Just when you think the bar for government IT security has hit the absolute floor, they pull out a jackhammer and start digging.

If you haven't caught the latest ProPublica investigation^[1] regarding the Defense Department, Microsoft, and Chinese contractors, you are missing out on a spectacular display of bureaucratic idiocy. The short version: the government is relying on Microsoft, and to keep things "secure" during code reviews, they use what are essentially "digital escorts."

Let us be brutally honest about how stupid this is.

The "Code Review" Charade

First of all, deciding to heavily rely on Microsoft architecture for neuralgic, high-security infrastructure is already a questionable life choice. But the concept of these digital escorts is where the real comedy begins.

These "minders" might be able to skim a few lines of Java or Python and nod thoughtfully when they see a well-commented function. But ask them to step through a compiled binary? Forget it. When your daily reality involves hardware integration, managing memory pipelines in C++, or writing bare-metal Assembly, the concept of handing national defense security to someone who only understands high-level syntax is genuinely offensive.

Real exploits do not live in neatly formatted script files. A sophisticated threat actor is not going to leave a helpful comment block explaining their backdoor. They are going to use Return-Oriented Programming (ROP) to hijack the control flow right out of the compiled executable. They are going to manipulate the stack, smash the registers, and exploit the very architecture of the application. The idea that a "digital escort" peering over a shoulder is going to catch a low-level memory exploit in a massive codebase is pure, unadulterated security theater.

The AI "Hacking" Myth of the Fable Model

This systemic lack of fundamental technical competence perfectly explains the other recent embarrassment: the NSA getting "hacked" by Anthropic's new Fable model.

If you listen to the tech bros and the media, you would think Fable is some omniscient, superintelligent cyber-god. It isn't. The model is not objectively smarter than a human engineer. It doesn't possess a magical intuition for zero-day vulnerabilities.

What Fable actually did was just burn through millions of tokens, brute-forcing its way through absolutely terrible, bloated government code. It didn't need to be a genius; it just needed to tirelessly exploit the endless attack surface provided by lazy Microsoft architecture and decades of copy-pasted, unoptimized legacy systems. When your infrastructure is a house of cards built by the lowest bidder, you don't need a super-villain to knock it down—a very fast, very persistent text predictor will do the job just fine.

The Bottom Line

Government agencies almost never have good code. They have massive budgets, endless meetings, and a terrifying reliance on contractors who view them as bottomless ATMs.

We keep putting the least qualified people at the most critical, neuralgic points of our infrastructure. As long as the DoD thinks a digital babysitter reading Java constitutes a "code review," and as long as they keep buying into bloated corporate architecture, we don't even need to worry about the "Great Filter." Our own sheer incompetence will get us first.

Sources

1 How Microsoft’s “Little Workaround” Created a Major Pentagon Threat