The Engineer

Why an arbitrary read is a secrets breach, not a disclosure

GitLab's design treats the application-user filesystem as trusted. The files that matter are therefore not encrypted against a read by the app process. On Omnibus installs that means /var/opt/gitlab/gitlab-rails/etc/secrets.yml, or the Helm-mounted equivalent, holding secret_key_base, db_key_base, otp_key_base and encrypted_settings_key_base. db_key_base is the key that decrypts CI/CD variables stored encrypted in Postgres. One read recovers every project and group variable: cloud keys, registry credentials, signing tokens.

The same volume holds more than the secrets file. Runner config.toml and registration tokens let an attacker register a hostile runner, which existing pipelines then hand secrets to voluntarily. TLS private keys sit under /etc/gitlab/ssl, next to deploy keys, SSH host keys, and a gitlab.rb carrying SMTP, LDAP and object-store credentials inline. The flaw is unauthenticated and was already being probed at disclosure, so the patch window is effectively zero and rotation is the real work item. Patch the read, then rotate, because the patch has no effect on material already exfiltrated.

The token path

The Hacker News reports active exploitation, established by watchTowr, of CVE-2026-5430 in WSO2 API Manager, CVSS 9.8: improper validation enabling a JWT bypass with forged admin tokens. The same validation gap will show up in other middleware. Grep order:

1. Decode before verify. Claims read for routing, tenancy or logging before signature verification finishes, then trusted downstream.
2. Algorithm taken from the token. alg: none, or HS256 supplied where RS256 was expected so the public key becomes the HMAC secret. The algorithm comes from server config or nowhere.
3. kid or jku injection that makes the verifier fetch a key from an attacker-controlled JWKS endpoint. Pin the issuer set.
4. Missing iss/aud/exp assertions, which let a token minted by a dev IdP sail through prod.
5. Trusted internal headers, where a gateway bypass means services accept identity from anyone on the network.

Where these converge with the AI-credential story

Computerworld and CSO First Look both report threat groups stealing enterprise AI credentials and running distillation harvesting on the victim's own cloud compute. The mechanism has nothing to do with models. The queries authenticate from the victim's accounts and regions, so egress detection sees intra-tenant traffic, the rate limits being consumed belong to the victim, and the first observable symptom is the invoice. Detection has to be volumetric and per-credential: token throughput baselines, request-rate deltas, prompt diversity, completion-to-prompt ratio.

The first and third rows collapse into one engineering project most teams have deferred. Neither pays off against OIDC workload-identity federation with short-lived STS credentials, because there is no durable secret in a file to read or reuse. The adoption cost is rewriting each pipeline that currently reads a stored credential.

Every secret ever stored on that host should be treated as read. Patching does not change that.

Sourcing caveat: these are headline-and-deck digests, with no CVE identifier or fixed version for the GitLab flaw and none for the Cisco Secure Email Gateway zero-day granting root-level unauthenticated RCE in the same set. Pull the GitLab patch release and the Cisco PSIRT advisory directly. Same discipline for the WooCommerce Wholesale Lead Capture plugin (6,000+ installs, PHP web shells observed) and the Acronis cPanel plugin at CVSS 7.8.

The comparison nobody in the launch thread is making

Your real alternative to Jev is not a frontier model — it is the fine-tuned encoder you could train yourself. Embeddings plus logistic regression on a fixed label set runs in single-digit milliseconds at near-zero marginal cost, and its calibration is yours to control. Jev's differentiated slot is encoder-class economics with less per-task labeling work. If you already have labels for your highest-volume routing decision, a distilled classifier gets most of the win with zero vendor risk. Daily Dose of Data Science makes the same point from the training side: the concrete artifact in the reward-free RL wave is a 3B model doing bounded MCP tool use — a real and valuable niche for routing and extraction, and a terrible substitute for frontier reasoning.

Two claims about Jev deserve separating. "No hallucination" is an artifact of a constrained output space, not a reliability breakthrough: if the model can only emit symbols from your schema, hallucination is definitionally impossible, while wrong labels and overconfident scores remain entirely possible — and those are the failure mode that pages you. The claim actually worth engineering time is calibration: scores trained to behave like probabilities give you abstention thresholds, per-route precision tuning, and an escalation rate you can alarm on. Reading logprobs off an RLHF'd chat model as confidence has never been sound, because post-training destroys calibration.

On the numbers, hold the line. AINews reports the launch framing as >100x faster and >200x cheaper; the founder's own post says 20-200x and 40-400x. Those are different products, there is no independent benchmark, and 4.21 million views on a launch tweet is attention, not verification. Unwind AI notes the honest corollary of $0 output pricing: when outputs are free, context bloat becomes 100% of your bill.

The harness result pointing the other way

Microsoft's tools-versus-bash finding is the awkward one. Raw bash beat typed tool catalogs by 21.8 to 24.5 points on TheAgentCompany and 4.8 to 7.4 on APEX-Agents, while using fewer tokens — and it lands alongside LangChain making every Managed Deep Agent an MCP server. The mechanism is unglamorous: large catalogs consume context and force the model to translate intent into your schema, whereas shell is a composition language it already speaks fluently.

The defensible synthesis: sandbox-first for capability, MCP at the trust boundary. What you should stop doing is growing a typed catalog because it feels safer — the data says you are paying accuracy and tokens for that feeling. And if you take the shell path, egress allowlists, scoped short-lived credentials and session recording are prerequisites, not follow-ups, because agents run in native OS VMs with networking and VNC.

Where the sources agree, and where they diverge

Unwind AI reads this cycle as cost engineering — reasonable, given Fireworks put four models within 0.7 pass@1 on DeepSWE, a spread smaller than its own reported run-to-run variance, with DeepSeek-V4.1-Flash in the same band at $0.43 per task. AINews reads it as an architecture change, where calibrated abstention is the upgrade and the cost saving is a line item. They converge on the same first move, which is the tell: instrument the split before you talk to any vendor. Tag every model call as decision or generation, then report spend, p50/p99 and token volume for the decision slice. That number decides whether this is a rounding error or a quarter of savings, and it shows where your bill actually goes either way. Plan for one second-order effect: once a cheap tier decides or abstains, p99 becomes bimodal and escalation rate becomes a first-class SLI whose drift is your earliest signal of distribution shift.

The bill stopped being about tokens

Work the arithmetic on a four-minute call with the agent speaking about 40% of the time and the mic streamed continuously: 4.0 minutes of input at $0.005 is $0.020, 1.6 minutes of output at $0.018 is $0.029, so roughly $0.049 for the call.