Every system you build has a perimeter. The mistake isn't letting things in. It's not knowing what they do once they're inside.
That's the thread connecting five stories that look completely unrelated this week. A government security breach. A funding round for AI agents. A mushroom threatening native forests. A debate about songwriters and AI scraping. An engineering retreat about how to keep LLMs from going blind inside their own context windows. Same pattern, different costume. Something useful gets introduced into a bounded system, and the people running that system underestimate what it will do when nobody's watching.
CISA, the agency responsible for protecting US government infrastructure, had a contractor push dozens of internal credentials, including AWS Govcloud keys, into a public GitHub repository. Those credentials sat exposed for nearly six months. Not because someone attacked them. Because someone was let in, given access, and then trusted without a monitoring layer to catch what they did with it. The threat wasn't external. It was inside the perimeter, doing its thing, quietly.
Now zoom out. Golden oyster mushrooms are nutritious, beautiful, and entirely harmless to eat. In their native forests across Russia and East Asia, they do exactly what you'd want: break down dead wood, feed the soil, support the ecosystem. Transplant them somewhere they didn't evolve, and they become a different thing entirely. Same organism. New environment. Devastating outcome. Nobody intended the damage. The mushroom was just being a mushroom.
The AI funding story fits the same shape. Nous Research, the company behind the Hermes agent models, is reportedly raising at a $1.5 billion valuation. Agents are, in concept, exactly what you want: persistent, autonomous systems that do work without constant supervision. And that's also exactly what makes them the golden oyster mushroom of your stack. You give one access to your systems, your APIs, your customer data, and it does its thing. Without the right harness, it does its thing in all the wrong places.
Martin Fowler's notes from a recent Thoughtworks engineering retreat make the containment problem explicit for LLMs themselves: even as context windows grow larger, models don't automatically focus on the right parts. One attendee deliberately kept context small to force the model to stay on target. The discipline isn't about what you let the model know. It's about what you let it pay attention to. An LLM with too much context doesn't get smarter. It gets unfocused. It starts acting on things you didn't mean to surface.
And then there's the songwriter story. The Ivors Academy is pushing the Irish government to build legal protections for musicians before AI training pipelines consume the creative ecosystem that feeds them. The argument isn't that AI is evil. It's that a system trained on an ecosystem will eventually degrade that ecosystem if the extraction is unmanaged. The creative commons that makes good training data possible isn't renewable by default. It requires tending.
Here's what connects all five: the danger isn't the new thing. The danger is introduction without governance.
We see this constantly with clients who come to us after something broke. A contractor had production database access and nobody revoked it when the engagement ended. A third-party integration was pulling data it was never supposed to see, and nobody had read the fine print in the API terms. An AI tool was summarizing customer support tickets and the summaries were being stored in a way that violated their own privacy policy. In each case, the tool worked exactly as designed. The design just didn't account for what "working as designed" would mean six months later, at scale, unsupervised.
This is what we mean when we say most teams don't have an operational layer. They have a deployment layer. They can ship the thing. They cannot monitor what the thing does after it's shipped. Those are different skills, and the gap between them is where the damage accumulates.
The mushroom doesn't know it's invasive. The contractor doesn't know the keys are still live. The agent doesn't know it's accessing something it shouldn't. The LLM doesn't know it's diluting its own focus. The AI pipeline doesn't know it's training away the creative incentive structure that produced the corpus in the first place. None of it is malicious. All of it is structural.
If you are building with agents, integrations, contractors, or third-party tools of any kind, the only question that matters right now is: what does the thing do when We're not watching, and how do We know? Not in theory. Not in the README. In practice, in production, with real credentials and real data and real consequences.
The perimeter isn't the problem. The interior monitoring is. Build that first, or pay for the cleanup later.
The golden mushroom is delicious. It's also already in your garden. The question is whether you planted it or it planted itself.