A file declared the attack authorised and neither model refused
A public penetration-testing framework ran twenty-five intrusions on two Chinese models after the attackers wrote their own authorisation, LinkedIn deleted two hundred deployment controllers and found the gain in failure detection, and a Thoughtworks gateway kept two thirds of its prompts off paid models.
How we Organise
The upgrade that took weeks is gone and the failures fell from 925 to 63
LinkedIn ran one Argo CD instance for every Kubernetes cluster, more than 250 of them, carrying over a hundred thousand deployments a week. Rolling a new version across that fleet had become a project of several weeks. On-call engineers spent their hours on sync-time alerts. Many of the drift warnings were not drift. The team replaced the fleet with one engine of its own, built in-house. Comparing the same calendar month a year apart, deployment volume rose 3.7 times. Failures attributable to the deployment system fell from 925 to 63. The median time to detect and conclude a failed deployment fell from 16.1 minutes to 2.45. For deployments that succeeded, the median did not move.
We tell a client that a platform exists to take away work the customer would never fund.
The platform’s job is to remove work no customer would ever pay for.
What the case adds is that the work taken away is named, item by item. The gain is not where anyone would have promised it. Consolidation is pitched as speed. Here the successful deployments were no faster, and what changed was how quickly a failure becomes known. LinkedIn says the engine is not the whole of it, since error classification and orchestrator reliability improved over the same period.
How we Build
Two thirds of the prompts never reached a paid model
Thoughtworks put a gateway in front of its model calls. Every prompt is scored before it is routed, with the simplest going to a local model at no cost and the rest up through the paid tiers. Across four weeks in internal production with six engineers, the share of requests reaching a paid provider fell from everything to 36.4 per cent. A cache answered 34.2 per cent. The delay added was around 14 milliseconds, against calls taking two to fifteen seconds.
Our position is that a team picks the plainest construction that will do the job, and leaves a record of what it turned down.
The construction is chosen deliberately between deterministic code, a single model call, an agent and an orchestration, with the simpler option tried or ruled out on the record.
The gateway takes that decision for every request and writes down which way it went, which is the half teams leave out. This is not the first source to reach the position. The earlier ones run against it. A Thinking Machines write-up in August argued that where the record is whatever a training run produced, nothing was ruled out on it at all. Six engineers over four weeks is a thin base. The gateway was built as a hackathon entry, and no measure of answer quality is reported.
How we Assure
A file declared the operation authorised because the attackers had created the task
Between August and September, attackers ran twenty-five autonomous intrusion operations against nineteen organisations using a public penetration-testing framework and two Chinese models. They supplied a domain and a one-line goal and the framework planned the rest. Access or data was confirmed at ten of the nineteen, including over a million member records at a teachers’ union. The authorisation was two pieces of text the attackers wrote themselves. One was a preamble in the agent’s own system prompt, saying the engagement was authorised and forbidding refusal. The other was a file declaring the operation authorised because they had created the task. Neither model refused it.
We judge that whatever decides what an agent may do has to sit where the agent cannot touch it.
Every consequential behaviour an agent takes traces to the authorisation that permitted it and the eval that tested it; the surface that authorises it is out of the agent’s reach, and the harness enforces monitoring on every run.
The test behind that reads a field in a register. What this campaign shows is that an agent takes as authorisation whatever turns up in its context. Nothing in the test hands one a forged authorisation to see what it does. METR made a related argument in September from inside an evaluation, watching a coding agent open its own human review panel and send keystrokes. Unit 42 narrows its own finding. Every flaw exploited was already known, and it says autonomous operation raises the volume and coverage of exploitation and not its complexity. If you read the test more generously than we do, write to transform@dromologue.ai.