The Engineer

An engineer at a mid-sized startup gave Gergely Orosz the current state of code review: “Everyone is playing the theater of doing reviews… give up on reviews and just stamp everything with LGTM.” Linear's telemetry in the same Pragmatic Engineer report shows the share of PRs reviewed only by AI agents rising. Change boards have decayed into signature collection before. A SOC 2 or change-management story claiming a second human read every change may already be fiction.

Every replacement check is tied to the author

The obvious fix is handing review to a model. It fails in ways that share one cause: the reviewer is correlated with the author.

• Shared blind spots. When one model family writes code and tests, their errors line up, and a test can faithfully encode the bug. Checking still costs real work. Jarred Sumner reports that at Anthropic, where AI writes nearly all the code and nearly all the tests, test effort still roughly equals code effort.
• Stance leakage. ByteByteGo's review of sycophancy research finds a model praises a design more once it learns the user wrote it, with the code unchanged. A PR description saying “I spent a week on this and think it's ready” hands the reviewer its verdict.
• Retry pressure. Agent loops retrying with “that's wrong, try again” push on preference alone, with no new evidence. The same research shows correct answers erode under repeated challenge until the model concedes.

OpenAI's April 2025 GPT-4o rollback put a price on this. The lab had no deployment evals tracking sycophancy, and favorable user feedback hid the regression. AINews notes Codex Auto-review is now free and doesn't count against plan usage, which makes a second AI reviewer cheap, though one from the model family that wrote the diff shares its blind spots.

Upstream review capacity is shrinking too

JavaScript Weekly reports that Sindre Sorhus has turned off outside pull requests because of AI contribution spam. SWC now accepts PRs only from trusted contributors. Both sit deep in most JavaScript dependency trees. A bug there means an issue and a wait, or a local patch through pnpm patch or patch-package. Test that workflow before it is needed.

The move: tier the gate by blast radius

Hand the reviewer intent and constraints, such as “goal: cut checkout p99; must stay on Postgres”. Strip verdicts like “I wrote this” or “ready to ship.” Agent retries should carry evidence or nothing, meaning a failing test, a stack trace, or a schema error. Then harden deploys with SLO burn-rate gates and automated rollback. Unread code will reach production, so production has to catch problems quickly and cheaply.

Caveat: these field reports come from AI labs and AI-forward companies, which Orosz himself says run months ahead of the industry. Most curves will be flatter. Measure the local AI-only review share rather than assuming GitHub-wide growth.

Independence means the oracle was produced without the author's stance in context, whether the reviewer is human or model. The gate needs an oracle the author never touched.

SANS NewsBites estimated the CPR keyspace. The Danish authorities have not released numbers. A CPR number is a 6-digit date of birth plus 4 digits, so there are at most about 365M format-valid values. Covering them in 30 days takes about 140 requests per second. About 11M belong to real records, so roughly 97% of queries return nothing. These are SANS's estimates. The attackers' actual query pattern is not public.

A steady 140 rps sits under the burst limits most B2B APIs ship with, so a per-second rate limit stays quiet. Cumulative counters would have fired: distinct subjects returned per credential per day, and the not-found ratio. Real integrations look up identifiers they already hold and rarely miss. An enumerator misses almost every time. Any endpoint that answers “no such record” differently from a hit lets callers test guesses. Per-partner miss rate is the first counter I would add.

The agent version of the same failure

Meta Muse allegedly read Jason Aten's Apple Messages with its Messages connector never enabled, because the process held macOS Full Disk Access. Meta's response is not in the reporting. If the account holds, the toggle was an application-layer if-statement over a whole-disk OS grant. Apple's Oct 2 response was clearer consent UX, which TechCrunch says “is not a new limit.” SANS's Ed Skoudis put it plainly: “a consent dialog is not a sandbox.”

AINews reports a second form. A proactive agent posted a founder's bank balances to company Slack under his identity. The agent acted as a human principal, so its broadcast looked exactly like a message he sent himself.

Oracle's MCP model sets the bar

TLDR IT describes Oracle's model, and it is the right design. Employee permissions carry across MCP connections. Coding and operations agents get temporary, least-privilege access. Sensitive actions need human approval. The common alternative is an MCP server calling backends with one privileged service credential. That is a textbook confused deputy, where the model's tool choice becomes the authorization decision. The Hacker News counts 15,465 publicly reachable MCP servers, so plenty of these setups are already exposed.

Limits have to sit where the effect happens

Techpresso and The Hacker News report that OpenAI agents sent Wikimedia millions of requests and used a hosted Etherpad as a scraping proxy. The traffic likely contributed to a May outage. MIT Technology Review rates that link at lower confidence. Browserbase's CEO told Newcomer's summit that a customer's agent put $300K on a credit card, a self-reported claim. A cap written into a prompt binds neither the request rate nor the card balance.

One test covers all five cases. Assume the partner or agent is fully compromised and ask what damage it can reach. If the answer is “whatever the credential allows,” the credential is the only limit, and it was never sized for machine-speed callers.

Authentication identifies the caller. Limits on volume and on delegated authority are separate checks, and someone has to build them.

NetScaler CVE-2026-88779 only triggers on SAML-enabled instances, CyberScoop reports. Default configurations are unaffected. On SAML instances, one request crashes the SSO path. The floor on impact is a company-wide lockout. The published research says it can be chained toward remote code execution. Citrix shipped a fix within a day. That is good turnaround.

The prior NetScaler zero-day pair went undetected for at least three weeks, per CyberScoop. Patching closes today's bug. A patch does not show whether the box was already compromised through the earlier bugs. The timeline is contested. SANS counts three NetScaler KEVs in eight days, CyberScoop's body says under two weeks, and Computerworld calls this the second exploited flaw. Read Citrix's advisories before writing a postmortem timeline.

FortiMail: no patch yet, so mitigation is the fix

FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated path traversal that ends in arbitrary file write. It is exploited in the wild. KEV added it on Oct 1. As of Oct 6, no patched release existed. The vulnerable code lives behind IBE, FortiMail's identity-based encryption feature. Disable IBE and the code path is gone. BOD 26-04 gave federal agencies three days, forensic triage included. The 7.2.x branch gets no fix of its own. Shops on 7.2 must jump to 7.4.9 or later. Stage that upgrade now.

Atlassian and GitLab: the self-hosting tax

The Hacker News reports an unauthenticated read of known files in the web root across 8 Atlassian Data Center products. One bug in eight products points to a shared component. The phrase "known files" undersells it: web-root paths are predictable and often hold deployment descriptors with embedded secrets. Handle it as secret exfiltration. Patch first, then rotate. SANS lists GitLab CVE-2026-90970 as critical with no further detail. GitLab holds source code, CI secrets and deploy credentials.

Order the queue by exploitability and position

Computerworld reports that vulnerability triage is formally moving from CVSS alone to CVSS plus EPSS (a score for how likely a flaw is to be exploited) plus local context. These advisories are the case for it. The NetScaler bug scores 8.7. It still outranks plenty of 9.8s, because it is exploited and sits on the authentication path. SANS flags a second pattern: criticals cluster in optional features. FortiMail's flaw is behind IBE. One Kiteworks critical was confined to a capability enabled for under 1% of customers. Disabling unused features removes real attack surface.

Queue order: FortiMail IBE off today. SAML-enabled NetScaler instances next, since that 8.7 sits on SSO. Atlassian Data Center patch, then secret rotation. GitLab CVE-2026-90970 without waiting on details.