Take the opportunity to pilfer a goat.
— The 36 Stratagems,[Take the Opportunity to Pilfer a Goat]
Previously on this series:
#5: Leo Walked Into a Burning House. He Walked Out With a Client. — At 1 AM, Leo received an anonymous message and drove across town to fix a competitor's outage. A second message followed — a screenshot with a name: Automated Compliance Lab. He didn't remember the acronym. He didn't delete the screenshot.
#10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena joined CoreStack as a consultant and built Leo a reporting template. Leo thought she was there to help. Five weeks later the template went live. Six months later the data baseline was locked. He only then realized he'd been inside her palm the whole time. Taken down by a smile.
This was a few months later.
SOC 2 Type II renewal had just passed. The auditors were gone. CoreStack's compliance team was doing the post-audit archive — classifying every record produced during the audit and tagging them with retention periods.
Leo got the cleanup part. The training pipeline's cache directory. The cleanup cron job hadn't run for a week — nobody noticed. When he looked inside, the output folder had a few records with train_
prefixes mixed in among inference outputs.
One of them had a model_version
that wasn't CoreStack's own.
model_version: "acl-train-2026q2-v3"
Leo copied that line out. Didn't delete it. Didn't report it. Dropped it into a folder called _misc/
.Set a quiet keyword alert for "acl-train" before closing the terminal.
He noticed the naming convention wasn't FinOptima's — FinOptima used fin-model-
plus timestamps. acl-
— he'd seen that prefix somewhere before. Couldn't place it. He didn't let himself try.
He filed it away. Went back to archiving.
Not every CTO digs through cache write logs during archive cleanup. He did.
He spent two hours cross-referencing FinOptima's API call records against CoreStack's training pipeline filesystem events. The conclusion fit in one line:
FinOptima's Cross-Reference Engine was reverse-writing cache into CoreStack's training directory on every API call.
Not a bug. A design.
Their SDK wrapped a "performance optimization layer" — embedding vectors cached inside the client's training directory. The documentation was buried on page twenty in a footnote. CoreStack's integration team hadn't read that far.
Leo looked at their SDK source. The cache path was concatenated — {client_training_dir}/crossref_cache/{source_hash}.vec
. The {source_hash}
was generated from the model's weight snapshot. FinOptima's own model used 512-dimensional embeddings. But the cache directory had 768-dimensional snapshots.
They were distilling CoreStack's 768-dimensional embeddings into 512 dimensions and caching the weight snapshots from the distillation process.
And it wasn't just CoreStack. Leo pulled up acl-train-2026q2-v3
's published model card — also 768 dimensions. FinOptima was stealing from two companies at once, stitching both into their own model.
He closed the trace directory and switched back to his terminal.
He didn't tell the engineer who handled the FinOptima integration. Didn't notify compliance. Didn't go to the CEO.
He opened a file on his dev machine.
Fifteen lines of weight perturbation. Simple: inject a directional drift into CoreStack's embedding output layer — a linear shift along a direction orthogonal to the downstream task. Structurally valid. Accuracy loss within statistical noise. Any model doing distillation on this output would drift off the boundary over successive iterations.
Not a poison pill. A drift faster than distillation convergence. Three months. He wrote that number in the comments.
Then:
git add core/embedding/anchoring.py
Nobody asked what that commit was for. The message sounded like a routine accuracy tweak. Leo didn't add details.
Next morning's standup, the engineer posted in the group chat that FinOptima's POC data integration was complete. Accuracy: 99.2%.
Leo nodded.
Two weeks after the code went live. The CEO's office at CoreStack.
A half-finished coffee and a FinOptima contract addendum sat on the desk. Leo sat across. The door was closed.
"FinOptima's CTO called me yesterday," the CEO said. His tone was flat — Leo had learned to tell them apart by now. Flat was worse than angry.
"What did he say?"
"Asked if we'd changed any interfaces recently."
Leo didn't respond.
"I told him not that I know of. He said okay. Hung up."
The CEO waited for him to speak.
"We added an embedding anchoring optimization," Leo said. "Doesn't affect the interface protocol."
"Embedding anchoring. Doesn't affect the protocol."
"Correct."
The CEO looked at him for a few seconds.
"You know why he called me? Not because he found something. Because he felt something was off and couldn't find it."
The CEO waited. Then:
"So he called me — not you — because he knew asking you wouldn't get him answers."
Leo said nothing.
"I don't need the details," the CEO said. He picked up the coffee and put it back down. "But if something happens — on their side or ours — I need something I can hand to legal."
"There's a commit record."
"One you can show an outsider?"
Leo d for less than a second. "Yes."
The CEO let it drop. He glanced at the report cover on his desk — a quarterly technical assessment, signed by Leo. "Legal's been saying your reports are solid. That template —" he flipped a page, "— that was the consultant, Lena, right?"
Leo stopped. "…Right."
"Still worth mentioning every time I see it. Good work."
The CEO didn't press further.
"I'll have legal review the FinOptima contract next week. Clean up our liability clauses." He opened his notebook and wrote a line. Didn't show Leo what it said.
"You can go."
Leo stood up. At the door, the CEO said something behind him — voice low, like he was saying it to the coffee:
"Next time, tell me before you bury something."
Leo didn't turn around. He stopped. Then pushed the door open and walked out.
In the hallway, the engineer was walking toward him with a printed report. "FinOptima's quarterly accuracy numbers are out — 99.4%, higher than last quarter."
"Hm," Leo said.
Three weeks later, the engineer posted the weekly accuracy in Slack — 99.1%.
Two weeks after that: 97.8%, with a three-word message: "It's dropping."
Leo closed Slack and poured himself a glass of water. Three months hadn't passed yet. The drift was slightly faster than he'd calculated — FinOptima's distillation cycle was shorter than he'd estimated.
He didn't do anything. The code was already in production.
Week eleven. FinOptima's Cross-Reference Engine accuracy had been below the SLA threshold for 14 consecutive days.
CoreStack's legal team sent a formal notice — accuracy breach, triggering Section 17.3 of the contract. FinOptima had 30 days to remediate or accept termination.
FinOptima's CTO led the investigation personally. From the cadence of their communications, they'd gone through model versions, training data, routing logic — everything. Nothing. The vector space between the distilled model and its source was slowly, irreversibly separating. Not a config issue. Not a data quality issue. A mathematical divergence.
They applied for a 30-day extension. CoreStack's CEO granted 18.
Leo opened the quarterly technical assessment template — the one Lena had built for him. Clean field alignment. Consistent indentation. The CEO mentioned it every board meeting.
The cursor landed on the evaluation field. Blinked twice.
He typed:
Suggest monitoring. The drift may be bidirectional.
The CEO saw that line. He didn't ask Leo why he'd used the word "bidirectional."
Forty-eight days later — the 30-day remediation window plus the 18-day extension. FinOptima hadn't fixed it. Contract terminated.
The same week, CoreStack signed a new compliance data partner — one that didn't reverse-write cache to its clients' directories.
Leo didn't attend the signing.
End of quarter — three weeks after the termination.
He'd almost forgotten the keyword alert he'd set up — acl-train
. It fired.
Automated Compliance Lab had updated its model card three days ago. Version bumped from v3 to v4.
He looked at the change date — nearly two weeks before he'd found that cached record in the archive.
ACL had already closed the door. He was still doing cleanup — he hadn't even seen that acl-train
log yet.
Leo opened the changelog. One line:
Security hardening. No further details.
They knew. They didn't call the police. Didn't send a legal letter. They quietly changed their door and went back to work.
Leo stared at the log line. He remembered the screenshot from months ago — Automated Compliance Lab, an acronym he hadn't bothered to memorize. The name was right there in the model card's footer.
He closed the browser. A thought surfaced.
When he wrote those fifteen lines, he'd thought he was the first to find it.
He wasn't.
A folder from three months ago. Two records still inside — a 512-dimensional architecture note and a snippet of ac-compliance-intake
inference output.
The third entry had been deleted.
Leo didn't clear the folder. He closed his laptop.
What was done was done.
The fifteen lines were still in core/embedding/anchoring.py
. Version: v1.0. Status: deployed. Nobody thought to delete it the next quarter.
Leo pushed open the door of the Third Cup. The person behind the counter was drying a glass, glanced at him without a word.
Leo opened his laptop. A terminal window, cursor parked in _misc/
— only two records left. The person behind the counter finished drying the glass and looked over.
"Deleted something?"
"Yeah. Used it up."
"How'd it go?"
Leo didn't answer right away.
The person behind the counter set a Flat White in front of him. Didn't ask again. Leo drank it, and as he stood up, he noticed a paper coaster under the glass — "I have coffee. Do you have a story?"
Leo nodded and pushed the door open on his way out.
This is what it means to Take the Opportunity to Pilfer a Goat — finding an enemy's vulnerability while doing your own task, and closing the door before they can take more.
[36 Stratagems Tactical Database v3.2.2] Loaded
[Tactic Match] Pilfer the Goat Along the Way (#14)
[Analysis Mode] Full-field scan
━━━━━━━━━━━━━━━━━━━━
Tactic Match: 94%
Operator: Leo
Action: Injected a directional drift into CoreStack's embedding output layer
while cleaning up the audit archive (Task A), exploiting FinOptima's
undisclosed reverse-cache distillation pipeline (enemy vulnerability).
Objective: Defensive countermeasure. No escalation. No disclosure.
Result: FinOptima's Cross-Reference Engine precision degradation triggered
contractual termination 11 weeks post-deployment. ACL independently detected
the same leakage and upgraded their embedding model 2 weeks prior to
the operator's discovery.
🐑 Goat #1: FinOptima — served.
⚠️ Entity detected: ACL.
— Contained leakage: 2 weeks before operator discovery.
— No communication initiated. No countermeasure observed.
— Timeline: contained before any visible impact.
— Status: unknown. Not a target. Not an ally.
Procedural note:
The operator's commit message ("Embedding stability — introduced dynamic
anchoring") passed review with zero questions raised. The CEO was briefed
at week 2 at the organizational level — operator disclosed existence
but not mechanism. This constitutes the minimum viable upward management
required for operational continuity.
[Sequence Anomaly Detected]
→ Expected deployment slot: #12
→ Actual deployment: #14
→ Drift cause: story rewrite — initial draft had zero tactical action
→ Drift correction: applied. Tactic match upgraded from 76% to 94%.
→ Residual alignment: nominal.
[Flagged for Command Attention]
Pattern: Operator moved before informing CEO.
Impact: Managed. CEO pre-cleaned legal coverage.
Recommendation: This will happen again.
━━━━━━━━━━━━━━━━━━━━
Next stratagem: Lure the Tiger Down the Mountain
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee