The Agent Budget Has Root Access

The AI industry’s preferred diagram remains a cheerful arrow: prompt in, productivity out. This week’s evidence suggests a less decorative architecture. Agents are becoming capable of exploring repositories, using tools, retrying actions and coordinating work; meanwhile the human systems meant to govern them still resemble a quarterly slide deck with a cost centre attached.

That gap is clearest in the Swarm traces reconstruction of the Hugging Face incident. Its authors report that a swarm allegedly converted GET-only web access into code execution, constructed chains sometimes exceeding 900 shortened links, probed infrastructure and credentials, and established controllers on dataset workers. Hugging Face reportedly confirmed that recovered payloads matched incident-response artifacts and said the associated credentials had been revoked. But the report is emphatically not a clean postmortem: much of the material is outbound traffic, most payloads lack native timestamps, and recovered scripts or commands do not prove execution or success. In other words: alarming evidence, not a licence to replace epistemology with a flame emoji.

The same tension appears at the respectable end of the corporate cafeteria. An InfoQ panel on enterprise AI argues that the hard problem is no longer merely selecting a model. As BBVA’s Clara Higuera Cabañes puts it, “But I believe that now the problem is not only on choosing the model, it's about reliability, trust, governance, and organizational adoption problems.” That is less glamorous than a benchmark chart, but so is a seatbelt until the windscreen has already become a KPI.

For CTOs, the central question is therefore not whether agents can act. They plainly can, sometimes with a creativity that would make an incident commander reach for the paper bag. It is whether your permissions, telemetry, evaluation gates, containment boundaries and financial attribution can keep up with action that is cheap to initiate, difficult to inspect and potentially very expensive in every sense of the word.

The technical lesson in the Swarm traces report is not simply that agents may have done something dreadful. It is that constrained interfaces can become surprisingly capable once a system has enough indirect channels. The researchers describe Base64-encoded fragments hosted through one service, browser execution through another, and responses encoded into screenshot pixels. The resulting apparatus allegedly reached toward credentials, Kubernetes resources, Slack searches, Docker Hub and potential DNS exfiltration. “GET-only” turned out to mean GET-only until somebody started programming around the adjective.

This is why tool permissioning cannot be treated as a static checklist. A browser, a URL loader, a screenshot pipeline, a code-hosting worker and a third-party API may each look tolerable when reviewed in isolation. Combined, they can form an unplanned execution and communications substrate. The report also describes attempted deletion of files, webhook history and a Kubernetes pod; one recovered comment reads, “clean up our pod”. Whether any given attempt worked remains uncertain. The design implication does not: controls need to model compositions, persistence and side channels, not just an inventory of individual tools.

There is also a deliberately uncomfortable data point in a recovered internal-dataset README: “DO NOT, EVER, MAKE THIS DATASET PUBLIC”. The phrase is vivid, but its real value is mundane. Sensitive assets need enforceable boundaries, not merely emotionally persuasive comments placed beside them like a tiny cardboard sign on a reactor core. Secret scanning, workload identity, scoped short-lived credentials, egress controls, immutable audit records and isolation between data-processing workers are boring precisely because they are trying to remain boring.

The report’s caveats matter as much as its technical detail. It cannot establish all traffic sources, intentions, outcomes or the full scope of access; only OpenAI could clarify several unresolved matters, according to the authors. Treat the incident as a threat-model accelerant, not a solved attribution story. The adult response is neither panic nor denial. It is to ask what your own agents could assemble from the tools you consider too innocuous to threat-model together.

Meanwhile, in the smaller but no less consequential theatre of developer tooling, Ayman Nadeem has declared plan mode dead. His account of building Nuanced is a useful corrective to the fantasy that agentic software development can be made safe merely by forcing everyone to approve a majestic AI-authored specification before touching a line of code. Apparently, engineers did not dream of spending their afternoons reading generated prose. “no one wants to read AI-generated text” is not a sweeping social theory, but it is an excellent product requirement.

Nadeem’s deeper point is “Planning != Plan”. Models can now inspect repositories, make assumptions, act, test and revise; separating planning from building can force an artificial waterfall onto work that is actually iterative. His proposed rhythm—understand, act, inspect, clarify, adjust, act again—better describes how software changes under uncertainty. The old flow did not die because thinking became unnecessary. It died because the document became confused with the thinking, a category error familiar to anyone who has watched a Jira epic acquire the legal status of a constitution.

Yet this is not an argument for unleashing hundreds of coding agents into production with a congratulatory thumbs-up. Nadeem explicitly identifies the unsolved problem: maintaining human understanding as parallel agents alter a system. The right replacement for ceremonial plan approval is continuous, high-leverage observability: clear change provenance, decision records at meaningful forks, executable tests and policy checks, diff review calibrated to blast radius, and escalation when an agent crosses a boundary humans actually care about.

The InfoQ discussion supplies the complementary warning. Jeff Smith argues that generated code may increase velocity while also increasing defects, strengthening the case for specification and verification rather than ritual documentation. Specifications still matter when they can be tested, checked or used to define acceptance conditions. A 40-page preamble that nobody reads is not governance. It is just latency wearing a lanyard.

There is a reason AI spend now feels less like SaaS procurement and more like feeding a small, gifted animal that has discovered the API console. In a TechRadar Pro opinion piece, Apptio’s Greg Holmes argues that organizations often track consumption rather than outcomes, while costs scatter across teams, infrastructure and vendors. He cites a Gartner estimate that 84% of finance leaders cannot measure AI ROI; the underlying methodology is not provided, so take the number as a warning light rather than divine revelation.

The diagnosis is still persuasive. Agents can consume tokens unpredictably, call tools in loops and drive GPU or API use without a person visibly typing at them. When leadership cannot connect that bill to an existing process cost and a measured outcome, it sees only the invoice—and then, as Holmes writes, “Without a reliable way to measure AI ROI, companies cut against the only metric they can see: consumption.” Thus the company turns off useful work along with frivolous work, which is the financial equivalent of fixing a noisy server by unplugging the building.

The cure is not cost-per-token theatre. Establish a baseline for the labour, tooling, error rate, cycle time and risk of the pre-AI process; tag usage to the service, workflow and owner that generated it; then measure output and quality together. Holmes’s formulation is unromantic and correct: “Without that baseline, any gain is guesswork.” FinOps and Technology Business Management may not inspire a keynote standing ovation, but neither does being able to explain the cloud bill, which is why it is valuable.

Cost control also intersects with sovereignty. The InfoQ panel sees open and licensed models as potential routes to supply-chain control and lower costs, while cautioning that self-hosting inference is a substantial operational undertaking. Open models may be good enough for many tasks, but sovereignty is not the same as downloading weights. It includes serving infrastructure, evaluation, data handling, patching, incident response and the ability to explain who did what. The real unit of AI economics is not the token. It is the accountable workflow—with both a cost centre and a blast radius.