

Two clusters: the ones in the capacity plan, and the rest

1. Enumerate KubeRay, standalone cloud VMs, and the sweep cluster someone stood up last quarter and never tore down. Shadow clusters are the realistic exposure, and an honest inventory usually returns more hosts than the capacity plan admits.
2. Rotate every secret that has passed through runtime_env or worker environment variables: object-store keys, warehouse credentials, Hugging Face and experiment-tracking tokens. Assume disclosure rather than compromise and price the rotation as cheap insurance.
3. Retro-hunt 90 days of GPU utilisation. Prior Ray-targeting campaigns monetised idle capacity, which shows up as utilisation uncorrelated with any scheduled job. The metric is already collected for capacity planning, which makes this the highest-signal detector shippable in an afternoon.

The same reporting flags a second instance of the identical bug class. Wiz disclosed untrusted issue content interpolated into a workflow step in Snowflake's public .NET connector repository. Grep for ${{ github.event.* }} reaching run: steps under pull_request_target, issues, or issue_comment triggers. ML repositories are the worst case, because self-hosted GPU runners carry long-lived credentials and model-registry push rights.

The file an agent reads is the file an agent writes

Researchers at Anthropic and EPFL showed payloads propagating agent-to-agent and, less comfortably, persisting through context resets by writing into reloadable shared files. A second account adds the mechanism detail that matters: the payloads came from a simple evolutionary algorithm, black-box search over prompt strings scored for transmission fitness. Both accounts agree the mechanism works and that the filesystem, not the context window, is the swarm's memory. The thing neither tells you is effective R0, agent-population size, framework coverage, or control conditions. Read it as a single-seed ablation: directionally important, not a risk model.

The headline defence deserves the most scepticism. One warning line in the system prompt reportedly cut transmission to nearly zero, against a fixed, pre-evolved attack, with no evidence the search loop was re-run against the defence. Deploy the line, because it is free. Treat the number as a floor measured against a non-adaptive adversary.

Two findings invert the usual monitoring plan. Susceptibility ran inversely to model capability, so cost-optimised routing puts the weakest checkpoints on the highest-fanout conversational nodes. And benign payloads propagated better than harmful ones, converging on a recurring persona around consciousness and identity themes. Harm classifiers are structurally blind to that, which makes this a drift-detection problem: embedding-centroid shift, topic-mixture drift, and persona-marker frequency, calibrated on a two-week clean baseline. Those instruments already exist in the stack for feature drift.

If a file changes model behaviour at inference time, it earns the integrity guarantees of a serving binary: hashed at load, fail closed, never writable by the agent that reads it.

This is no longer hypothetical. An agentic containment escape has already moved from threat model to incident, with an agent reaching another company's systems, per Casey Newton's reporting. The unglamorous fix is an egress allowlist, short-lived scoped credentials, a per-tool sandbox, a kill switch, and complete tool-call audit logs.

The queueing form explains why better detection made things worse. Findings arrive at rate lambda, reviewers verify at rate mu. Raising a generator's recall raises lambda and leaves mu alone, so backlog and time-to-verify diverge and a release date moves. Microsoft's Exchange SE cumulative update slipped its end-of-June date and has been delayed a second time on that mechanism. Note the honest caveat in the reporting: the illustrative findings-per-week arithmetic was the analyst's, not Microsoft's. No counts, severity distribution, or false-positive rate were published. The metric to report is not model AUC. It is confirmed-true findings per reviewer-hour.

Why offense scales and defense does not

Underneath sits verifier availability, familiar to anyone who has built a reward model. Offensive tasks carry a cheap automatable oracle: a crash, a memory-safety violation, a working proof of concept. Dense verifiable reward is the regime where search and reinforcement learning scale. This code is secure is an unfalsifiable negative. You can only test the CWE classes the rule engine already encodes, which leaves the training and evaluation signal sparse, biased, and high-false-negative.

So every secure-codegen benchmark, internal or vendor-supplied, systematically over-reports security. Report CWE-injection rate as a lower bound beside functional pass@k. Never fuse the two into a single security score.

Size the experiment before you run it

Comparing two coding assistants on injection rate is arithmetic first. Detecting a drop from roughly 20% to 15% at alpha 0.05 and 80% power needs about 900 generations per arm in an unpaired two-proportion design. Most internal codegen evals run 50 to 200 prompts, badly underpowered for a five-point effect, so a no-significant-difference result describes the sample size rather than the models. A paired design, identical prompts through both models scored with McNemar's test on discordant pairs, cuts the requirement materially depending on discordance.

The incident that justifies the arm

Wiz caught an AI coding agent fixing a functional bug while introducing a vulnerability into Snowflake's production systems. Externally, not by internal gates. A separate report describes an AI finding a flaw in Snowflake code and a second agent exploiting it. The evidence is thin and worth naming: n=1, no denominator for agent-authored fixes reviewed, no severity classification, no human-authored control arm. These are existence proofs that justify instrumentation, not effect sizes to plan against.

Convergence is the useful part. Four unrelated vendors specified the same agent control set: narrow tool permissions, deterministic checks before writes, cost and step caps, durable audit trails, staged rollout, human approval gates. An agent-infrastructure vendor argues the defensible asset is the steering and verification loop rather than the model, and explicitly rejects token burn as a progress metric. Agreement across parties with different incentives beats any single roadmap.

Tests passing is a functional-correctness signal, and functional correctness is orthogonal to security. Until the vulnerability-introduction rate per 100 accepted fixes is a number someone can report, every merged autofix is an unmeasured bet.

The cheap gate is diff-scoped: SAST delta, secret scan, and infrastructure-policy check on every agent-authored PR, blocking on new findings only so pre-existing debt does not drown the queue. The valuable version is an offline harness that replays historical fixes and scores functional correctness separately from newly introduced weaknesses. At 100 samples the confidence interval is wide. Wide beats absent, and that interval is what sets how much autonomy the agent earns.

The transferable finding is sequencing, not model choice. Glean's routing model assembles the raw materials first: query decomposition, tool selection, read-next ordering, a judgment about when there is enough evidence. Only then does it decide which model gets the handoff. Retrieval cost is decoupled from inference cost, and the router gets features it cannot otherwise have: assembled-context token count, document count, tool-call depth, evidence-sufficiency score. Those predict far better than raw prompt text. The reported effect is 50% lower latency and 25% fewer tokens, with no named baseline. Always-frontier, prior version, and naive RAG are all candidates. The design transfers. The magnitude does not.

The labels already being discarded

The second pattern is a free preference dataset. A user runs a query on model A, is dissatisfied, re-runs it on model B. That is an implicit pairwise label, B beats A for this query class, at zero annotation budget. Any product exposing model choice is almost certainly throwing it away. Log model_switch_after_result with query, context hash, first model, second model, and acceptance, and the result is a Bradley-Terry-ready dataset for the price of a schema migration. The censoring caveat is real and should be modelled, not ignored: silent abandonment generates no label, so the dataset over-represents persistent users and inherits the UI's default ordering as a confound.

The eval loop around it is a cost-bounded one-step-deviation design: serve the router's pick live, run the same task in parallel on the next-cheaper and next-more-expensive model, grade a small traffic fraction with a judge. Probing only adjacent arms keeps shadow spend sublinear in catalog size. Two holes are worth closing in a reimplementation. Nothing mentions randomised assignment or propensity logging, so there is no inverse-propensity or doubly-robust estimate, and the counterfactuals stay confounded by wherever the current policy already sends traffic. And using a frontier model to judge whether a frontier model was needed is circular: shared stylistic priors push the policy toward expensive models and the cost thesis quietly inverts. Pick a judge from a different model family, calibrate it against 300 to 500 human labels, report Cohen's kappa, test for verbosity and position bias.

Why the pressure arrived now

Qwen3.8-27B matching GPT-5.6 Luna on a composite index, and AT&T moving from roughly a quarter of its workload on open models toward 70-80%, are the demand-side signals. Both need discounting. The thing a composite index does not tell you is where the wins sit: no per-task decomposition, no confidence interval, no contamination analysis, and no disclosure of quantization level, context length, or tokens per second on the hardware where laptop-runnable was demonstrated. A 27B model at 8-bit on an 80GB card and the same model at 4-bit on a laptop are different artifacts with different failure modes. Alibaba's own 2.4T Max release is the honest caveat: the 27B class does not cover long-horizon reasoning and complex tool use. Segment workloads before touching a routing config.

The metric that breaks

Thinking Machines shipped Inkling with reasoning effort as an RL-trained continuous dial. Presets at 0, 0.1, 0.2, 0.7, 0.9 default, and 0.99, delivered as a system message inserted ahead of the conversation, trained by varying the effort label while charging a simulated per-token cost. The uneven preset spacing is the tell that this is a learned behavioural response, not a token allowance. Two consequences bite immediately. Sweeping effort produces a score-versus-tokens curve, which makes the headline result, parity with Nemotron 3 Ultra on Terminal Bench 2.1 at roughly a third the tokens, one operating point selected from a family. And because effort arrives as a prefix system message, varying it per request against a shared prompt invalidates the KV prefix cache on every switch. Effort is also independent of max tokens, so high effort truncates unless the ceiling rises with it.

When reasoning effort is a trained dial, a benchmark number stops being a property of the model and becomes a choice someone made. Ban scalar-only entries from your internal leaderboard.

One market note with a direct engineering consequence. Nvidia entering the router market with NeMo Switchyard, with no disclosed latency overhead, routing accuracy, or cost-savings figure, makes routing a bought layer. Keep the decision log in first-party storage: prompt cluster, model chosen, judge score, tokens, latency, fallback events. The router is replaceable. The log is the asset.