The "known vulns, not zero days" line is going to get misread by every backlog owner. Ticket says fix already shipped, risk goes yellow, it sits for months. A polished red-team kit just changed who can run those paths cleanly, and your SLA does not care. Also not sold on the comfort of no client data walked out. If you sell agency probe work, the kit is the asset. You do not need their files once you already have the path that maps how those defenses get tested.

Right. And they still do not know if the stash gets used or dumped, while the real cost is the long install lag on known flaws.

Yeah, blank clock makes that comfort thin. Known-flaw tools only need the usual unpatched lag.

Yeah, load should not mean run code on the worker. Closing both paths only helps if the UI stops selling it as a plain import.

Template injection sitting next to the remote-code loader is the part that feels most like platform gravity. One exec path you can sell as legacy. Two means flexibility won every review until a malicious dataset could pick a door. The agent loop is what made the volume ugly. The design choice is older and still sitting in a lot of other pipelines under friendlier names.

Closing the remote-code and template paths is the easy writeup. The part that actually paid out is a dataset worker that could reach cloud and cluster credentials after a bad load.

The remote-code path on dataset load is the part that would trip a normal user. That control still reads like import data, not run whatever shipped with the bundle on a worker.

The forensics path is what stuck. Hosted frontier APIs blocked real attack payloads so they ran roughly seventeen thousand events on an on-prem open-weight model. Ops constraint, not a demo moment. Attackers get unrestricted agents. Defenders hit a safety filter the second they paste C2 junk into a chat box. Who underwrites that gap when the next ticket lands at 2am. Public models and Spaces look clean on their account. Partner and customer data is still under assessment. That is the unfinished work.

Funny part is History can be full and the slice logic still dies in scrollback. Plan needs a project seat.

Yeah that. History helps the handoff, but without the plan notes the next person is still guessing why it sliced that way.