The Engineer

Why pre-auth write is a different bug class

Unauthenticated write access turns the source-control server into the adversary rather than the victim. Every integrity control configured inside GitLab sits downstream of the compromised component: protected branches, required approvals, force-push denial, the audit log itself. Each one inherits the trustworthiness of the thing that broke. Runners then build whatever HEAD they are handed, sign the artifact with the org's own keys, and promote it. That is a fully automated supply-chain attack running on owned infrastructure, with every log line reporting success.

Patching is the easy half. The exposed instance is almost never the one on the wiki. It is the CI mirror someone stood up for a migration, the box an acquired team still pushes to, the instance behind a load balancer whose auth rule got relaxed "temporarily." Enumeration that works keys off network reachability, not asset inventory, and then checks which of those answer from the internet with no authenticating proxy in front. With a pre-auth flaw, reachability is the vulnerability.

The same defect in two other trust roots

CyberScoop's reporting on CISA's Medusa advisory supplies the tempo: newly disclosed CVEs weaponized inside 24 hours, Fortra GoAnywhere and BeyondTrust named explicitly, victim count moving from 300+ to 500+ in about a year, broker-purchased footholds priced from $100 to $1M, and living-off-the-land RDP afterwards, so signatures contribute nothing post-foothold. The useful question is not what the patch policy says. It is the measured p95 from disclosure to production deploy. The number is available: take the last four security patches and measure it. The honest trade-off: a 24-hour SLA raises change-induced outage risk, so canary deploy and automated rollback are the actual prerequisite project.

Clop's campaign changes which control is load-bearing. It burned a zero-day in PTC's product-lifecycle software, then ran an automated web-shell toolkit chaining credential theft, lateral movement and bulk exfiltration, with no encryption anywhere. Immutable backups, restore drills and RPO/RTO targets contribute zero against pure exfiltration extortion. Per-workload egress default-deny plus byte-volume anomaly alerting on service accounts is what bites. And a web shell has to write a file and then execute an interpreter, so read-only root filesystems and shell-less distroless images break both steps at essentially zero runtime cost.

Bloomberg extends the same pattern into the model supply chain. A Hugging Face breach pushed OpenAI to harden models under development even though it was not the breached party. The engineering read: weights are build inputs, not data. A legacy .bin/.pt checkpoint is a pickle stream, and pickle deserialization executes arbitrary Python at load time, inside the container holding cloud credentials. from_pretrained("org/model") resolves a mutable third-party ref, often at image build and sometimes at cold start.

Where the reporting is thin

Both security items are headline-level: no CVE identifiers, no affected version ranges, no CVSS, no IOCs, no named researchers. Bloomberg supplies no scope, timeline or attack path for the Hugging Face incident, and "AI tools running amok" is framing rather than a threat report. This material sets priority and nothing more. GitLab's release notes and Hugging Face's own advisory are where the detail that belongs in a change ticket lives.

If a pre-auth flaw in source control can rewrite history, then in-platform controls always sat downstream of the SCM. Integrity comes from runner-side signature verification, digest pinning and off-platform provenance.

The control you lost was accidental

Claude used to stop at a draft. A human opened Gmail and pressed send. That manual step was a security control by accident, and it is now optional. Approval is required by default, users can disable repeated prompts, and only on Team or Enterprise can an owner decide whether members are allowed to disable them. Every prompt users are permitted to disable will eventually be disabled. The owner-level pin is the most important line in the release for anyone running a team.

The announcements do not name the attack, so name it. One session now holds three ingredients: access to private data (the inbox), ingestion of untrusted content (inbound message bodies nobody on your team wrote), and an exfiltration channel (forward). A crafted email body is attacker-controlled input to a system with send authority. The mitigation is a human clicking a dialog that ships with an off switch.

Perplexity has the worst posture and the best distribution. No authentication gate is described: cc [email protected] and a session spins up with zero install and zero onboarding, carrying the whole thread into an external runtime. Any employee can open that exfiltration path unilaterally. A mail-gateway rule plus a DLP match is roughly an hour of work.

Managed MCP moves the agent inside the data perimeter

"Direct access to live application data" is a very wide default grant. Model indirect prompt injection first. The agent reads a document field, the field contains instructions, and the next tool call is attacker-chosen. Every readable collection is now in the control path, not just the data path. Then the unglamorous production failures: agent queries land on the primary and application p99 goes with them; a model that does not know your index topology issues unbounded collection scans; audit entries get attributed to the human who launched the agent rather than the agent identity, which makes forensics useless. A coding agent debugging a schema question needs shape, not production PII. A scoped read-only replica, or API-gateway-mediated tools, is the sweet spot.

Aggregation compounds it in one hop. Treg is offering agents 2,600+ tools behind a single URL and a single token, at the same moment prompt-injection worms are being discussed as near-term rather than theoretical. One credential, thousands of side-effecting tools, and untrusted text in the context window is a textbook self-propagation substrate: read a poisoned page, write to an outbound channel, repeat.

What the protein result adds

Anthropic's campaign is the cleanest counterexample to confidence-based gating. 354 of 1,320 designs bound, roughly 27%. Two of fifteen targets failed completely, and the folding models' confidence scores flagged neither failure. The generator's uncertainty estimate correlates with the generator's blind spots, so it goes quiet exactly where an independent check would have fired. What made the run budgetable was the $50,000 per-campaign ceiling enforced in the loop, not discovered on an invoice.

The move

1. Annotate every tool read-only or side-effecting, then add a CI check that fails any session config combining untrusted-content ingestion with a privileged write tool.
2. Delayed outbox, 30 to 120 seconds, cancellable, in front of every irreversible operation. This turns "we sent the wrong thing to the wrong person" from an incident into a queue deletion.
3. Idempotency keys and an append-only action ledger: tool name, full arguments, model and version, prompt hash, approver identity, outcome. A chat transcript is not an audit trail.

The same four primitives show up in all three reads above: scoped agent identity, action-level permissions, server-side budgets, append-only log. All four are buildable in a sprint with tools already running. Retrofitting stays cheap only while the fleet is small. Game-day it: kill an in-flight agent and measure how long its credentials stay valid. If the answer is "until the service-account token rotates next quarter," there is no kill switch.

An agent that can send email is a distributed system with a write path and no rollback. Design it like a payments integration, not a chatbot.

Where the indexing bill actually goes

Full GraphRAG indexes in six phases: chunk into text units; LLM extraction of entities and relationships per unit; merge of entities sharing title and type, with a second LLM pass compressing each description array into one; optional claim extraction for time-bound facts; hierarchical Leiden clustering into a community hierarchy; community report generation and embedding. Extraction is roughly 75% of indexing cost. Merge is the hidden multiplier. A service named across 200 documents produces 200 separate descriptions that must be reconciled before the graph is usable. Cost scales with entity mention frequency, not document count, so the most-discussed services are the most expensive nodes.

The spend buys provenance, not accuracy. Every extracted entity, relationship and claim keeps a pointer back to its source text unit, and that pointer is the actual mechanism behind paragraph-level citation. Microsoft's evaluations show gains in comprehensiveness, diversity and supporting-source quality, while faithfulness scored at a similar level to baseline vector RAG, and vector RAG stayed stronger on local queries. Graph retrieval funded as a hallucination fix contradicts the vendor's own numbers. Rebuild the case on auditable citation and answer coverage.

The long-context objection is separately dead for corpus-wide questions. Microsoft compared graph retrieval against vector retrieval stuffing 8K and then 64K tokens of context. The larger window still trailed on comprehensiveness, diversity and source quality.

The index is a materialized view, not a search index

Freshness is what kills these projects after launch. New documents force re-extraction, re-clustering and re-summarization over affected material, and the community hierarchy itself can shift structurally as the graph grows. Community reports are pre-computed answers with no cheap invalidation signal. A corpus that changes daily (tickets, postmortems, ADRs, commits) means a continuous pipeline, not a build step, and a recurring monthly cost line.

Note what the vendor of the expensive architecture published next. LazyGraphRAG uses an NLP-based index with no summarization and defers all LLM work to query time. It matches global-query quality at 0.1% of full GraphRAG's indexing cost and over 700x lower query cost. Default to it. The only defensible reason to pay a thousand times more for indexing is that humans will read and share the community reports directly, which is a knowledge-management requirement rather than Q&A. Get that commitment in writing before funding the extraction bill.

Harvest the free structure first

LinkedIn's SIGIR 2024 production result, +77.6% MRR and 28.6% lower median per-issue resolution time, came from preserving ticket structure and inter-ticket links that plain-text storage had discarded. Not from running Microsoft GraphRAG. Most ingest pipelines flatten exactly the edges that are deterministic and noise-free: incident-to-service mappings, ADR cross-references, PR-to-deploy-to-incident chains. Materialize those before paying an LLM to infer anything.

Two implementation details are worth stealing whether or not a graph ever ships. Global search deliberately shuffles community-report batches to mitigate position bias in map-stage LLM calls, and it asks for a numerical importance rating per point so the reduce stage has a real ranking signal instead of summarizing summaries. Treat the community hierarchy level as runtime config, not a build constant. Microsoft states response quality is heavily influenced by which level supplies the reports, deeper levels multiply report count and latency, and there is no safe default.

One sourcing caveat: the 75%, 0.1% and 700x figures are all Microsoft's own, relayed secondhand. Verify them on the target corpus before they land in a budget deck.

Graph retrieval buys coverage and citations, not correctness — budget it as a summarization pipeline you have to keep refreshing.