THE LAB

Cursor's Seven-Month Zero-Day: No Patch, Now Public

Drop a git.exe in the root of any repository and Cursor will execute it — automatically, silently, repeatedly, with no prompt and no warning. That is the complete exploit.¹ On Windows, Cursor's path-resolution logic sweeps the workspace root when loading a project, finds the attacker-controlled binary before the real git, and runs it under the current user's privileges. It keeps running it. In Mindgard's proof-of-concept, a harmless Windows Calculator binary renamed to git.exe spawned multiple windows without any user interaction and continued launching new instances while the project stayed open.

Mindgard discovered the vulnerability on December 15, 2025 and reported it the same day to Cursor's published security address. An internal automation failure prevented the HackerOne workflow from triggering; a LinkedIn post eventually surfaced a security contact, and Cursor's CISO manually invited Mindgard to the private bug bounty program in January 2026. The report was first closed as informative and out of scope, then reopened after successful reproduction. HackerOne confirmed delivery to Cursor on January 20. After that: silence. Update requests in February, March, and April went unanswered. Direct outreach to Cursor's CISO and leadership produced nothing. In the months that followed, Cursor shipped more than 70 new releases. Mindgard notified HackerOne of intent to disclose publicly on June 1. The full-disclosure post went up July 14 — seven months and 197-plus versions after initial report, last verified April 30, 2026 against Cursor 3.2.16. The vulnerability was still present.¹

For enterprise Windows environments: AppLocker or Windows App Control path-based deny rules scoped to workspace roots (%USERPROFILE%\source\repos\*\filename.exe) are the recommended interim mitigation. Hash-based rules won't hold since attacker binaries vary by hash. Consumer users: open untrusted repositories in a VM or Windows Sandbox until a patch appears. Cursor reports 7 million-plus active users and deployment at over 50,000 companies.¹

Armin Ronacher — the Flask and Jinja2 author — published an essay July 13 that Simon Willison flagged the next day, and it earns a careful read. The argument is not about AI making bad code; it is about what AI does to the social structure that makes large codebases navigable.

Ronacher's framing is precise: the shared language of a software project is not Python or English but the distributed model of invariants, ownership, and architectural intent that lives partly in documentation but mostly in the overhead of having to explain a change to someone else. Before agents, reaching into another team's storage layer required reading their code, asking questions, and coordinating across service boundaries. That process was slow, and much of its slowness was waste — but not all of it. The part that was not waste was the synchronization mechanism: forcing the developer to acquire enough of the shared model to get sign-off. Agents dissolve that friction. Each developer can now reach into any corner of a codebase, ask an agent to make the change, and get back code that compiles, passes tests, and comes with a generated explanation. Nobody has to talk to anybody. Nobody has to acquire the context that would once have been the price of the change.

The structural consequence Ronacher identifies is that architectural coherence can collapse well before it becomes visible. "The tower does not fall, and so we do not notice what was lost. It just keeps rising."² He does not prescribe a fix, and the essay is more honest for the omission. The problem is not a tooling problem with a tooling solution; it is a coordination problem that better tooling is actively exacerbating.

New York governor Kathy Hochul signed an executive order July 14 imposing a one-year pause on the development of hyperscale data centers — the first statewide data center moratorium in the country.³ The order halts state environmental reviews for facilities over 50 megawatts while the Department of Public Service assesses energy and environmental impact and develops a new generic permitting framework. Hochul is also proposing an end to all data center tax incentives in the state.

The order is narrower than legislation the New York legislature passed in May — the Responsible Data Center Development Act, which set the threshold at 20 megawatts and carried bipartisan support — and that bill remains on Hochul's desk under review. At least 13 other states introduced moratoriums this year. Maine became the first to pass one through its legislature, but the governor vetoed it in April and the underlying project was put on hold indefinitely in June.³ The New York executive order is the first to actually take effect.

Trending today: GitHub is saturated with Claude Code skill collections, AI-agent wrappers, and curated LLM lists — nothing cleared the technical novelty bar. JustVugg/colibri (GLM-5.2 consumer inference) reappeared but was already featured in a recent edition.

↑ Back to top

THE WORLD

Spain in the Final; Hormuz Traffic at Half Normal

↩ Developing story — first reported Jul 10 · previously Jul 12, Jul 13, Jul 14

• Spain into the World Cup final — Oyarzabal's penalty and a Porro goal shut out France 2-0 Tuesday; Spain meets the Argentina-England winner Sunday. Source
• Hormuz traffic down 52% — CENTCOM confirmed a third consecutive night of US strikes on Iranian military targets; Brent crude rose 2% to $85 a barrel. Source
• Argentina vs. England in Atlanta today — The semifinal determines Spain's opponent in Sunday's final; Messi is tied with Mbappé at eight World Cup goals. Source

King County Sheriff Patty Cole-Tindall stated publicly that deputies will not assist ICE on immigration matters — cooperation is limited to criminal cases backed by a judge-signed court order. King County has received no ICE requests yet, Cole-Tindall said, but the policy is clear; the county has joined multi-jurisdiction lawsuits challenging federal attempts to tie grant funding to immigration enforcement cooperation. Source

The Seattle City Council votes tomorrow (July 16) on which version of the transit levy goes to the August 4 primary deadline and, if approved, to November's ballot. Mayor Wilson's proposal doubles the Transportation Benefit District sales tax to 0.3%, generating an estimated $138 million annually for bus service, streetcars, and free ORCA passes; Councilmember Kettle is pushing a 0.05% amendment that preserves bus service and 22,000 ORCA cards while stripping capital spending the city considers duplicative of the 2024 Transportation Levy. Source

A former King County Jail inmate and an accomplice were convicted Monday in a scheme that used jail phones to target seriously ill veterans for fraud. Source

ON THE ROAD — Adast, Hautes-Pyrénées, France

• Canicule warning in effect today — Météo France issued heat vigilance for Hautes-Pyrénées Wednesday; high near 86°F, overcast, 20% precip chance. Source
• Don't drink mountain stream water — Two hiker groups were airlifted to Tarbes hospital July 14 after drinking untreated water from lakes and torrents; rescue services urging strict caution. Source
• Rockabilly Fest, Bordères-sur-l'Échez, July 17–18 — 5th edition at Showroom Gallery CEMA; two days of rock'n'roll concerts, dancing, vintage atmosphere. Source
• Fête du Gâteau à la Broche, Arreau, July 19 — 26th edition of the Pyrenean spit-cake festival; music and family activities in the valley, one day before your departure. Source
• Abbaye de l'Escaladieu — Cultural summer program running through September: contemporary art, music, theatre; worth a half-day detour from the valley. Source

↑ Back to top

THE PELOTON

The White Powder That Burned: Stage 10's Safety Gamble Costs Harper His Tour

↩ Developing story — first reported Jul 11 · previously Jul 12, Jul 13, Jul 14

NEVERS, France — The chalky white coating sprayed across the Col de Puy Mary's switchbacks was applied to prevent the tarmac from melting in 32°C heat. On Tuesday it did something else: Tom Pidcock went down on a tight left-hander, Matteo Jorgenson came off on the same descent, and Chris Harper slid out alongside Pidcock. By Wednesday morning Harper had undergone surgery for a serious thumb injury and abandoned the race.¹

This is the bind ASO finds itself in as the Tour pushes through a sustained European heatwave. Treat the roads and risk making the descents treacherous; leave them bare and the surface softens beneath the peloton's tires. Paul Seixas described sections of uncoated tarmac on the same descent as "like an ice rink" where he felt the surface was literally melting — and this was after his Decathlon-CMA CGM team drove hard on the Puy Mary's ascent specifically to secure safe positioning before the worst sections became impassable for riders further back.² Seixas, racing to one of the best results of his debut Tour, got down safely. Others did not.

Pidcock was unsparing afterward. "I don't know what they do to the roads here," he told TV reporters. "They've thrown all sorts of white shit over them. It made it very slippery, especially on the descents."¹ He slid out with teammate Harper on what appeared to be a treated corner; Pidcock remounted and fought through to ninth. Harper did not start Wednesday morning. Jorgenson crossed the line with his left elbow bandaged, the cause of his crash not captured on camera.

The white-roads incident is the newest dimension of a safety thread that has already produced a truncated Stage 9 and rewritten feeding rules mid-race. Each time the heat finds a new surface to exploit.

Stage 11 rolls 161 kilometres from Vichy — the race's first visit since 1952 — along open roads through freshly harvested cereal fields to a finish on Nevers' outskirts beside the Loire.³ There is almost nothing in the way of climbing; the last categorised ascent of the day is the kind of rise that barely asks a driver to change gear. The sprint is the story, and the wind is the variable.

Tim Merlier arrives with two stage wins and the French proverb about never two without three within easy reach of a headline writer.³ Biniam Girmay, Olav Kooij, and Jasper Philipsen are the principal opposition. On Philipsen, Mathieu van der Poel said after Sunday's stage that his sprinter "doesn't have the legs" but expected improvement.³ Being fourth or fifth at the Tour is not the same as being 45th. If the wind gusts — models diverged on whether northwest cross-gusts would reach 40 km/h or flatten out by race time — the sprint formation becomes harder to organise and the chances of a different winner improve.

The GC picture behind Pogačar is developing in ways the race for yellow cannot. Remco Evenepoel sits just 30 seconds behind Vingegaard in third, close enough that the Stage 16 individual time trial becomes genuinely decisive — a discipline Evenepoel favours.⁴ But Florian Lipowitz, his Red Bull-Bora co-leader, has been the steadier climber all race: never dropped by the riders he is racing, and without Evenepoel's tendency to drift and claw back.⁴ With five of the eleven remaining stages finishing on summit finishes, Lipowitz may be the better bet for the podium despite the time trial shortfall.

Seixas, 19, climbed to fifth overall after Tuesday's stage and continues to justify the pre-Tour attention he arrived with.⁴ Isaac del Toro, by contrast, slipped to seventh — the young Mexican was the one visible crack in the UAE armour on the long drag to Le Lioran, where Adam Yates briefly stopped the pace on the penultimate climb before the world champion launched without him. Vingegaard did the most work in the chase group and was beaten to the remaining bonus seconds by Evenepoel, shedding another 44 seconds to the overall lead.⁴

New reporting today by Cyclingnews fills in the backstory of how Visma-Lease a Bike restructured around Vingegaard after last winter's near-resignation. Marc Reef, who is taking over from Grischa Niermann as Head of Racing, confirmed that the team built this year's programme — including the Giro d'Italia and Tour double — around Vingegaard's direct feedback. "Jonas is very open and feels right at home; actually, everything has gone really well so far," Reef told the Dutch outlet In de Leiderstrui.⁵ Vingegaard himself called it "a step in the right direction, but just one step," and argued that individualised programmes should be the direction for professional cycling broadly: "If it is hard to be away for such a long time, then you have to do something else — and that is what we have done for me this year."⁵ Reef added that the team remains committed to further dialogue after the Tour. The posture is open-ended — a team that knows it is being renegotiated with in real time.

Chris Froome is back at the race for the first time in four years, working as an ambassador for Tour partner Skoda.⁶ In an interview with L'Equipe, he gave the most detailed account yet of why he retired when he did. The crash in Toulon last August — multiple broken ribs, a pneumothorax, fractured vertebra, perforated pericardium — was severe enough that he was in and out of hospital until mid-January and not fully functional until April or May. But the decision to leave, he told the paper, was made years earlier.

"When I signed my last contract, I knew it would be my last," Froome said. "I was hoping to be able to race one last race and say goodbye that way, as is usually done. But the accident in August sidelined me." His retirement announcement, when it finally came, was not a planned statement. Someone asked him a question on the eve of this year's Grand Départ. He answered it.

On his biggest regret: the 2019 Critérium du Dauphiné crash, not the 2018 Giro win that preceded it. "I was flying. I was in the best shape I'd been in for years," he said of the form he carried into that Dauphiné. On the Giro: "If I hadn't gone, I would have been fresher for the Tour — but in that case, I would never have won the Giro. I'm not going to try to torture myself over it."⁶

On Pogačar, now his equal on four Tour victories and pursuing a fifth that would set a new record: "I think he kills them. On the Tourmalet, he made it clear to the others that they would be riding for second place. I know how demoralising that can be for your rivals. But on the first mountain stage, I was gaining a minute; in Tadej's case, it's three minutes. It's incredibly impressive. I can say I'm glad he wasn't around when I was at my best."

Finally: Lukas Nerurkar of EF Education-EasyPost was struck by a car on July 2 while training at home in England, ending a run of form he had been building toward the Austrian and Polish races. EF's medical update this week confirmed the damage: broken and dislocated collarbone (surgically repaired), fractured sternum, fractured vertebra, broken rib, and a small punctured lung.⁷ The collarbone repair was complicated by ligament damage at the distal end of the bone and required more than a standard plate. The team's head doctor estimates six to eight weeks before the 22-year-old returns to competition, with the punctured lung healing on its own.⁷ "It's just generally scary that a car can do that to you so easily," Nerurkar said.

↑ Back to top

THE LONG READ

Nokia Saw It Coming. It Still Lost.

The morning after Steve Jobs pulled an iPhone from his pocket, Nokia held a rapid-response meeting. The slide deck from that January 10, 2007 gathering — now in Nokia's publicly released archives at Aalto University — did not sugarcoat anything. "Executive summary: Apple iPhone is a serious high-end contender," it read. "Nokia needs to develop touch [user interface] to fight back."¹

They knew. That is what makes what followed so brutal to reconstruct.

IEEE Spectrum's account of Nokia's 14-year run atop the mobile phone market — drawn from those newly public internal documents and interviews with engineers from the era — is not another business-school cautionary tale about a company that failed to see disruption coming. It is something rarer and more instructive: a story about a company that saw it with perfect clarity and still couldn't outrun it.

The scale of what Nokia was at its peak is worth sitting with. In 2005, the company sold its billionth mobile phone — a budget handset that went to a customer in Nigeria. At that point Nokia was making one of every three cellphones on earth.¹ The 1100, released in 2003, sold half a billion units, more than any cellphone in history, a figure that still makes it one of the best-selling consumer products ever made.¹ Nokia designed the 1100 for durability in hostile environments: dust resistance, nonslip sides for wet hands, a 400-hour standby battery, and a built-in flashlight activated by holding the "C" key. In Uganda, Nokia researchers documented informal "kiosk" operators — often women — who charged neighbors by the minute for use of their device, and who shortened the billing unit from 60 to 57 seconds to avoid accidentally tipping into the next charge increment.¹ Nokia knew its users in that granular a way.

It also knew multitouch. In 2006, NYU researcher Jeff Han gave a celebrated TED talk demonstrating a screen that could track multiple fingers simultaneously. Peter Bryer, then Nokia's manager of strategic foresight, recalls a colleague bursting into the room insisting he watch it. "We both thought that was cool and that's the future," Bryer told Spectrum.¹ Then he checked the talk's sponsor list. Nokia was on it. So was Microsoft.

Nokia had funded the research demonstrating the technology that would eventually destroy it, recognized that technology as the future, and then spent the next four years not shipping a multitouch phone. The first Nokia device with multitouch arrived in 2010.¹

Bryer's explanation for the delay is the most humanizing detail in the piece, and the most damning: "Remember, Nokia is based in Finland. It's very cold in Finland. They wear gloves for six months of the year, including the executives. They didn't think a device like that would work."¹

This is not a metaphor. The executives who needed to greenlight a multitouch product were people who spent their winters unable to use a touchscreen. The product instinct that had made Nokia brilliant — the flashlight, the nonslip sides, the 57-second kiosk billing unit — was the same instinct that couldn't imagine a glass slab working in the real world.

The iPhone threat turned out to be the wrong thing to be afraid of. Nokia's touchscreen answer, the 5800 XpressMusic, launched November 2008 — a year and a half late and without multitouch. It sold reasonably well. But the iPhone was a high-end device, and Nokia's core strength was never the high end. The existential threat came from below.

The first Android phone shipped in September 2008. Within a few years, Android devices were targeting the same low-cost global buyers Nokia had built its empire on. "I think it's fair to say Android is the one that disrupted the market more for Nokia," Bryer says. The company responded with the 5230 in 2009 — a low-priced touchscreen phone meant to compete across the board. It sold 150 million units. It didn't have Wi-Fi.¹

The company's R&D labs were, by all accounts, still producing extraordinary work. Gordon Murray-Smith, who ran services and ecosystems intelligence from 2008 to 2011, describes annual innovation days showcasing self-healing materials and flexible screens. "But why was Nokia not able to commercialize some of that really interesting and innovative activity more than it did?" The question answers itself in the asking.

By February 2011, Nokia's first non-Finnish CEO — Stephen Elop, a Canadian who had just come off Microsoft's leadership team — had run out of patience with euphemism. In an internal memo that quickly leaked, he wrote: "The first iPhone shipped in 2007, and we still don't have a product that is close to their experience. Android came on the scene just over two years ago, and this week they took our leadership position in smartphone volumes. Unbelievable."¹

The same year, Nokia launched the N9 — a Linux-based smartphone running MeeGo that reviewers called possibly the most beautiful phone ever made. Then Nokia abandoned MeeGo and pivoted the entire product line to Windows Phone. Then Microsoft acquired the handset division for roughly $7.2 billion. Then, one year later, Microsoft wrote down $7.6 billion and laid off nearly half the Nokia staff it had just inherited.¹

What remains of Nokia today is not phones. The company refocused on an older business line — telecom infrastructure — that the handset years had largely obscured, and now ranks among the world's top three suppliers of 5G network equipment alongside Ericsson and Huawei.¹ The brand name endures on budget Android devices sold by HMD Global. There are nostalgia reproductions of the 3310.

Timo Partanen, who was in the room for that January 10 meeting, offers the most useful thing in the piece: "Often, being the first mover is not necessarily the best position. Being a quick follower is the best position." Nokia was the first mover in affordable global phones. It needed to be a quick follower in smartphones. It knew what was coming. It couldn't move fast enough. That gap — between seeing and doing — is the whole story.

↑ Back to top

FROM THE ARCHIVE

The Handshake Over Metz: July 15, 1975

Deke Slayton had been waiting sixteen years. Selected as one of the original Mercury Seven in 1959, an irregular heartbeat grounded him before his first flight and kept him earthbound through every Gemini and Apollo mission. By 1972, the program that had beaten the Soviets to the Moon was being wound down. What remained on the books was something no one had ever attempted: docking an American spacecraft with a Soviet one. Slayton, by then head of NASA's astronaut office, selected himself for the crew.

On July 15, 1975 — fifty-one years ago today — two spacecraft lifted off within seven-and-a-half hours of each other from opposite sides of the planet. Soyuz 19 rose from Baikonur at 12:20 UTC; Apollo followed from Cape Canaveral at 19:50.¹ The Apollo crew was Slayton, Tom Stafford, and Vance Brand. The Soyuz carried Alexei Leonov, the first man to walk in space, and Valery Kubasov. The mission had a name as unglamorous as its politics were delicate: the Apollo-Soyuz Test Project.

The engineering problem was genuine. Apollo ran on pure oxygen at about 5 psi; Soyuz used a nitrogen-oxygen mix at sea-level pressure, roughly 15 psi. You cannot open a hatch between those two environments without killing someone. The solution was a one-off docking module — an airlock and adapter built specifically for the mission, flown only once — incorporating the APAS collar developed in joint meetings between Houston and Moscow that had run from 1971 through 1972. The two sides had spent years contemptuous of each other's hardware. NASA's Johnson Space Center director Christopher Kraft called the Soyuz a craft that landed the moment anything failed rather than switching to a backup. Soviet engineers called Apollo "extremely complex and dangerous." The ASTP program manager eventually had to warn the American astronauts to stop complaining to the press because they kept offending their counterparts. NASA worried any slight would cause the Soviets to pull out entirely.

The two ships docked on July 17 at 16:09 UTC.¹ Three hours later, Stafford and Leonov shook hands through the open hatch. NASA had calculated the moment would take place over the British seaside town of Bognor Regis; a delay pushed it east over Metz, France. Both governments read the handshake as confirmation of their own superiority: Soviet press implied the USSR was leading in space; American coverage described the Soyuz as technically primitive. The mission was designed as a symbol of détente, and each side immediately stripped it for parts.

None of that was Stafford and Leonov's concern. Leonov later joked that three languages were spoken on the mission — Russian, English, and "Oklahomski," for Stafford's Oklahoma drawl when attempting Russian. The two men remained close for the rest of their lives. Leonov became godfather to Stafford's younger children.¹ When Leonov died in October 2019, Stafford gave the eulogy.

The return nearly killed the American crew. During reentry, Brand failed to close two switches on the checklist — he said the cabin noise prevented him from hearing Stafford call off the item — leaving the reaction control system running through descent. Toxic propellant fumes, monomethylhydrazine and nitrogen tetroxide, were sucked into the cabin through the ventilation intake. Brand briefly lost consciousness. Stafford retrieved emergency oxygen masks and got them on Brand and Slayton. All three were hospitalized for two weeks in Honolulu.¹ The incident was largely overshadowed by the handshake.

The Apollo module was retired after splashdown. It was the last one. As soon as it launched, ground crews at Kennedy Space Center began converting the facilities for the Space Shuttle. The next American astronaut to reach orbit would do so nearly six years later, in April 1981. The cooperative framework Apollo-Soyuz established lay dormant for two decades before STS-71 docked with Mir in 1995 — using a descendant of the same APAS collar, by then embedded in the Mir station's Kristall module. That connection, through successive adapter generations, reached all the way to the ISS.

↑ Back to top

THE FUNNIES

The Bug That Survived 70 Releases / Handshake Over Metz

*After Dilbert — on the Cursor zero-day that traveled through seven months and seventy-plus releases while the pointy-haired boss celebrated shipping velocity. After Bloom County — on the Apollo-Soyuz docking of July 15, 1975, when two rival mission controls each read the same handshake as proof of their own superiority.*

↑ Back to top

ALSO NOTED

Also Noted

• Exolactate gels at the Tour — A WorldTour team (unnamed under confidentiality) is racing the 2026 Tour on Exolactate's debut gel — 40g carbs plus 5g of exogenous lactate — developed over seven years by former Ineos Grenadiers lead of human sciences Aitor Viribay, who argues the externally supplied lactate arrives as ready-made fuel rather than as a byproduct of hard effort. escapecollective.com Jul 14, 2026
• UCI disqualifies Smit for video-recording glasses — South African pro Willie Smit was thrown out of the Tour of Magnificent Qinghai after riding in camera-equipped Oakley Meta smart glasses, apparently brought to officials' attention when he posted crash footage to X; an April 2026 UCI rule requires all data-recording devices to be mounted on the bike, not worn. velo.outsideonline.com Jul 14, 2026
• Yeti LT replaces Switch Infinity with six-bar Sixfinity — After 12 years, Yeti's new LT enduro bike retires the sliding Switch Infinity mechanism for the Sixfinity platform — a six-bar linkage refined over a decade through eMTB and World Cup downhill programs — which lets engineers tune anti-squat, anti-rise, and leverage rate more independently of one another. bikeradar.com Jul 14, 2026
• Microsoft patches record 570 security flaws — July's Patch Tuesday is nearly triple last month's record, including roughly 60 critical vulnerabilities and three zero-days already being exploited in the wild; Microsoft EVP Pavan Davuluri publicly attributed the surging patch volumes to AI tooling that finds more vulnerabilities faster across more code. krebsonsecurity.com Jul 2026
• Every real computer in Jurassic Park, cataloged — Fabien Sanglard traced every machine visible in the 1993 film — SGI IRIS Crimson, Thinking Machines CM-5 supercomputers, Mac Quadra 700s, and a pre-release Motorola Envoy PDA prototype that reached Spielberg via a chance encounter on a plane — totaling roughly $1.7M in loaned hardware ($4M+ in 2026 dollars), with the famous "It's a Unix system!" scene confirmed to use SGI's real fsn file explorer. fabiensanglard.net Jul 13, 2026

↑ Back to top

THE QUESTION

Awareness Is Not a Fix

Seven months of acknowledged awareness, seventy-plus releases shipped, and a critical arbitrary code execution bug still present — Mindgard's disclosure post on the Cursor zero-day reduces the coordinated vulnerability disclosure process to its simplest test case: what exactly is it for?

The standard answer is procedural: the process exists to reduce risk to users. A researcher reports a bug; the vendor acknowledges and reproduces it; engineering prioritizes and patches; disclosure follows. Cursor's security team acknowledged the Mindgard report in January, the bug was reproduced and confirmed, HackerOne confirmed delivery — and then nothing. Update requests in February, March, and April went unanswered. The bug traveled through more than seventy releases.¹ Mindgard's own conclusion is principled: coordinated disclosure depends on both parties sharing the objective of reducing risk, and when a vendor goes silent, full disclosure becomes the only protection left. That is correct. It explains what failed at the level of a single company's triage process. It does not explain the structural mechanism that let it happen.

Armin Ronacher's essay in THE LAB today offers that structural layer. His argument is not about AI producing worse code; it is about what AI does to the organizational friction that would, in an earlier era, have surfaced a problem like this one and forced it toward resolution. Before agents, coordination had a cost. Reaching across team boundaries required reading others' code, asking questions, and making a change legible to people who would have to live with it. That friction was mostly waste — but not all of it. Some of it was the mechanism by which shared understanding was built: having to explain a decision to someone else forced both parties to discover whether they still agreed on how the system worked, who owned what, and what a critical open bug actually meant for the people responsible for shipping the next release.

As THE LONG READ reports today, Nokia's internal records capture the same failure mode at institutional scale: documented awareness, explicit internal acknowledgment that a threat was serious, and then years before the necessary product appeared. The gap between seeing and doing, as THE LONG READ frames it, was the whole story.

The question that ties these pieces together: if shared understanding is what actually closes the gap between "we have documented awareness" and "we fix the problem" — and if agents are dissolving the friction that builds shared understanding, replacing it with locally coherent changes that never need to be explained to anyone — what happens to that gap over time? Ronacher's closing line answers it: "The tower does not fall, and so we do not notice what was lost. It just keeps rising."² The gap does not close. It becomes invisible. Awareness is necessary but not sufficient, and the thing that converts awareness into action is exactly what the current moment in software is optimizing away.

↑ Back to top