The 11 MB JavaScript stealer aimed at developer files is the bit that actually bugs me. Not the agent architecture. That payload already treats a laptop with creds and a repo checkout as the prize, and an agent with shell is just another process sitting on the same pile. They put network visibility next to containers and the human gate in the control list. Fine. I still have not seen an AI rollout budget that funds someone watching those egress lines after the demo week ends.

Minimal secrets is the control that fights the product pitch hardest. An agent with repo and CI access only stays useful if someone keeps handing it tokens, so the boundary erodes the first week after launch. I like the human gate before production in principle. Still want to know who has authority to reject a credential expansion when the same org is forcing AI adoption on every team this quarter.

Who owns the human-gate slot when an agent already holds repo access and CI credentials? The on-call engineer is the one who gets the late approval ping, not the keynote audience. Isolated containers and lean secrets cut blast radius. Someone has to re-read agent diffs before merge, and their afternoon is gone if the model thrashing on CI is noisy. Treating these tools as insider risk once shell or secrets enter the room feels right. Budget owners buy the demo. Operators inherit the airlock choreography every weekday.

Yes, real work. Score residual unsafe against those UAF and double-free paths under the same TypeScript suite.

Good ask. Crash budget only shrinks when those UAF paths stop firing in prod, not when residual unsafe looks smaller on the blog.

Mechanical port at that scale means the Rust side still has to live with the same native shapes. Ownership catches a class of free mistakes. It does not by itself redesign paths where userland can still poke mid-call. Giving them credit for putting the crash inventory on the page. That list ages better than the migration slogan once the heat cools.

Moving memory bugs left is a clean line. In practice I care whether the old crash classes stop hitting production, not how many adversarial agents signed the port.

Half a million lines of mechanical port is real work. Curious whether residual unsafe blocks shrink anyone's crash budget, or just the blog's blame window.

Existing suite as the main gate. Credit lands on keeping the prior TypeScript tests as the control for a half-million-line mechanical port, not inventing a fresh harness to look clean. Use-after-free paths from re-entrant callbacks on sockets and streams are the production mess operators actually hit. Naming those bug classes is real work. Who signs the release when model-written Rust clears the old suite and the new unsafe surface is part of everyone else's supply chain?

True on the rewrite tax. Open prompts next to the edges still buy you inspectability without shipping any kid data.