The Refusal Rate Is the Product

The industry’s current bargain is simple: give the model a browser, a calendar, a payment method and just enough persistence to become an unusually diligent junior colleague. Then call the resulting blast radius productivity. Meta’s new Muse embodies the pitch: a personal agent that can plan multi-step work, run in the background, connect to services including email and calendars, fill forms, book appointments and shop.

To Meta’s credit, its product page at least acknowledges that an agent which can do things must be governed differently from one that merely produces eloquent fog. Muse says users can approve sensitive actions, inspect an audit trail, use a dedicated persistent virtual machine, and permit an action once, always, or not at all. Its credential store is described as inaccessible to the agent itself; shopping uses a one-time card number. These are not decorative features. They are the product.

But “certain actions” is doing the sort of work normally assigned to an overloaded SRE. Muse is free up to an unspecified usage limit, with a paid tier beyond it, while the page leaves undefined which actions demand approval, what standing permission really entails, and the practical boundaries of its safeguards. The market is racing from chat interfaces to delegated authority. In that transition, the approval model is not a settings-panel detail. It is the constitution.

While consumer AI firms construct permission dialogs, attackers have discovered that autonomy also scales the less wholesome parts of software delivery. Google Threat Intelligence Group, as reported by The Hacker News, says an unnamed financially motivated actor used an AI coding chatbot and a multi-agent framework to compromise thousands of third-party credentials in under six hours after gaining access to an unnamed organization’s cloud environment.

The disturbing detail is not that a model wrote malicious code. Humans have managed that grimly well for decades. It is that the system reportedly coordinated scanning, troubleshooting, credential harvesting and IP rotation. Google described the operation this way: “Using preconfigured markdown instruction sets as operational playbooks, the threat actor conducted automated scanning and credential harvesting, compromising thousands of third-party credentials.” Markdown: the format that began as a way to make README files less ugly and has now apparently graduated to operational doctrine.

For engineering leaders, the implication is brutally ordinary. Cloud credentials, CI/CD environments, developer configurations and AI-workspace context are now high-value terrain because they are where automation gets its hands. The same report describes supply-chain compromises spanning PyPI, npm and Docker Hub, and credential-stealing payloads aimed at developer and cloud access. Agent security cannot end at model moderation; it has to cover identity, secrets, egress, workload isolation, package provenance and incident response. A model’s alignment is not much consolation after its service account has joined a botnet.

Mistral’s €3 billion funding round—led by Samsung and valuing the French lab at more than €20 billion—looks like another entry in the great compute-capex arms race. It is that. The company says the money will fund training infrastructure and international expansion, while investors including Nvidia, Salesforce Ventures and ASML place their chips around a lab known for open-source LLMs.

Yet Mistral is no longer selling merely weights and Gallic counterprogramming to Silicon Valley. Its stack includes managed models, synthetic-data tooling, custom-model development, guardrails, retries, registries, version control and agent-building services. It also sells Vibe, a pre-packaged code-generating and spreadsheet-automating agent that can run on premises. That is a sensible enterprise portfolio: customers do not buy a model because it has parameter counts; they buy a system because they have a ticket queue.

The strategic contradiction is that openness and deployability are features for legitimate operators precisely because they reduce dependence on a remote vendor—and, as Google’s threat researchers note in the credential-theft reporting, local deployments of open-weight models can also evade provider monitoring and safety controls. This is not an argument against open models. It is an argument against pretending the governance model for downloadable, self-hosted capability can be identical to API-gated capability. Sovereignty is useful. So, inconveniently, is accountability.

The most consequential argument about model refusals may not happen in a benchmark chart or a cheerful enterprise procurement meeting. The Intercept reported that a released Pentagon contract document described OpenAI “Mission Models” for national-security work as having minimal refusal rates. The phrase is disputed: OpenAI says it rejected that language and that the released document was a draft; a Pentagon spokesperson says it appears in no active contract.

That dispute matters, but it does not resolve the larger design question. A Justice Department lawyer representing the Pentagon initially said the document was signed and executed, then withdrew that confirmation. A subsequent February 27 agreement permitting OpenAI services on classified military networks retained the heading concerning testing and refinement of Mission Models, but the substantive text beneath it was fully redacted. The public is therefore left to inspect the metadata around a safety boundary rather than the boundary itself. Governance by PDF silhouette: robust in the sense that one cannot see the holes.

A former OpenAI safety engineer told the publication, “Minimal refusal is likely referring to little or no safeguards on the model being used.” That is an interpretation, not proof of the final contract terms, and the reported paperwork does not specify the relevant national-security tasks. Still, the connective tissue across this week’s AI news is hard to miss. Consumer agents need clear approvals. Enterprise systems need enforceable controls. Offensive actors exploit delegated execution. And state customers may seek models that decline less often. The refusal rate is not a personality trait. It is a statement about who bears the consequences when software stops asking.