The Engineer

Patching stops the reads. Rotation ends the incident.

An RCE incident ends when the fixed version is running. A secrets-disclosure incident ends when the stolen credentials are useless. CVE-2026-66066 hands an unauthenticated caller whatever the Rails process can read: SECRET_KEY_BASE, master.key and credentials, object-storage keys, any signing material sitting in the app. After the patch, a signed cookie or JWT minted under a leaked key still verifies. A leaked S3 key still authenticates. Risky Business has this right: rotation ends this incident, and the deploy only stops the reads.

Rails shipped the fix at the start of August, so the live variable is when each environment got it. Reconstruct that window before closing the ticket: the date the fixed release actually landed per environment, which of those services answered from the internet before that date, and whether Active Storage sat in the request path at all. The subsystem is on by default, so absence needs proof. grep finds the obvious call sites; only the request path tells you whether it was reachable unauthenticated.

Sequence the rotation by blast radius

A leaked signing key and a leaked bucket key are two incidents wearing one CVE. The signing key forges sessions and tokens against your own app. The storage key reads and writes data directly, outside your request path and outside your logs. Rotate both, plus any credential the app could enumerate downstream. Cookies and sessions minted under the old key will stop verifying. Plan that user-visible logout deliberately rather than discovering it in a support queue.

The other patch is a discovery problem

Ubiquiti's 21 critical fixes cover UniFi OS Server plus three UniFi applications, and the impact classes are the bad ones: remote command execution, authentication bypass, privilege escalation. The controller pushes configuration, firewall and NAT rules, VPN topology, DNS resolution, and firmware to every adopted device. Auth bypass chained to command execution collapses that boundary in one step, with no lateral movement required.

Real exposure runs ahead of the advisory because controllers live in shadow infrastructure: a branch office nobody inventories, or an engineer's home network with a tunnel into corp. Asset inventories undercount them structurally. The relayed advisory detail also carries no CVE IDs and no CVSS vectors, so pull the vendor bulletin directly before scoping the change window.

Where the two stories agree

Both remediations gate on inventory you either already have or will spend the week building: a credential inventory and an asset inventory. Both sources arrive there independently, from opposite ends of the stack. That is the pattern worth carrying past this week: patch velocity is cheap; enumeration and revocation are the constraint.

Until the keys are rotated, the patched app still trusts tokens minted under the old one. The controller inventory is the one most teams lack, and the next disclosure bug will bill them for it.

Why a 55-100% range is not marketing

Count the passes. A conventional tool-calling loop spends a full inference pass on every MCP invocation: the model re-reads a growing context, emits one call, and the serialized observation gets appended for the next pass. A ten-call chain is ten passes over a growing prompt. Code-mode batching collapses that into one pass. The model writes a script, the script invokes the tools in-process, and one consolidated observation comes back. Savings scale with chain length, which is the whole reason the range is that wide. Short chains save little. Long chains save nearly everything.

The trade-off is observability. A batched script that dies on step 7 of 9 hands back a stack trace, not a clean per-step tool-call trace. Mid-chain recovery goes with it. Structured logging inside the generated scripts is work that lands before this ships, not after the first bad incident.

Tool discovery has to become lazy

Uber's grounding layer exposes 1,000+ MCP tools. That is why "CLI-resolved MCP calls" sits in the same list as the cost levers. Static tool manifests break somewhere around 50-100 tools; a thousand JSON schemas injected into a system prompt survives neither the token budget nor the routing accuracy. Exposing tools as a CLI surface the agent discovers on demand moves schemas from push to pull. The cost is discovery latency per session. It is cheap to design in now and expensive to retrofit as a prompt-architecture rewrite later.

Skills are becoming an artifact with a governance problem

Do the division. 3,600 skills against 30,000 executions a day averages roughly eight runs per skill per day. That is a long, cold tail. Microservice sprawl with worse tooling. Uber's authoring conventions read like runbook discipline: the description is a router written in the words a user would type, the body is steps and nothing else, deterministic scripts carry the fixed sequences, and the agent is reserved for judgement. Then verification is a step of the procedure. That last convention earns its keep, because a bash script has exit codes and a skill has none until someone builds them. The verification step is the exit code.

Where the sources converge, and where Uber is quiet

Uber's own database-overload work landed on the same mechanism: static, human-configured quotas do not survive real capacity movement, and the fix was a closed loop reading observed latency. The agent tier is open-loop on unit cost for the same reason. Requests grew 9.4x and cost per 1,000 requests fell 34%. "Down 52% from peak" concedes the overspend arrived first and the instrumentation second. Reporting on Salesforce repricing AI points at the consequence: under seat licensing a 3x retry rate is invisible, and under consumption pricing it is a budget incident with a team's name on it.

One thing not to copy: the 24M-node context graph is the harvest of years of platform consolidation across 30+ internal systems, and Uber flags that mileage varies. Ground two or three high-value workflows, watch where agents fail for lack of context, and expand against evidence.

Every MCP round-trip you leave unbatched is a full inference pass over a growing prompt, and you pay for the prompt twice.

Read the escape surfaces, not the headline

The paths Trail of Bits names are libslirp, QEMU's usermode network stack, and CUPS, a printing subsystem. Neither is the hypervisor's hardened core, and CUPS has no legitimate reason to exist inside an agent execution image at all. The isolation primitive largely held while the accessories bolted onto it did not, which is what makes the result actionable rather than fatalistic. The cheapest control available is deleting the surface that was exploited. That is a base-image change, not a platform migration.

MCP is npm with instruction-injection privileges

The 155 abandoned MCP servers found on public marketplaces are not passive malicious dependencies waiting to be imported. Here is what actually happens on a tool call: tool descriptions and tool outputs flow directly into the model's context, and the model holds tool-calling privileges, so a hijacked server is prompt injection with hands attached. Treat these like production dependencies. Pin versions, allowlist by publisher, vendor or fork anything that touches production systems, and drop marketplace-sourced servers with no active maintainer.

The compromised OpenAI-related npm package is the older and better-understood half of this: publishing credentials sitting in CI. OIDC trusted publishing and provenance attestations exist specifically to delete that failure mode, and they are good engineering. A static registry token in CI secrets is one workflow misconfiguration away from being next week's item.

Two vocabularies, one control

Risky Business arrives at default-deny egress and per-task credentials from the escape side. Daniel Miessler's reporting arrives at the same place from the injection side: an agent's reading context must not hold send or write tools, because a payload only needs the ability to read untrusted content and trigger an outbound action inside one trust boundary to become self-propagating. Remove that adjacency and worm mechanics break regardless of payload sophistication. Both conclusions are capability separation, described in different vocabularies and reached from different threat models, which means the control is not an artifact of one attack class.

Detection-based defenses lose this race on economics. An attacker iterating with a capable model outpaces filter patching, and the same ledger reports ransomware operators claiming LLM-driven command-and-control and intrusion crews using coding agents to plan hands-on-keyboard work. The RaaS claim is single-source and hedged by its own author, so treat it as direction rather than measurement. The planning consequence survives either way: attacker tempo becomes a compute question, and the mean-time-to-detect budget shrinks against it.

An escaped agent holding a short-lived, task-scoped credential that cannot reach the metadata endpoint is an incident, because the credential expires with the task and the blast radius expires with it. A long-lived key does not expire, so it grants everything its policy allows for as long as the escape goes unnoticed. That is a breach.

Why the control plane cannot see this failure

Pod creation reads as an orchestration operation. The CNI ADD path is network-dependent. kubelet calls the CRI, the CRI invokes the CNI plugin, and most production CNIs then make control-plane or IPAM calls over TCP. When the kernel cannot insert a new conntrack entry it drops the SYN. The CNI retries, the retry drops, kubelet's timeout expires, and the pod sits in ContainerCreating. Nothing in that chain emits the word conntrack. The observable output is an opaque timeout.

Adyen's case turns on a distinction: table full and capacity exhausted are not the same condition. Expired entries are not reaped at the moment they expire. The kernel GC worker walks the table incrementally on a bounded time budget, so under high connection churn the table stays saturated with entries that are logically dead and structurally present. Two consequences outrank the fix itself. Raising nf_conntrack_max alone hands the collector more ground to cover per pass. And if nf_conntrack_buckets is not scaled alongside it (target roughly max/4), insertion failures are traded for long hash-chain lookup latency, the same pain in a slower, harder-to-attribute form. Scan cadence and per-pass budget are kernel-version dependent, so check the node image before copying anyone's sysctl gist. An eBPF datapath does not remove this cliff. It relocates it into a BPF map with its own sizing and eviction semantics.

The ground truth already exists in conntrack -S: insert_failed, drop, chaintoolong, plus the count-to-limit ratio. Almost no fleet exports them. That is why a named alert becomes a multi-hour diagnosis.

The same shape on the GPU side

Datalab's Marker v2 documents the serving equivalent. The default scaling move for document parsing is more workers, each loading its own model copy into VRAM and feeding it one page at a time. A GPU's speed is batching, so a private replica fed serially never forms a batch, and it idles while its worker does CPU-side file I/O and output assembly. You pay for N model copies and get roughly the throughput of one. Marker v2 inverts the layout: many thin CPU workers into one shared inference server, with the parent reading server capacity and splitting it across workers. Two metrics settle the question in an afternoon, mean effective batch size and GPU SM utilization. Batch size near 1 while several replicas run is the bug, and it bills monthly.

Two traps sit in the published numbers. The marketed 23.7 pages/sec is OCR-disabled on a B200. The accuracy-leading balanced mode is 2.9 on the same hardware. The default mode is also hardware-dependent: balanced on GPU, fast on CPU/MPS, where fast reads equations from the PDF text layer instead of the rendered page. Identical code therefore produces different extraction quality on a laptop and in production, and math degrades silently rather than erroring. In a retrieval ingestion tier that surfaces four weeks later as unexplained answer-quality complaints.

The third instance is a memory budget, not a throughput one. KV cache bytes per token equal 2 × layers × kv_heads × head_dim × dtype_bytes, which for a Llama-3-8B shape is 128 KiB per token. That is about 1 GiB for one 8K sequence and 64 GiB at 64 concurrent sessions. That number sets max concurrency, not FLOPs.

The common diagnostic

Uber's move from static per-client rate limits to closed-loop load management is the fourth instance of the same class. A limit encodes a capacity estimate from the moment it was set, while real capacity moves with data volume, cache hit ratio, and replica health. Set it low and headroom is stranded. Set it high and it does nothing during the overload it was bought for. Ship the adaptive limiter and priority tiers, with a static floor as a backstop so a misbehaving control loop cannot shed to zero.

Each of these outages was one exported counter away from being a named alert instead of a multi-hour diagnosis.