Airflow 3.3.0 RCE and Feast Feature Poisoning Hit ML Stacks

The claim worth reading past the hype: GRPO removes the trained reward model entirely. Sample N answers per prompt, score them, push the policy toward those beating the group mean. The reward becomes a deterministic, version-controllable Python function you unit-test rather than retrain. For any verifiable task — code compiles, math checks, schema validates — that retires an annotated component and its drift surface. The thing this doesn't tell you is how much of your real workload is actually verifiable.

The Othello example exposes the discipline. The composite reward weights four signals: win/loss (1.0), piece advantage (1.0), invalid-move penalty (1.0), and format compliance at just 0.2. That low weight is the tell that formatting belongs to a prior SFT stage, not RL. Ministral-3B's illegal moves are 'noise RL can't train through,' forcing a mandatory pipeline: data generation (200 GPT-4.1 games) → SFT → RL. Skip SFT on a weak base and RL compute burns on format, not capability.

Strategically: Prime Intellect open-sourced Verifiers plus a 2,500+ environment hub the same week Anthropic reportedly floated $1B+/year on proprietary environments. Pretraining and SFT are commoditizing. The scarce resource is the RL environment. In a verifiable domain, the environment is the IP. The open hub is a floor, not a leveler.

The gap: zero quantitative results — no win-rate deltas, sample counts, or reward-weight ablations. Treat it as an architecture template, not an empirical claim. The reusable win is the harness itself. A deterministic seeded opponent behind an OpenAI-compatible API lets local Ministral-3B and hosted GPT-4.1 swap in one line. That gives you a reproducible apples-to-apples comparison for local-vs-hosted, which is the number most of these writeups never bother to measure.

Two structural shifts. Both testable this quarter.

The lakehouse is absorbing the vector tier. Apache Hudi ships native vector columns, HNSW indexing, and hybrid vector+filter search on lakehouse tables, pitched as RAG without a separate vector DB. Iceberg v3's Variant type shreds semi-structured JSON into real Parquet columns for typed reads and column pruning. The payoff is collapsing a serving tier and killing embedding drift between stores. The thing this doesn't tell you: Hudi's capability is announced, not benchmarked — no published recall@k or latency-vs-dedicated-DB numbers. Lakehouse-native is credible at mid-scale (<1B vectors). But HubSpot's 20B+ vectors across 200+ indexes, 140+ clusters, 38+ teams on Qdrant shows dedicated infra earns its keep at fleet scale, and the real unlock there was Kubernetes operators, not embeddings.

The sleeper is DataFusion: PageRank on 1.05B edges in ~30 min on 5GB RAM, weakly-connected-components on 1.96B edges in 10GB, via disk-backed scans and spill-aware sort-merge joins. If it reproduces on your graph, that retires a Spark cluster for batch graph features. Read the conditions first. Single-author blog, standard Graphalytics datasets, no cross-engine comparison. Those numbers are a starting point, not a verdict.

Second shift: agent-authored pipelines are silently wrong. Multiple independent sources converge on a deterministic correctness layer — SQL/schema validation, query equivalence, lineage, blast-radius checks — because non-deterministic models are blind to your actual data. The mechanics: Write-Audit-Publish, an upfront data contract validated in a staging branch before publish, plus a database MCP so agents inspect real schemas instead of hallucinating them. If agents author SQL or transforms, treat the output as untrusted input. Gate every transform behind schema, row-count bounds, null-rate, and referential checks.