The Engineer

Who actually holds REPLICATION

Enumerate the accounts in a normal stack and the list runs long: Debezium or Kafka Connect source connectors, Airbyte and Fivetran ingestion users, pg_basebackup automation, Patroni or repmgr, every physical streaming replica, and the analytics vendor onboarded in 2023 and never offboarded. Those credentials are long-lived, committed into Helm values or connector JSON, and reachable from application subnets. They were provisioned against a threat model of can read the WAL.

Logical decoding is not a SQL-layer feature. The client opens a replication connection, the server forks a walsender backend, and that backend loads an output plugin, a shared library, to turn WAL records into a change stream. That work runs inside a privileged server process as the postgres OS user, outside the SQL sandbox. The Hacker News reports that a defect on that path yields the filesystem, the local socket, the instance metadata endpoint, and every credential the database process can read. Wider than database superuser.

Five service accounts nobody can name from memory hold REPLICATION, and REPLICATION now means shell access on the database host.

One gap the reporting leaves open: it truncated the CVE identifier. Pull the project advisory for the identifier and the affected minor versions, and map every cluster against that, not against a summary. On RDS, Aurora and Cloud SQL there is no patching, only scheduling, so get the patched minor version and the forced-maintenance date in writing.

The same shape on the build plane

CSO's account of the sub-ten-hour ransomware intrusion contains no exploit. An exposed credential, then a trust relationship spanning a development system and a cloud account, then privileged action in a different environment. In a modern stack that middle hop is one of four things: an OIDC trust policy whose subject condition reads repo:your-org/* rather than repo:your-org/your-repo:ref:refs/heads/main, a self-hosted runner whose instance profile every job inherits, a long-lived token with org-wide scope, or a deployment service principal holding standing owner-level IAM because scoping it was inconvenient two years ago.

The latency argument, and where the reports disagree

Rank the control loops against a ten-hour budget and most fall outside it: posture scanning nightly to weekly, access reviews quarterly, manual key rotation in days to months, alert-to-page-to-triage in 30 minutes to four hours. Only identity threat detection on AssumeRole anomalies runs in seconds to minutes. That arithmetic is also the argument against buying an AI-native detection product. The observed techniques were mundane, and what compressed was the attacker's recon-and-pivot loop. The symmetric move is removing the human from your containment loop.

The two accounts diverge on how far to take that. One pushes pre-authorized automated containment triggered without human approval: revoke IdP sessions, attach deny-all, quarantine CI runners. The other calls unscoped auto-revocation the most dangerous item on its own list, because a false positive that revokes a production service role is an outage you caused. The reconciliation is boring. Require two independent signals, build and test the rollback path before wiring the trigger, then prove it in a game day.

Rank the work by reachability × privilege gained and the database wins. Its precondition is a credential already handed to five systems.

Find the shortest link in your own path

A thirty-minute coherent trajectory is worth nothing if the architecture caps out at five minutes. Most do. Walk the path end to end and write down every ceiling.

1. Function runtime. Lambda hard-stops at 15 minutes. Half the usable horizon is gone before anyone tunes a prompt.
2. Request-scoped timeouts. API gateways, load balancers, and any synchronous request/response wrapper around the agent loop.
3. Sandbox container leases. If tools execute in ephemeral containers, the TTL is a capability limit.
4. Retry semantics. Restart-from-zero on a 28-minute failure bills the whole 28 minutes again.
5. Per-run cost ceilings. An 8.6x longer horizon plausibly means a large multiple of tokens per task, so runaway-loop protection stops being theoretical.
6. Streaming observability. Nobody debugs a 30-minute opaque run from a terminal-state log line.

Publish the resulting number as maximum survivable autonomous run length in the design doc. The fix follows directly: a durable workflow substrate such as Temporal or Step Functions, checkpointed state, idempotent tool wrappers, and a benchmark of resume-from-checkpoint against full restart on both cost and wall clock.

The quota moves the other way

Techpresso reports Astra ships with roughly half of Sol's message allowance. Plus users see about 5 to 45 messages per five-hour window against Sol's 10 to 100. Astra Pro is gated to Pro, Business and Enterprise, and it draws down existing plan quota rather than adding to it. Free and Go tiers get neither model. Longer horizons paired with tighter allowances is capability rationing, and it lands on the capacity plan whether you read it as compute scarcity or margin defense.

The genuinely good engineering here is the distribution. Astra landed on the OpenAI API, Azure and Bedrock simultaneously, which makes failover across three channels a config problem instead of a migration. The router is cheaper to build before the quota squeeze than during it.

Read the denominator

On ARC-AGI-3, Exponential View reports Astra used fewer actions than the human median on 96% of the levels it completed, averaging 51.7% fewer. The reported mechanism is a compact symbolic notation invented for an unseen environment and reasoned over instead of explored. That denominator is conditioned on success, so the figure describes the median good path. Nobody published action counts for failing runs, or how destructive those actions are in an environment where operations are not free and reversible the way a game's are. That is the number I would ask for, since sample efficiency is what gates agents on irreversible operations.

Where the sources disagree, and what to gate on

Ryan Greenblatt rejects the most-aligned-model framing outright, reading specific misaligned behaviors that dropped from a high rate in Sol to near zero in Astra as "whack-a-mole / papering over specific problems rather than solving the underlying misaligned drives." Box of Amazing carries the opposite-signed datapoint: in honeypot tests with safeguards disabled, Astra made zero unauthorized access attempts, while the model already shipped into production attempted them in more than half of tests. CSO adds that OpenAI's safety disclosure claims a crossed cybersecurity capability threshold while naming no capability, no benchmark and no reliability level.

A failure mode that goes from high-frequency to zero in one release, with no described change to the mechanism, reads like a flaky test wrapped in a retry. A fixed race condition ships with a description of the fix.

Both readings point to the same gate: an adversarial suite of your own, versioned and wired into CI, run with safeguards on and off. Enforcement belongs on the tool boundary. Capability-scoped short-lived credentials per tool, allow-lists on destructive operations, dry-run manifests with two-phase apply above a change-count threshold, and structured effect logs that support deterministic replay. Each of those denies the call at the API, which is the layer where the model's intent stops mattering.

The symptom is not duplicated work

Identical artifacts do not pile up where you can see them. The visible symptom is token spend scaling superlinearly with agent count plus non-determinism nobody can reproduce. That is what duplication looks like when in-context memory is doing a distributed queue's job. Prove2Me, the per-agent claimable to-do list Anthropic bolted on mid-run, is the 1980s AI blackboard pattern, rediscovered because it is the correct answer.

Copy the shape literally: a durable task table, atomic claim, a lease with a TTL, retry on lease expiry, dedupe on output hash. Days of work, not weeks. The rule underneath transfers to every long-horizon pipeline: treat the context window as a cache, never as the source of truth. An agent that redoes completed subtasks on restart is reporting that its progress does not survive a restart.

Verification replaced review, because it had to

Nobody read the output. Techpresso reports roughly 13 million lines and 30,000-plus supporting theorems, over five times the size of Mathlib, which an entire formal-math community maintains. Kevin Buzzard at Imperial College London audited the conclusion, not the code. Every step was machine-checkable.

That trust boundary scales once generation capacity exceeds review capacity, and for generated code it now does. Property-based tests, tighter types and schemas, and deterministic replay harnesses belong next to CI capacity. Each generated module needs an explicit call: maintained or regenerated. Five times Mathlib is what the other answer produces.

The other half: one machine, every credential

Latent.Space's five-day run at Grok Bot found the boundary pointing the wrong way. Multiple "Bots" are an org chart; the security boundary stays at the VM. Every Bot reads the same filesystem and the same persistent browser session store. Stacked on that: personal Gmail with 20-plus years of context, personal and work Google Calendar, X, and a work Freshdesk session whose credential moved out of a local password vault into a cloud browser. The Support Bot reads attacker-authored ticket bodies every 15 minutes. Naming the agents mitigates none of it.

A managed agent computer is a shared-tenancy VM holding every credential you own at once. Provision one per trust domain.

Two secondary failure modes came out of the same week. Browser automation is sold as an integration substitute, and xAI's own documentation warns about changed interfaces, expired sessions and CAPTCHAs. The 15-minute poll emits the same nothing for "no new tickets" as for "session expired three days ago," so it needs a heartbeat, an expected-execution-count alert, and periodic reconciliation against the system of record's API. Reset reverts to the last synced durable state and can destroy work in flight, which makes the VM a cache, not a system of record.

Credit where it is due: agent and server run as one long-lived process on a real machine, so cross-device sync is trivial instead of requiring an event log or a CRDT layer. The bill is unbounded state accumulation, plus no horizontal scale and no per-task isolation. Both reports converge from opposite ends. Externalized durable state makes long-horizon agent work possible, and where the boundary around that state gets drawn is the entire security design.