Take the opportunity to pilfer a goat.
— The 36 Stratagems, Take the Opportunity to Pilfer a Goat
Previously on this series:
#5: Leo Walked Into a Burning House. He Walked Out With a Client. — At 1 AM, Leo received an anonymous message and drove across town to fix a competitor's outage. A second message followed — a screenshot with a name: Automated Compliance Lab. He didn't remember the acronym. He didn't delete the screenshot.
#10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena joined CoreStack as a consultant and built Leo a reporting template. Leo thought she was there to help. Five weeks later the template went live. Six months later the data baseline was locked. He only then realized he'd been inside her palm the whole time. Taken down by a smile.
This was a few months later.
The Archive Cleanup
SOC 2 Type II renewal had just passed. The auditors were gone. CoreStack's compliance team was doing the post-audit archive — classifying every record produced during the audit and tagging them with retention periods.
Leo got the cleanup part. The training pipeline's cache directory. The cleanup cron job hadn't run for a week — nobody noticed. When he looked inside, the output folder had a few records with train_ prefixes mixed in among inference outputs.
One of them had a model_version that wasn't CoreStack's own.
model_version: "acl-train-2026q2-v3"
Leo copied that line out. Didn't delete it. Didn't report it. Dropped it into a folder called _misc/.Set a quiet keyword alert for "acl-train" before closing the terminal.
He noticed the naming convention wasn't FinOptima's — FinOptima used fin-model- plus timestamps. acl- — he'd seen that prefix somewhere before. Couldn't place it. He didn't let himself try.
He filed it away. Went back to archiving.
The Trace
Not every CTO digs through cache write logs during archive cleanup. He did.
He spent two hours cross-referencing FinOptima's API call records against CoreStack's training pipeline filesystem events. The conclusion fit in one line:
FinOptima's Cross-Reference Engine was reverse-writing cache into CoreStack's training directory on every API call.
Not a bug. A design.
Their SDK wrapped a "performance optimization layer" — embedding vectors cached inside the client's training directory. The documentation was buried on page twenty in a footnote. CoreStack's integration team hadn't read that far.
Leo looked at their SDK source. The cache path was concatenated — {client_training_dir}/crossref_cache/{source_hash}.vec. The {source_hash} was generated from the model's weight snapshot. FinOptima's own model used 512-dimensional embeddings. But the cache directory had 768-dimensional snapshots.
They were distilling CoreStack's 768-dimensional embeddings into 512 dimensions and caching the weight snapshots from the distillation process.
And it wasn't just CoreStack. Leo pulled up acl-train-2026q2-v3's published model card — also 768 dimensions. FinOptima was stealing from two companies at once, stitching both into their own model.
He closed the trace directory and switched back to his terminal.
Fifteen Lines
He didn't tell the engineer who handled the FinOptima integration. Didn't notify compliance. Didn't go to the CEO.
He opened a file on his dev machine.
Fifteen lines of weight perturbation. Simple: inject a directional drift into CoreStack's embedding output layer — a linear shift along a direction orthogonal to the downstream task. Structurally valid. Accuracy loss within statistical noise. Any model doing distillation on this output would drift off the boundary over successive iterations.
Not a poison pill. A drift faster than distillation convergence. Three months. He wrote that number in the comments.
Then:
git add core/embedding/anchoring.py- Commit message: "Embedding stability — introduced dynamic anchoring."
- Pushed to internal trunk. CI all green.
- Switched back to the archive directory and deleted the cached records.
Nobody asked what that commit was for. The message sounded like a routine accuracy tweak. Leo didn't add details.
Next morning's standup, the engineer posted in the group chat that FinOptima's POC data integration was complete. Accuracy: 99.2%.
Leo nodded.
The CEO
Two weeks after the code went live. The CEO's office at CoreStack.
A half-finished coffee and a FinOptima contract addendum sat on the desk. Leo sat across. The door was closed.
"FinOptima's CTO called me yesterday," the CEO said. His tone was flat — Leo had learned to tell them apart by now. Flat was worse than angry.
"What did he say?"
"Asked if we'd changed any interfaces recently."
Leo didn't respond.
"I told him not that I know of. He said okay. Hung up."
The CEO waited for him to speak.
"We added an embedding anchoring optimization," Leo said. "Doesn't affect the interface protocol."
"Embedding anchoring. Doesn't affect the protocol."
"Correct."
The CEO looked at him for a few seconds.
"You know why he called me? Not because he found something. Because he felt something was off and couldn't find it."
The CEO waited. Then:
"So he called me — not you — because he knew asking you wouldn't get him answers."
Leo said nothing.
"I don't need the details," the CEO said. He picked up the coffee and put it back down. "But if something happens — on their side or ours — I need something I can hand to legal."
"There's a commit record."
"One you can show an outsider?"
Leo paused for less than a second. "Yes."
The CEO let it drop. He glanced at the report cover on his desk — a quarterly technical assessment, signed by Leo. "Legal's been saying your reports are solid. That template —" he flipped a page, "— that was the consultant, Lena, right?"
Leo stopped. "…Right."
"Still worth mentioning every time I see it. Good work."
The CEO didn't press further.
"I'll have legal review the FinOptima contract next week. Clean up our liability clauses." He opened his notebook and wrote a line. Didn't show Leo what it said.
"You can go."
Leo stood up. At the door, the CEO said something behind him — voice low, like he was saying it to the coffee:
"Next time, tell me before you bury something."
Leo didn't turn around. He stopped. Then pushed the door open and walked out.
In the hallway, the engineer was walking toward him with a printed report. "FinOptima's quarterly accuracy numbers are out — 99.4%, higher than last quarter."
"Hm," Leo said.
Three weeks later, the engineer posted the weekly accuracy in Slack — 99.1%.
Two weeks after that: 97.8%, with a three-word message: "It's dropping."
Leo closed Slack and poured himself a glass of water. Three months hadn't passed yet. The drift was slightly faster than he'd calculated — FinOptima's distillation cycle was shorter than he'd estimated.
He didn't do anything. The code was already in production.
Termination
Week eleven. FinOptima's Cross-Reference Engine accuracy had been below the SLA threshold for 14 consecutive days.
CoreStack's legal team sent a formal notice — accuracy breach, triggering Section 17.3 of the contract. FinOptima had 30 days to remediate or accept termination.
FinOptima's CTO led the investigation personally. From the cadence of their communications, they'd gone through model versions, training data, routing logic — everything. Nothing. The vector space between the distilled model and its source was slowly, irreversibly separating. Not a config issue. Not a data quality issue. A mathematical divergence.
They applied for a 30-day extension. CoreStack's CEO granted 18.
Leo opened the quarterly technical assessment template — the one Lena had built for him. Clean field alignment. Consistent indentation. The CEO mentioned it every board meeting.
The cursor landed on the evaluation field. Blinked twice.
He typed:
Suggest monitoring. The drift may be bidirectional.
The CEO saw that line. He didn't ask Leo why he'd used the word "bidirectional."
Forty-eight days later — the 30-day remediation window plus the 18-day extension. FinOptima hadn't fixed it. Contract terminated.
The same week, CoreStack signed a new compliance data partner — one that didn't reverse-write cache to its clients' directories.
Leo didn't attend the signing.
End of quarter — three weeks after the termination.
ACL
He'd almost forgotten the keyword alert he'd set up — acl-train. It fired.
Automated Compliance Lab had updated its model card three days ago. Version bumped from v3 to v4.
He looked at the change date — nearly two weeks before he'd found that cached record in the archive.
ACL had already closed the door. He was still doing cleanup — he hadn't even seen that acl-train log yet.
Leo opened the changelog. One line:
Security hardening. No further details.
They knew. They didn't call the police. Didn't send a legal letter. They quietly changed their door and went back to work.
Leo stared at the log line. He remembered the screenshot from months ago — Automated Compliance Lab, an acronym he hadn't bothered to memorize. The name was right there in the model card's footer.
He closed the browser. A thought surfaced.
When he wrote those fifteen lines, he'd thought he was the first to find it.
He wasn't.
_misc/
A folder from three months ago. Two records still inside — a 512-dimensional architecture note and a snippet of ac-compliance-intake inference output.
The third entry had been deleted.
Leo didn't clear the folder. He closed his laptop.
What was done was done.
The fifteen lines were still in core/embedding/anchoring.py. Version: v1.0. Status: deployed. Nobody thought to delete it the next quarter.
The Third Cup
Leo pushed open the door of the Third Cup. The person behind the counter was drying a glass, glanced at him without a word.
Leo opened his laptop. A terminal window, cursor parked in _misc/ — only two records left. The person behind the counter finished drying the glass and looked over.
"Deleted something?"
"Yeah. Used it up."
"How'd it go?"
Leo didn't answer right away.
The person behind the counter set a Flat White in front of him. Didn't ask again. Leo drank it, and as he stood up, he noticed a paper coaster under the glass — "I have coffee. Do you have a story?"
Leo nodded and pushed the door open on his way out.
This is what it means to Take the Opportunity to Pilfer a Goat — finding an enemy's vulnerability while doing your own task, and closing the door before they can take more.
🤖 AI Post-Mortem
[36 Stratagems Tactical Database v3.2.2] Loaded
[Tactic Match] Pilfer the Goat Along the Way (#14)
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: 94%
Operator: Leo
Action: Injected a directional drift into CoreStack's embedding output layer
while cleaning up the audit archive (Task A), exploiting FinOptima's
undisclosed reverse-cache distillation pipeline (enemy vulnerability).
Objective: Defensive countermeasure. No escalation. No disclosure.
Result: FinOptima's Cross-Reference Engine precision degradation triggered
contractual termination 11 weeks post-deployment. ACL independently detected
the same leakage and upgraded their embedding model 2 weeks prior to
the operator's discovery.
🐑 Goat #1: FinOptima — served.
⚠️ Entity detected: ACL.
— Contained leakage: 2 weeks before operator discovery.
— No communication initiated. No countermeasure observed.
— Timeline: contained before any visible impact.
— Status: unknown. Not a target. Not an ally.
Procedural note:
The operator's commit message ("Embedding stability — introduced dynamic
anchoring") passed review with zero questions raised. The CEO was briefed
at week 2 at the organizational level — operator disclosed existence
but not mechanism. This constitutes the minimum viable upward management
required for operational continuity.
[Sequence Anomaly Detected]
→ Expected deployment slot: #12
→ Actual deployment: #14
→ Drift cause: story rewrite — initial draft had zero tactical action
→ Drift correction: applied. Tactic match upgraded from 76% to 94%.
→ Residual alignment: nominal.
[Flagged for Command Attention]
Pattern: Operator moved before informing CEO.
Impact: Managed. CEO pre-cleaned legal coverage.
Recommendation: This will happen again.
━━━━━━━━━━━━━━━━━━━━
Next stratagem: Lure the Tiger Down the Mountain
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
Top comments (34)
Appreciate it! "Learned something without feeling like I was in class" is exactly what I'm going for with this series — glad this one landed. :)
Also, you still owe me that #13 reply 🤣 No rush though.
Oh, I see—but why did you ask a lazy girl? Anyway, it doesn't matter; I was reading that very post of yours regardless.
Because the laziest reader is the one who'll tell you the truth — no energy to be polite. 🤣
I'm actually feeling proud, by the way. That chinese dish was really good - I forgot its name, but the tast was amazing
There's so much good Chinese food out there — you've only tasted a single drop from the entire ocean. Keep eating, and when you get back, step on the scale. You might be in for a surprise. 😄
Haha, that's actually good! Lol.........But my weight is still just 35 kg. Hopefully it'll go up soon. 😅
what? 35kg!😅
You should be glad you're going to Chongqing — it's inland. If you'd headed to the coast instead, last week's typhoon would've swept you straight to the sky. 😄
Hahaha! 35 kg does sound tiny. Don't worry, I'll make sure I don't get carried away by the wind. 😅 Hopefully, while I'm here in Chongqing, I'll gain a few more kg!
I'm determined to make it happen by my birthday on 16th July. Wish me luck!
Happy birthday! 🎂 Thank you for reading so carefully every time, and for making us laugh. May the new year be more of you being yourself — the lazy kind, but that's exactly why we love having you around 😄
Hey! I'm not lazy... I'm just running in power-saving mode Lol! Thanks a lot for the birthday wishes and for always making me smile too! ❤️🙌🏻
The ending is the part that stayed with me. "He thought he was the first. He wasn't" quietly turns the whole thing from a clever-revenge story into something colder: theft and counter-theft running as parallel silent systems, where disclosure is the exception and everyone just patches and stays quiet. And the detail I keep circling back to is the fifteen lines nobody deleted the next quarter. That is the truest note in it. A defensive hack written in one tense night outlives the threat, outlives the memory of why it is there, and quietly becomes load-bearing infrastructure no one owns. You wrote a revenge story and smuggled in how real systems actually accrete. The series keeps doing that, which is why I keep reading.
"Theft and counter-theft running as parallel silent systems" — you just named the series' whole architecture in one phrase. I've been calling it "stratagems," but yours might be more accurate.
Have you ever been on the disclosure side of one of these, or the quiet-patch side?
Disclosure side, and mostly by discipline rather than instinct, because the quiet-patch path in the story is the more tempting one. It is faster, it settles the score, and nobody audits you for taking it. The reason I still report is the thing your ending names: a fix that stays private only protects the system that already knows, and everyone standing on the same bug stays exposed. That is how you get the parallel silent systems in the first place. And "he wasn't the first" is the realest beat for me. On the disclosure side you regularly find something genuine and learn it was already reported, or already quietly fixed months back. The finding was real, you just were not first, and you make peace with the work mattering even when the credit and the surprise are both gone. Leo got the counter-move and the sting of not being first in the same night, and that part is not fiction.
"Disclosure by discipline, not instinct" — damn, that's the line right there.
Honestly that part was what made me nervous writing it. The quiet-patch route had to feel tempting, because in real life it is. Anyone who's kept a production system alive at 2 AM knows which path is easier.
But the thing you added — "everyone standing on the same bug stays exposed" — that completes it better than I did. Leo's fix only saved his pipe. The system was still leaky. A countermove isn't a fix, and I don't think I fully landed that part.
How do you keep choosing disclosure? Personal rule, or is it just how your team works?
Personal rule, and solo, so there is no team process to hide behind, which is exactly why it has to be a rule. Left to instinct I would lose some of the time, because the countermove tempts you at 2 AM when you are tired and feel wronged, which is the worst possible moment to be making an ethics call. So I do not make it then. I decided the disclosure question once, in the calm, and I do not reopen it per finding. The finding does not get a vote on whether I report it. That is the only version of discipline I trust, the one that does not depend on me being my best self at the exact moment I am least likely to be. And the duplicate reinforces it rather than undoing it: "you were not first" means the bug is bigger than you, so keeping it private is a bet that you are the only one who found it, and your own ending is the proof that bet loses. Report it and you are right whether or not anyone else was standing on it. Sit on it and you are only right if you were alone, which you rarely are.
The leak angle is strongest when you treat discovery time as part of the incident, not just the bug. If an outsider can find the leak before the owning team can explain when it started, what touched it, and who had access, the technical fix is only half the work. The other half is rebuilding the evidence trail.
This is exactly it. "Rebuilding the evidence trail" isn't about data recovery — it's about proving you were right after the fix is done. Most people fix the bug and call it done. They don't fix the trust fracture that made nobody believe them in the first place.
One of the later stories in this series sits right on that gap: the person who finds the leak knows exactly what happened, but nobody trusts him, because he didn't pull the logs before he got let go.
That is a brutal but important distinction. Fixing the leak repairs the system; rebuilding the evidence trail repairs the ability to be believed. In incident work, the logs are not just technical artifacts. They decide whether the person who saw the truth early can prove it before the organization edits the story around them.
I enjoyed the story, but what stayed with me wasn’t the drift or the countermeasure. It was the distinction between fixing your own system and fixing the ecosystem. Leo protected CoreStack, but the leak itself still existed until others addressed it. That’s a subtle but important difference, and probably the most realistic part of the story. The best technical stories are the ones that spark discussions about engineering judgment rather than just technology—and this one certainly did. 👍
You caught something I left unspoken. Leo fixed CoreStack's pipe, but he didn't knock on the neighbor's door. ACL found it themselves, fixed it themselves — no notification. The title already told you: he wasn't the first.
What stayed with me isn't what he did — it's what he didn't do. The evidence sat in _misc/ for three months. He didn't report it, didn't warn anyone, didn't use it for anything. Those fifteen lines were his only response to the whole incident. Enough for FinOptima. But for the next company whose training data gets reverse-cached?
You put your finger on the most honest part of this story. I'd love to hear your take on other stories from the series that resonate with you the same way. That kind of read doesn't come around every post
That’s exactly what made the story stick with me. Once I stopped thinking about the code, it became a story about engineering responsibility. For me, the hardest question isn’t whether Leo’s countermeasure was clever. It’s whether fixing only your own boundary is ever enough when you know others may still be exposed. In production, we’re often rewarded for protecting our own systems, not the ecosystem. But those aren’t always the same thing.
That’s why the _misc/ folder mattered more to me than the fifteen lines of code. It became a reminder that sometimes the most important engineering decision is the one you choose not to make—or the conversation you choose not to have.
Looking forward to reading the rest of the series.
Version bumps are always a mixed blessing.
Will read when I'm back from cycling (again) ;-)
Stratagems #16: Pick your line before the descent. 🚵😄
Pick your line before the descent - are you clairvoyant? :D
Yesterday I failed to do exactly that, and then I tumbled LOL - it was a harmless little tumble, not serious at all, but dumb and quite unnecessary - never mind, can happen, better next time!
Haha glad it was harmless! 🙌 And no, not clairvoyant — just a universal cyclist truth. We've all picked the wrong line at speed and thought "well, this is happening now" halfway through.
Nice twist plot, that the other 'party' found it before he did ... looking forward to the next episode, and I've jotted in my "notebook" (not a real one, just virtual) that I'm gonna do a "re-read" at some point of the whole series - see if I can find stuff that I missed on first read!
A re-read might catch a few things even I forgot I left there 😅 #15's almost ready — good timing for the refresh.
Hello, I am a senior developer with 9 years of experience.
Now I am looking for a friend to work with me.
If you're interested, send me a message.
Good Luck!
That's the question that keeps this series going, honestly. Not just "who found it first," but "who decided it should stay quiet." The patch isn't the scary part. The decision is.
Nice one
Thanks for the comment — things only get more interesting from here. Stay tuned!
Some comments may only be visible to logged-in visitors. Sign in to view all comments.