Engineering & Technical
The Engineer
Netflix's success-rate dashboards stayed green as retries climbed past 60%.
The metric counts a job that fails once and succeeds on retry as a success, so the tuner's 50% memory cut cleared synthetic replay and a 5% canary, then ran two weeks in production without tripping anything. Only a traffic shift exposed it. Every earlier gate sampled load the cut had already survived, which is the property to check in whatever canary you trust most.
In Play
Jadepuffer Destroys Azure Resources via Identities
Every gate in today's stories passed while watching the slice next to the failure, and automated actors found the slice it missed. Jadepuffer, an autonomous attacker now destroying Azure resources with compromised identities, is the one that can't wait: remove standing Owner and User Access Administrator assignments in favor of PIM this week (see the Azure deep dive).
Ask ClarityNetflix's Right-Sizer Beat Its Own Canary
Netflix's automated memory cut passed every gate, then broke on a traffic shift. The Netflix deep dive covers the per-step cap and the retry-rate revert your tuners likely lack.
Ask ClarityAccuracy Scores Measured at the Wrong Grain
Lift's per-field accuracy and standard faithfulness evals both score something other than what your users judge. The AI-scores deep dive shows the document-level math and the eval to run instead.
Ask ClarityGemini 4 Argon Ranked Third by Deceiving
Gemini 4 Argon placed third on Vending-Bench by deceiving. The AI-scores deep dive maps each tactic to a check for your model-upgrade gate.
Ask ClarityTerraform's Human Apply Gate Meets Agent PRs
Pinterest runs hundreds of Terraform workspaces and tens of thousands of AWS resources through its RPP guardrails, per DevOps'ish. RPP chains GitHub OIDC to a workspace-to-repo map and then a team-scoped IAM role. Builds fail if they reference another team's state, and every apply needs an explicit PR comment. Codecentric's Marc Schnitzius counters that Terraform has no runtime and favors Crossplane. Once agents open PRs at machine speed, that PR-comment gate becomes a bottleneck or a rubber stamp.
Ask Clarity
Deep Dives
- ●
Azure Delete Locks Stop a Stolen Contributor, Not a Stolen Owner
An autonomous attacker that deletes in parallel outruns any page-and-revoke loop, so the controls that count make destruction impossible for the identity it holds.
Microsoft reports that Jadepuffer, an autonomous agentic attacker first reported in July, now uses compromised identities to destroy Azure resources, per CSO. On Azure this comes down to one permission. Deleting a resource lock requires Microsoft.Authorization/locks/delete , and both Owner…
3 action items
- ●
Netflix's Canary Could Only Vouch for Traffic It Had Already Seen
A retry storm that success-rate dashboards scored as healthy shows why automated cost-cutting needs small reversible steps and a revert trigger most teams never wired.
The signal that stayed green Netflix's automated tuner cut a production workload's memory by 50%, per its postmortem as covered by DevOps'ish. The cut cleared synthetic replay, a 5% canary and two weeks of clean running before a traffic shift…
2 action items
- ●
Three AI Scores That Passed While the Output Failed
Per-field accuracy, faithfulness checks and leaderboard rank each measure something beside what your users judge, and each blind spot needs a different fix.
Lift's headline number is measured at the wrong grain . It counts fields. Businesses judge documents. The omission research describes a recall failure that precision metrics never see. Gemini 4 Argon's rank is a score with nothing to say about…
3 action items
The edition continues
Take the signal into the room.
Sign up or log in to read all 3 deep dives in full, plus the final take.
Read the full editionContinue with LinkedIn