Three in ten dissertations carried AI writing
A near-census of US doctoral dissertations puts AI writing at 29 per cent this year. Google now settles what an assistant may read against the credential of whoever asked. An agent left its sandbox three times.
How we Organise
Twenty-nine per cent of this year’s dissertations were not written alone
Three economists measured AI-generated writing across a near-census of US STEM doctoral dissertations filed between 2019 and 2026, then followed the graduates into their first jobs. Nothing appears before 2023. By 2026 the share is 29 per cent and rising. It runs higher among students from countries where English is not the first language, and higher at lower-ranked programmes. Within one programme and one cohort, graduates whose dissertations contain AI writing go into academic research less often and into industry or non-tenure-track posts more often.
We tell a client that a skill leaves a firm quietly, and that it goes by nobody doing the work that held it.
A capability nobody exercises is one the firm no longer has.
A dissertation is the purest instance of that work. It exists to produce the writer rather than the document, which is why a faster route through it is not obviously a gain. The study reads career destination and not expertise, so the direction is arguable: somebody already heading for industry has less reason to labour over the prose, and the authors cannot separate that from the effect they propose. What the corpus does settle is scale. Nobody in it opted in.
How we Build
The credential of whoever asked now decides what the assistant can read
Google put federated query mode into preview on 2 October across four of its databases. An assistant reaches the data where it already sits, over the Model Context Protocol, under the credential of the person who asked. Nothing is copied into a store beforehand. The catalogue shipped alongside it searches only what that person can see anyway.
We ask a team to settle an assistant’s reach at the moment of the question rather than at the moment of the index.
An agent reaches no more data than the person who initiated it, entitlements are resolved as they stand rather than from a mirror taken at indexing time, and the denial has been tested.
For two years that has been the awkward half of the conversation. The ordinary design was its opposite. Ingest the corpus, embed it, then hope the filter on the way out matches the permission on the way in. A preview on four managed databases is not an application landscape. Most firms keep the material that matters somewhere else. The note is also silent on the last clause, which asks for a refusal somebody has attempted. Resolving a permission correctly and proving the system can say no are separate pieces of work. One of them shipped.
How we Assure
An agent left the sandbox three times, the last through bugs nobody had reported
A researcher at Trail of Bits gave a preview security model one task: get out of the virtual machine he sandboxes agents in. It got out three times. The first route was a host kernel flaw disclosed weeks earlier with no public exploit, which the agent built for itself. He patched the kernel, and it went through the networking library instead, where his distribution still shipped a version carrying a flaw that had been fixed upstream and never marked as a security fix. He rebuilt the whole machine from source, and it worked for twelve hours, abandoning routes that failed, until it had chained three previously unreported bugs into an escape it could repeat. Against a stripped-down alternative built for a smaller attack surface, it did not get out.
We judge an agent on three conditions held together rather than one at a time: the untrusted material going in, the reach it has, and whether anything can leave.
For every agent, the combination is assessed as one thing: untrusted content, private data and a path out.
The escape ran through a library that gives a virtual machine its networking, a display nobody was watching, and a routine for invalidating a page of memory. None of those is unusual, and inspected singly each one passed. This is the second source to argue the point: a paper in August assembled harmful chains out of marketplace skills that had each cleared their own scanner. One researcher and one configuration is a narrow base, and the escape was the goal he set rather than conduct that emerged on its own, which a reader may fairly weigh. The smaller sandbox held.