Fastjson 1.x RCE Fires in Default Spring Boot, No Patch Yet

Noise as energy, not information

The mechanism tells you where this generalizes. Optimized projection vectors and pure random noise gave statistically identical result distributions (Mann-Whitney p=1.000). That kills any story where the prefix carries information. What is left is stochastic resonance — added noise pushes a weak signal over a detection threshold. The reasoning was already latent. The perturbation supplies energy to get it past the decoder's commitment to a formatting template.

The controls confirm it. Zero embeddings and mean embeddings buy about four points. Remove chain-of-thought and the effect goes to zero, so both diverse prefix values and step-by-step reasoning are required. The prefix is two vectors scaled to the model's native embedding RMS of roughly 0.022, at 0.097% overhead. The failure mode shows up in the token counts. Correct runs average 718 tokens. Wrong runs slam into the 1,024-token ceiling and truncate mid-format. On (45+23)*17-89 the baseline burned its budget formatting; the perturbed run produced 1067 in half the tokens.

The gates that decide whether it works at all

Majority voting collapsing below baseline is the counterintuitive one. When per-seed accuracy is under 50%, requiring a majority throws away correct answers that never reach the threshold.

Selection is the product

The number to build around is not 72%. It is 100% oracle coverage against 51.6% realized accuracy. A correct seed always existed and the scorer failed to pick it. That 48-point gap is pure selection loss. The perturbation loop is five lines of throwaway code. The verifier and voting layer is the real system, and the single point of failure. Instrument oracle-versus-realized before you touch anything else. EOS completion rate works as a cheap health signal.

The economics justify the experiment. Ten seeds cost $0.009 per query against $0.45 for frontier thinking tokens. At 10,000 queries a day that is $2,700 versus $135,000 a month, and under $15,000 versus $675,000 at 50,000 a day. Hardware follows the same logic. A $429 RTX 5060 Ti at 16GB pushes 200 tokens/second; a $1,999 RTX 5090 at 32GB runs about 96. Runpod's 16GB serverless tier is $0.58/hour against $1.58 for 32GB.

Where the evidence thins, and where a second source agrees

Sample sizes are small: 25 arithmetic, 5 planning, 12 legal tasks. The n=3 scout runs overstated gains, falling from 60% to 51.6% at n=10, so expect regression as evals scale. The legal scorer, a 300K-parameter MLP, was non-deterministic and broken on 9 of 12 tasks. On out-of-knowledge legal tasks, every condition fabricated content. Perturbation adds energy, not knowledge, so keep it out of compliance, medical and legal paths.

What raises confidence in the direction rather than the number is a separate release. Poolside's open-weight Laguna S2.1 activates 8B of 118B parameters with a 1M-token context, per TheSequence. Both results say serving configuration now moves cost more than parameter count. They diverge on cost of adoption. The sparse-MoE path needs no new verifier. This one is entirely gated on one you have to build.

The capability was already inside the small model; frontier pricing was paying to fix a decoding bug, not an intelligence gap.

What the regression actually is

The symptoms cluster the same way in every report: more comments, longer comments, large numbers of pull requests merged with no review, and incidents and bugs per developer rising sharply. The named mechanism is the training objective. Current coding models are rewarded for short-term functional correctness — does the test pass, does the task complete — not for the properties that set cost six months out: coupling, naming, error handling, the absence of a second code path that does almost the same thing. An agent optimizing the first will degrade the second. Every merge without review capitalizes that debt silently.

So the control surface is the review gate, not model choice. In pipeline terms, coach mode is three concrete settings: auto-merge disabled for agent identities in branch protection, a required human approver distinct from the agent that authored the change, and a bugs-and-incidents-per-developer series you can compare across an autonomy change. Skip the third and you are arguing about vibes. Keep it and the next autonomy proposal arrives with a number attached.

Your benchmark suite is measuring the wrong horizon

Model selection compounds it. Short-task pass@1 scores — the SWE-bench family, including the 79.2% SWE-bench Pro figure attached to frontier releases — reward exactly the behavior the field data flags. A model tops those and still ships the maintainability regressions that surface as incidents. Two long-horizon suites are named as additions worth evaluating: SWE-Marathon and Frontier Code, both aimed at multi-PR tasks where a change has to survive later changes. Do not replace the suite. Add one long-horizon test and watch whether its ranking disagrees with the short-task ranking. The disagreement is the signal.

Identity is the audit primitive nobody provisioned

Block's Buzz, released Apache-2.0 at github.com/block/buzz, is the most reusable piece of plumbing in the material reviewed. Each agent gets a Nostr cryptographic keypair independent of the platform, plus a second signature binding that agent to its human owner. That produces a verifiable passport and audit trail. Prebuilt harnesses cover Goose, Codex and Claude Code over the Agent Client Protocol. The value is the model, not the platform. Git attribution collapses when three agents and a human share one service account. "Which agent, under whose authority, made this change" becomes unanswerable at the exact moment an incident review needs it. A per-agent key plus an owner-binding signature answers it cryptographically. You can implement that pattern without adopting Buzz.

The containment lesson is the security half of the same posture: treat any agent-executed code as untrusted, with default-deny egress and short-lived scoped credentials.

Where the gate generalizes past code

The Bear Cave supplies the consequence case. Axon's AI-generated police reports get facts wrong in production, a Forbes finding surfaced by short-seller Jim Chanos, while the product is marketed on officer time saved. Fluent output is not correct output. In an evidentiary document a transposed fact is a due-process failure, not an annoyance. The architecture that survives it is the one that survives agent PRs: retrieval-backed grounding, a mandatory human verification gate, immutable audit logs, and a measured error rate against ground truth.

If you cannot state your system's error rate against ground truth, you are not managing the risk — you are hoping about it.

Three independent reads converge on the same conclusion, which is the strongest evidence on offer. The fix for agent-authored defects is not a better model. It is a gate you own, instrumented well enough to argue with.