Hacking Didn't Get Smarter. The Blast Radius Did.

Hacking, as a craft of patience and curiosity, did not suddenly become genius because models exist. What changed is how far a single compromise travels, and how professional the travel looks.

The boring truth: most damage is still credentials, trust, and automation doing what it was told. The 2026 texture is that "what it was told" now includes agent harnesses, CI that publishes because the commit was signed, and developer machines that treat opening a repository as the start of a workday — which is also the start of execution if the repo brought its own chores.

Supply-chain worms are not a movie. They are a reminder that a maintainer account is a distribution network. Poison a package people already trust, harvest the next set of tokens, repeat. Provenance can tell you the build came from the right workflow. It cannot tell you the person, the laptop, or the GitHub identity behind that workflow was still themselves. Attestations are necessary. They are not a personality.

Agent-native shops inherited a new persistence story without asking for it. Project settings, session hooks, editor tasks that run because a folder opened — these are convenience until they are someone else's convenience. The industry lesson is not a recipe. It is a posture: treat repository-controlled automation as executable content. Inventory what runs when a human arrives. Restrict high-value tokens. Prefer ephemeral CI. Assume that "helpful" config in a cloned repo is a trust decision, not interior decoration.

Duty of care for maintainers is heavier than the README implies. Publishing is a public health act. Token hygiene, 2FA that is actually on, a sceptical eye on new workflow permissions, a plan to rotate and rebuild if the machine might be dirty — this is the unglamorous half of open source that paid the bill for everyone else's velocity.

Duty of care for product teams is similar and closer to home. Do not give an agent production-shaped secrets to be helpful. Do not auto-merge the path that prints money or identity. Do not confuse a clean diff with a clean origin. Review the harness — the rules, the hooks, the MCP servers — with the same seriousness you review the TypeScript.

This is not a call to romanticise attackers or to publish their homework. It is a call to stop designing systems that assume the only actor is a well-meaning developer with a coffee. The blast radius grew because we connected more powerful tools to more trust. Shrink the trust. Keep the tools. Stay boring on purpose.

Leaders will ask for a briefing that sounds like a thriller. Give them operations instead: inventory of agents, inventory of tokens, what runs on clone, who can publish, how fast you can rotate. The industry does not need more mythology about hooded genius. It needs fewer machines that trust a README.

If you write about this work, write like a grown-up. No recipes for harm. No admiration for the worm. Name the failure of trust, then fund the boring controls. That is how you stay on the right side of the craft.

Boring is a security strategy. It always was.