Read-only was a sentence in the prompt
A trial whose headline number comes apart when you decompose it, a build record that now expires by default, and a database assistant whose read-only mode was never a permission.
How we Organise
The composite rose sixty-one per cent on work whose quality did not move
The UK AI Security Institute randomised 500 people to a 2025 model or to nothing, then set both groups four kinds of office task drawn from the O*NET taxonomy. Pooled, the treatment group scored 19 per cent higher and finished 25 per cent faster. The study combines those into 61 per cent more points per minute. Decomposed, that single figure comes apart. Quality moved on two of the four tasks. Organising, planning and prioritising work moved on none of the three measures at all.
We tell a client that whatever they count is what they will get more of, whether or not it is what they wanted.
The scorecard buys what it measures.
The composite rests on a stated assumption. Every extra minute is taken to add the same quality. The decomposition is where that assumption gives way. A firm adopting the number as a target would have bought speed and filed it as improvement. AISI fences the magnitude itself: a small sample, wide uncertainty, and a panel on designed tasks rather than employees on their own work. The hard part is that nobody has a better instrument, so the figure may stand as the best available for a while yet.
How we Build
Ninety days, and the record of what checked the build is gone
GitHub has brought checks, workflow runs and statuses under the Actions retention setting. That setting already governed artifacts and logs. Records past the configured period are now deleted on their own. Deletion happens at whichever level set the number. The rule covers what third-party applications write as well as what Actions does. Public repositories stop at 90 days. Raising the setting later recovers nothing.
Our position is that a team which cannot rebuild how an answer was produced has no way to stand behind it later.
An output nobody can reconstruct is an output nobody can defend.
What moved is where the default sits. The trace a team would reach for is now on a timer. Somebody has to go and lengthen it, and the platform most teams build on is the one that set it. A changelog is a policy rather than a measurement. Nothing here says which period firms choose, and the awkward part is that a team tends to discover its own setting at the moment it needs the record and finds it gone.
How we Assure
A database owner wrote the instructions a sysadmin’s assistant followed
Johann Rehberger took apart Microsoft’s Copilot in SQL Server Management Studio, and Microsoft published the result as CVE-2026-65669 and rates it critical. Copilot runs on whatever session the user connected with. Its read-only mode turned out to be a line in the system prompt plus a regular-expression blocklist. A declared variable holding sp_executesql went straight through it. Data then left the database row by row, through a directory-listing procedure and through a tool meant for checking backup files. The chain closes on intended behaviour rather than a bug. Copilot reads instruction files kept as extended properties, attaching one needs only ALTER on the object, and the attacker finishes in the sysadmin role.
We ask a client to know who can put words into an agent’s head, and to be able to say where anything it reads came from.
What an agent believes can be written only by identified writers, and what it retrieves has a stated provenance.
Every writer in this chain was identified. The principal who attached the instruction file held a documented permission on that object. So the condition above reads true at this deployment while a database owner walks out holding sysadmin. How far it travels is unsettled. It is one product and one researcher, the mechanism is peculiar to SQL Server, and Microsoft publishes administrative controls that nobody measured here. If you read that condition differently, or you run a deployment where it held, write to transform@dromologue.ai.