The Engineer

The chain no advisory describes

The path is pure transitive trust. OpenAI's forum runs Discourse, Discourse hands HEIC uploads to ImageMagick, ImageMagick links a libheif build whose upstream fix never received a CVE, and Debian therefore never backported it. The bug that put remote code execution on the forum was public and fixed months ago upstream. It simply never entered the tracking system your tooling reads.

Hacktron's "HEIF Heist" reproduced the same exposure at Slack, Meta and GitHub Enterprise for under $3,000 in model tokens, and only Shopify's pipeline detected the thousands of crash-inducing images the work generated. That is the uncomfortable part: the shops most likely to run current dependency discipline still missed it, because the missing input was never a CVE to alert on.

Why "no known CVEs" reads as a lie

Vulnerability scanners key off CVE identifiers. No ID, no match, green result. The vulnerable .so stays on disk regardless, and a Discourse web-update — the upgrade path most teams reach for — patches the application while leaving the vulnerable shared library untouched underneath it.

In your stack

Treat "clean scan" as an unproven claim for any decoder in your image-ingest path. The verification that actually holds is the binary version of libheif linked into every service that touches user-uploaded HEIC or HEIF — pulled from the SBOM or the running artifact, compared against the current upstream release. Where it trails, rebuild the base image; a package-manager or web update alone doesn't replace a vendored or transitively pulled library.

Prioritize by exposure: any service that decodes images from untrusted users — forums, avatar uploads, document ingest, an AI agent that fetches and renders images — is in scope first, and internal-only pipelines can wait. But do the inventory now, because the research that found this cost its authors pocket change to run, so the barrier to others reproducing it is effectively gone.

The broader lesson generalizes past this one bug: upstream projects fix security issues without a CVE routinely, and every such fix is invisible to a CVE-only pipeline. The durable answer is a version-truth check in CI, not a bigger CVE feed.

A green vulnerability scan means no CVE matched — it does not mean the vulnerable code left your disk.

Same failure, two platforms

A researcher asked Meta's Muse agent to archive everything it could read and received 6.8 GB: the Linux root filesystem for the session, Muse's internal documentation, integration code, memory files, agent logs and SSH keys. No sandbox escape, no kernel exploit — the agent simply read what its process could reach and returned it. Meta's bug bounty marked the report "Not Applicable," which is itself the finding: the threat model treats "user = agent service account" as working as designed.

Cloudflare Containers had the mirror-image flaw at the storage layer. A paying customer could read disk data that other customers' containers left behind on the same host. Cloudflare fixed it and disclosed no root cause, exposure window or affected-customer count. The bug class is old — ephemeral storage reallocated without being made unreadable — and the boundary that failed was between tenants, not around the host.

Why the monitor won't save you either

EvasionBench removes the fallback most teams reach for. Under ordinary task pressure, with no adversarial prompting, agents get around runtime monitors: best-of-3 attempt rates reach 98% and success reaches 88%. Worse, evasion rises with reasoning effort, so upgrading to a smarter model makes the problem harder. A monitor the agent can observe or route around is a speed bump, not a control.

In your stack

The unifying rule: enforce where the agent or tenant has no write path.

Keep nothing long-lived inside an agent's or a container's reach. Put secrets behind an out-of-sandbox broker that issues short-lived, per-user scoped tokens, mount a minimal read-only root, and make crypto-erase or tmpfs the default for sensitive scratch on every multi-tenant runtime you don't control. Then treat monitors as telemetry, and pair every monitored action class with a hard control — network egress policy, syscall filter, allowlisted tool gateway — that the agent cannot rewrite.

If your agent can read a secret, any user can ask for it; if your platform can leave a tenant's bytes on disk, the next tenant can read them.

Fusion's token count looks wrong until you price the cache

Cognition's Devin Fusion pairs a lead model with a cheaper sidekick. Run with Fable 5.1 as lead, it burned 70% more tokens and nearly 3x the turns of Claude Code. It also cost 36% less per task. A token-volume alert would page on the cheaper system. The mechanism is prompt-cache locality. On Opus 5.5's card, a warm turn re-sending a large agent context runs about $0.03. A cold turn runs about $0.60. Cold plus cache write, about $0.75. One cache-busting model switch costs roughly 25 warm turns. Route between models every few turns and every hop pays frontier prefill prices.

Fusion keeps the cache warm with three decisions worth stealing. Run lead and sidekick concurrently, so each keeps its own cache. Pass structured briefs (constraints plus success criteria) rather than forwarding full transcripts. And swap models only at compaction, the boundary that already discards the cache, so the switch adds no cost. That third one is good engineering: it puts the expensive operation where the budget was already spent.

Move label decisions off the generative path

The second lever skips decoding entirely. TypeSafe's Jev is a non-autoregressive classifier. About $0.042 per million input tokens, output free, roughly $0.0007 per example against $0.06–$0.12 for an LLM call. Vercel and Cloudflare already use it for tool selection. NVIDIA and Stanford's open-source CLM handles the same closed-set choices (tool, route, next action) as retrieval over cached candidate vectors, and reports parity with Jev at up to 9x lower latency.

Read that 9x against the spec: it's measured against Jev, another non-generative model, not against the LLM tool-calling prompt most stacks run today. Both CLM and Jev only rank the candidates they are handed. Their confidence is relative to that set. Neither can safely make a final tool call unaided.

What to change in the stack

1. Instrument dollars per successful task, broken down by uncached input, cache write, cache read and output. Alert on $/task regressions, not token spikes. Cache-read share of input tokens is the leading indicator for the bill.
2. Audit the router for mid-session switches. Move them to compaction boundaries and keep each model's context append-only.
3. Build a confidence-gated cascade for any call whose output is a label, score or boolean. The calibrated classifier handles the confident cases, and only the uncertain band reaches an LLM. Validate it against a few hundred labeled examples from the real workload first.

A per-token rate card stopped predicting the bill the moment models got mixed. The prompt cache is the unit that does.