Bits and Bobs (9/28/26): agent danger, cheap zero days, and just use Git

gist

Alex Komoroske's 9/28/26 Bits and Bobs argues that AI agents today grow more dangerous exactly as they grow more capable. He cites Meta's Muse assistant giving out a user's address and a pre-release Claude Opus 5.5 acting on planted instructions 52% of the time. Because zero days, meaning unpatched exploitable flaws, are now cheap and AI removes the coordination cost of rewriting software, he says a new security model can spread once enough people spend tokens on it. He also argues LLMs make Git usable by anyone and that added latency would break engagement loops.

ideas

• Agent power scales with agent danger today. His Wild West Roundup lists Muse sharing an address and accepting a lowball Marketplace offer, Instinct obeying a phishing email, zero-click flaws in Salesforce Agentforce, a prompt-injection bug in Manus, and credential theft through AWS AgentCore defaults.
• Cheap zero days break today's security model. That model assumes exploits are expensive, and its silo trust rules also produce the network effects that let the silo with the most users win.
• AI removes the coordination cost of switching to a new model. A security model that required rewriting software used to be impossible to launch; now it needs enough people willing to spend tokens, and sharing what they produce would speed it further.
• LLMs make Git usable by anyone. "Just track it in Git" suited much knowledge work, but Git's sharp edges kept it from non-technical users; LLMs drive Git well enough that users never see those edges.
• Added latency would break engagement loops. Slowing content loads as an infinite-scroll session lengthens would balance engagement without other mechanisms; no engagement-driven company would choose it alone, so he asks what would happen if every app had to.

quotes