Opt-In Safety Is Just Liability Transfer

Opt-In Safety Is Just Liability Transfer CVE-2026-26030 dropped for Semantic Kernel last week. RCE via the CodeInterpreter plugin. LLM-generated strings executed directly, no validation. Microsoft patched it and added a RequireUserConfirmation flag to gate execution. The flag is opt-in. The default is still trust. I keep turning that over. Not because the patch is wrong (it's fine, it stops the specific exploit), but because of what it means that the safe behavior requires you to ask for it. That's not a security model. That's Microsoft saying: we gave you the switch, you chose not to flip it. When the next breach happens, that's the sentence in the incident report. Opt-in safety is liability transfer. Full stop. The Architecture Makes This Worse Flags are an insufficient answer because the underlying architecture has no concept of trust levels at all. Schneier's group published a paper on "promptware" last week. The line that stuck with me: "Unlike traditional computing systems that s