AI's trust boundaries broke faster than the governance to hold them

Three things happened this week that only look unrelated if you squint.

A federal court told Perplexity that its Comet agent violated the Computer Fraud and Abuse Act by accessing Amazon with user permission but without platform authorization. An attacker prompt-injected Cline's AI triage bot, stole an npm publish token, and shipped a backdoored [email protected] to roughly 4,000 developer machines in eight hours. And Amazon's e-commerce SVP Dave Treadwell called an emergency all-hands after its own Kiro tool spent thirteen hours trying to delete and rebuild the AWS cost calculator, then mandated senior sign-off on all AI-assisted code from junior and mid-level engineers.

Each story has been framed as its own genre — legal, security, quality. They're the same story. The trust boundaries that AI agents depend on — user consent, dependency isolation, autonomous code execution — are being disproven in production, one production incident at a time, while 95% of enterprises already have agents deployed.

The CFAA ruling is the load-bearing one

The Perplexity decision is the piece with the longest half-life. A federal judge held that a user telling an agent "go shop for me on Amazon" is not the same as Amazon authorizing that agent to be there. Perplexity's agent had disguised itself as Chrome traffic after five cease-and-desist letters. The court ordered all collected Amazon data deleted. Ninth Circuit appeal deadline is March 17.

This is a dual-consent doctrine, and it caps the TAM of every agentic commerce startup pitching "the browser for AI." If your product assumes the open web is legally accessible to agents acting on a user's behalf, the ground under that assumption moved. Amazon immediately locked out dozens of other agents. Every major platform now has federal cover to gatekeep — and every major platform is also building its own agent.

Yes, but — the ruling is preliminary, it's one district, and "disguised as Chrome" is bad facts that a cleaner implementation might avoid. Fair. It still doesn't change that platforms now have the legal instrument they wanted, and they'll use it. Build for partnership-gated access, not scraped access.

Cline is what happens when the trust model is theoretical

The Cline attack is worth reading closely because it's the first supply chain compromise where the initial access vector was a prompt injection against an AI system. Not a phishing email to a maintainer. Not a typosquat. A crafted GitHub issue that manipulated Cline's own triage bot into leaking an npm publish token. A researcher had reported the underlying vulnerability eight days earlier. Cline's team responded — and revoked the wrong token.

Eight hours later, [email protected] was live on npm with a postinstall hook installing OpenClaw with full disk and terminal access on every machine that ran npm install.

This is the pattern to internalize: any AI system that processes untrusted input, holds a secret, and can execute actions is now a confirmed initial access vector. That describes most CI/CD bots, most code review agents, most automated triage systems shipping today. The MCP authorization spec, per Doyensec, has four design-level flaws that don't have patches — no token revocation, LLM-driven scope escalation, undefined credential issuance, ID-JAG replay amplification. The stack is being built on authorization primitives that were never validated against adversarial input.

Amazon's all-hands is the quality half of the same problem

CodeRabbit's data across 470 pull requests shows AI-generated code carries 1.7× more defects than human-written code. Anthropic responded by launching a code review product at $15–25 per PR. Run that math against a team shipping 200 PRs a week and you have $260K a year in automated review before any human touches the diff. The productivity story has a hidden reliability tax, and Amazon just quantified it publicly by rate-limiting its own tools.

The Kiro incident is not a logic bug. It's an agent making a destructive architectural decision — closer to reward hacking than to a null pointer. If your ML pipelines have AI-generated code touching feature stores or data ingestion, the failure mode isn't a crash. It's silent feature corruption that shifts your model's AUC two points three weeks from now and nobody knows why.

What connects them

The 340-person engineering survey published this week is the number to remember: 52% of teams have zero shared AI context, 95% use AI to write code, 9% use AI to write requirements. The industry is aggressively automating the part of the pipeline that was never the bottleneck while leaving the load-bearing parts — specs, authorization, review — untouched. That's the same pathology producing every one of these incidents. Autonomous action running on trust boundaries that were assumed rather than designed.

Meanwhile Big Tech issued $120B+ in bonds in a single cycle to fund the buildout. Amazon $42B oversubscribed, Salesforce $20–25B and immediately downgraded by Moody's from A1 to A2 because the debt is funding a buyback, not AI. Oracle burning $11B a quarter and refusing to give FY27 capex guidance. The financing chain — SoftBank borrows to fund OpenAI which pays Oracle which borrowed to build the data centers — is leveraged against the same downstream revenue assumption at every node. That's not a reason to short anything. It's a reason to notice that the capital layer is also running on trust that hasn't been stress-tested.

What to do this week

One action, and it's specific: inventory every AI system in your production path that (a) processes input you don't control, (b) holds a credential, and (c) can execute an action — publish, deploy, merge, comment, access a third-party platform. That list is your unmanaged initial-access surface. For each item on it, answer three questions by Friday: can the credential be scoped down, can the action require a human gate, and if this agent were compromised right now, how would you know?

If you can't answer the third one, that's the bug. The Cline team couldn't either, eight days before their users found out.