The block was freed and the bytes stayed
A container platform handed one customer's deleted disk blocks to the next, GitHub stopped accepting a live session as proof of a person, and two practitioners wrote down why scheduled feedback fails.
How we Organise
Scheduling feedback is what stops people giving it
Two Thoughtworks practitioners published an account on 24 September of how peer feedback is exchanged there. The antipatterns are the sharper half of it. They name four: feedback timed to coincide with performance reviews, the praise-criticism-praise sandwich, orchestrated feedback events, and feedback farming. Against those they set feedback given in private and in real time, on the work as it happens. There is no measurement in it. What they offer is an account of what two people have watched work and watched fail.
We tell a client that the teaching sits beside the work rather than in a slot booked for it.
Coaching happens on live cases.
Three of their four antipatterns are the arrangements a firm reaches for when it wants that teaching to become a calendar entry. The support is worth having because it comes from people with no stake in our method. What the article does not settle is whether any of this travels. One consultancy’s culture, described by the people who built it, is not a population. A reader could hold that candour of this kind rests on who a firm hires rather than on when the conversation happens.
How we Assure
A live session stopped counting as proof that somebody is there
GitHub put proof of presence into public preview on 24 September. When a member of an enterprise account reaches for a high-impact action, creating a token or changing an organisation’s security settings, GitHub sends them back to their identity provider. The action goes through only if they return having satisfied the policy set there. Stolen session cookies are the reason given. Long-lived tokens turning up in recent supply chain attacks are the other reason. The changelog also names agents taking an extra step without the account holder knowing. One successful challenge then carries for two hours.
Ask a firm how its agents are governed and what comes back is usually a document.
The rules the agents run under are codified as policies with tests rather than held in a standard nobody can check.
GitHub has built the other thing: a policy evaluated at the moment of the action, which refuses that action when it is not satisfied. It is not the whole of what we ask for. The policy governs the person at the keyboard rather than the agent, and everything inside the two-hour window proceeds on the strength of one earlier challenge. It is in preview, for one identity provider, and no figure is published for how many enterprises have switched it on.
Deleted disk blocks came back readable to the next tenant
A researcher reported on 4 September that a paying Cloudflare account could read residual disk blocks left behind by other customers’ containers on the same host. Each container gets its own virtual machine and its own writable disk, carved from a pool shared across accounts in 64 KiB blocks. That pool was set to skip zeroing a block before handing it on. So a 4 KiB write claimed a whole block and left the remaining 60 KiB holding whatever the previous container had put there. The researchers found residual material on eighteen of twenty-four production placements across four continents, including directory structures, database pages and complete SQLite databases. Cloudflare turned zeroing back on within six hours. It then retired every running container disk, because the first fix left blocks already mapped untouched. Cloudflare Sandboxes runs on Containers.
This is the substrate a good deal of agent execution now sits on, and it is where we ask a firm to draw its line.
Agent execution runs inside a declared boundary, and every path out carries a named approver.
Cloudflare declared a boundary at every level that test reads. Each container had its own machine and its own disk, and no path out needed an approver because the design left no path out to approve. The test passes. The bytes crossed anyway, one layer below where the boundary was drawn. This is not the first source to argue it. A researcher spent August getting Claude Code’s auto mode to treat its own safety classifier as both the boundary and the approver. That is the same test passing on a different mechanism. What the disclosure does not settle is how much of this reaches a reader’s own exposure: the technique could not be aimed at a chosen victim, no live disk was touched, and Cloudflare’s review of its own telemetry found nobody but the researchers using it. Somebody could reasonably read a flaw found by a bounty hunter and closed inside three days as the arrangement working. Tell us where you think the line really falls, at transform@dromologue.ai.