Why are these AI projects so bad at security? Why do they keep running "just trust me, bro" at their service auth layer? GitHub had an issue not long ago where the agents could be used to expose private repos to unauthorized users. Access control is not all that hard, you just have to, you know, actually DO it!

To be fair, "just trust me, bro" has _always_ been Meta/Facebook's policy. Sure, they have a big long nicely-written policies if you look for them, but they continually break them, get caught, say "sorry, my bad" and then the way they broke the policy gets worked into the new policy as something that's allowed. This has happened so many times since Facebook started.