The title did not change and the pay did
Advertised pay in the most AI-exposed American occupations has grown almost twice as fast as in the least exposed, GitHub is closing the trigger that let a fork's code run holding a repository's secrets, and a security vendor has published why a rogue-looking agent action is not the same thing as an attack.
How we Organise
The same titles are advertised at 4.7 per cent more than before
Indeed’s Hiring Lab sorted American occupations by how much of their required skill set generative AI could take over, then tracked advertised salaries in each group. The most exposed occupations are up about 46 per cent since 2021, against 25 per cent for the least exposed. They then narrowed it until each job title was set only against its own past. A premium of 4.7 per cent survived. The fear was that exposure would push pay down. It went the other way.
We tell a client that the box on the org chart is the last thing to move.
A role changes when its content changes, not when its title does.
The market has now priced that. Data engineers are paid more to be data engineers. The work inside the label moved while the label sat still. A firm that reviews its people by reading job titles will find a year in which nothing happened to any of them. Advertised pay is an offer rather than a wage, the postings are American, and Hiring Lab calls its own seniority split suggestive. The size is open. The direction is not.
How we Build
A fork’s pull request could start a job holding the repository’s secrets
GitHub has taken workflow execution protections out of preview. They are an allowlist checked before a run starts: one set of rules for who may trigger it, another for which events may. Rules can be scoped to a single file now, so a deployment workflow can be held to one team while the test workflows stay open. And the trigger that runs a fork’s code with the base repository’s secrets is being disabled by default on public repositories, in evaluate mode from today and enforced from 2 November.
What we ask of a client is that nobody can borrow authority by pressing a button.
The scope a run carries in development is the scope it runs under in production, and never more than the person who initiated it holds.
Someone who can open a pull request and nothing else could start a run that reads every secret in the repository. GitHub now treats that as the wrong default rather than a setting. The fix sits at the trigger and not in the grant. The run’s own permissions are untouched, and only the list of people who may start it has changed. Private and internal repositories are excluded, which is where most firms keep their pipelines.
How we Assure
A malicious prompt that a boundary stopped is not an incident
Wiz has published how it grades an agent’s intent. Model input and output logs run through a chain of models that returns a verdict on what the agent meant to do, and that verdict is then set against the API calls, processes and network connections that followed. A tool call can look ordinary in the logs while the runtime shows it opening a reverse shell. A prompt that reads as plainly hostile can turn out to have reached nothing, because a sandbox or a permission boundary stopped it first.
We argue with clients who want one alarm for misbehaviour and for malice.
Not every rogue action is an attack.
Wiz cannot separate the two either, and says so: the reasoning alone will not do it. Their benchmark runs more than a hundred simulated scenarios, 57 of them injected attacks and 45 benign, so the coverage was built to catch false alarms as well as real ones. No accuracy figure appears anywhere in the post, so nobody outside knows how often the verdict is right. A firm that wants any of this has to be keeping model input and output logs already, and most keep nothing of the kind.