When Every Lamppost Can Think: The Security Problem the Octopus Model Ignores

Reacting to an article by Lance Harvie

Author: Berend Watchus. Independent non-profit AI & Cybersecurity Researcher. Publication for OSINT Team.

Distributed intelligence or distributed maximum vulnerability?

copyright: https://medium.com/@lanceharvieruntime/the-octopus-model-programming-systems-with-distributed-intelligence-across-sensors-and-actuators-de15b6100f01 My article here is reacting to this article by Lance Harvie [for take down request of the screenshot, let me know in the comments]

When Every Lamppost Can Think: The Security Problem the Octopus Model Ignores

[embed]The Octopus Model: Programming Systems with Distributed Intelligence across Sensors and Actuators For decades, the standard architectural approach in embedded systems engineering has mirrored traditional corporate…medium.com

Lance Harvie’s The Octopus Model makes a clean engineering case: stop routing everything through one central brain, push intelligence out to smart sensors and smart actuators, and let each “arm” decide and act on its own. The payoff he describes is real — less latency, less bandwidth, lower power, modular hardware that’s easier to upgrade and kinder to the planet.

As an engineering argument, it mostly holds. As a security argument, it quietly falls apart — and the article never notices, because it treats security as one subsection near the end rather than as a property of the whole design. Read properly, every advantage the piece celebrates is also an exposure. Worse, two of its headline claims — more secure-able and more sustainable — turn out to be in direct conflict. You can have one. You cannot have both at full strength.

Here is why.

The intelligence world already chose this octopus — and meant something colder

Before going further, it’s worth noting that the security and intelligence community is far less naive about this animal than the engineering article is. They got to the octopus first, and they read it the opposite way.

[embed]U.S. Spy Rocket Has Octopus-Themed 'Nothing Is Beyond Our Reach' Logo. Seriously. The Office of National Intelligence live-tweets the launch of a spy satellite-bearing rocket with an insane logo.www.forbes.com

[embed]USA-247 - Wikipedia USA-247, also known as NRO Launch 39 or NROL-39, is an American reconnaissance satellite, operated by the National…en.wikipedia.org

https://en.wikipedia.org/wiki/USA-247#/media/File:NROL_39_vector_logo.svg

In December 2013, the U.S. National Reconnaissance Office — the agency that builds and flies the country’s spy satellites — launched NROL-39 (catalogued as USA-247), a radar-imaging reconnaissance satellite, on an Atlas V from Vandenberg. Its official mission patch showed a giant octopus astride the planet, tentacles wrapped around the continents, beneath the motto “Nothing Is Beyond Our Reach.” This was not a leak or a parody. It was the real, sanctioned emblem, and the Director of National Intelligence’s office announced the launch on Twitter.

It landed months after the Snowden disclosures, and the public read it exactly as it looked: an unusually blunt admission of total reach. Commentators called it tone-deaf; Jon Stewart mocked it as a spy agency openly owning its own menace. The NRO’s own explanation is the part worth keeping. It described the octopus as “versatile, adaptable, and highly intelligent” — almost the same instinct the embedded-systems article reaches for — but aimed it at a different conclusion: that adversaries can be reached no matter where they hide.

That is the tell. The engineer sees an octopus and thinks distributed efficiency — many arms quietly doing useful local work. The intelligence world sees the same octopus and thinks distributed reach — many arms touching everything. And anyone who has worked the offensive side of that equation knows the corollary instantly: a system built to reach everywhere can also be reached at everywhere. The shape that means “our reach is total” from the inside means “our exposure is total” from the outside. Hold both readings at once and you already have the whole argument of this piece.

There’s a final irony the intelligence community would appreciate. According to a later, more mundane account from the ODNI, the patch didn’t begin as a statement of power at all. It grew out of an engineering in-joke about a troublesome bundle of cabling on the satellite — known in the trade as an “octopus harness” — that kept causing problems in testing, until the team quipped that the octopus harness had taken over the world. In other words, the most famous octopus in modern surveillance was born from embedded hardware misbehaving. Which is exactly the territory we are about to walk into.

This is older than spying — and it isn’t about spying

The obvious objection here is “fine, but that’s government surveillance, and I’m not building a spy satellite.” That objection misses the point entirely, and the history of the symbol is the quickest way to show why.

The octopus did not begin as a surveillance emblem. It is one of humanity’s oldest pictures of power exercised through many reaching arms, and almost none of that history is governmental. Twenty-five centuries ago the Sicilian city of Syracuse — one of the great maritime powers of the Greek world — struck silver coins with the nymph Arethusa on one face and an octopus on the other, widely understood as a sign of the city’s reach across the sea (more cautious historians read it simply as the emblem of a sea-port city, which makes the recurrence no less telling).

ancient Syracuse coins

https://www.cgbfr.com/sicile-syracuse-litra-ttb,v32_0007,a.html

In our own time the long-running Italian series La Piovra — literally “The Octopus” — used the same animal to portray the Mafia: a body that controls everything through interlocking local and international networks, exactly like an octopus.

A maritime empire, a criminal syndicate, and a spy agency, separated by two and a half thousand years, all independently reached for the identical image. They reached for it because it captures one specific idea better than anything else: control extended outward through many semi-independent arms.

That idea is precisely what the embedded-systems article proposes to build — in silicon, at the edge of every machine. So the right answer to “but that’s just spying” is: no, it never was. The octopus is not a story about states. It is a story about a shape, and the shape carries a fixed security consequence that does not care who wears it — a navy, a mob, an intelligence agency, or a factory full of smart actuators. Whenever you arrange a system as one central will commanding many far-flung, semi-autonomous arms, you gain reach and control and you pay for them in exposure. Every arm that extends your reach is an arm someone else can grab. Every limb that can act on your behalf is a limb that, once seized, acts on theirs.

For an ordinary organization or industrial system this is concrete, not poetic. The distributed arms are where the credentials live, where the control authority lives, and where the map of everything else lives — and they sit in the least defensible places you operate. Building outward this way takes the inner layers of the organization and its most valuable assets and pushes them to the perimeter, within arm’s reach of anyone who shows up. The octopus reaches the world; the world can reach the octopus right back, one arm at a time. That is the whole problem, and it has nothing to do with who launched the rocket.

Some places have guards. Most don’t. That isn’t an accident.

Start with a question the article never asks: why does serious protection cluster in a few places?

Vaults, data centers, secure facilities — they carry guards, cameras, alarms, mantraps, cleared and vetted staff, NDAs, 24/7 analysts watching for anomalies, even monitoring of the physical environment. The reason all of that lives there and not everywhere is simple economics. Protection is expensive, and the scarcest ingredient in it — sustained human attention — does not scale. So you concentrate the things worth protecting into a small, bounded footprint, and then you concentrate the defense around that footprint and pay for it once, spread across everything inside.

That is the principle the whole debate turns on: value can be spread thin; protection cannot, at the same density. A bank can guard a billion dollars because the billion sits in one room. It could not guard the same billion if it were scattered as loose cash across ten thousand street corners — not because the street corners aren’t worth defending, but because no security budget covers ten thousand guarded corners.

Distributed computing scatters the valuable thing across the street corners on purpose. And the moment you do that, the security floor for each piece drops to whatever an unattended object in a public place gets — which is essentially nothing.

A lamp, a smart bulb, and a thinking machine are not the same risk

Now picture a single lamppost, climbing three rungs.

A dumb lamp. Smash it and you lose a light. That’s the whole loss. No one needs to guard a lamp.

A networked smart lamp. Now it’s a computer on a network. It holds a credential, it can be reached remotely, and it can be conscripted. This isn’t hypothetical — it’s the entire history of IoT botnets, from Mirai in 2016 through the Aisuru and RondoDox campaigns still running in 2025–2026, which scan the internet for devices with default passwords and enroll them automatically. The lamp’s own value is trivial; its value to an attacker is as a foothold.

A thinking node with agency — the octopus model’s “smart arm.” It senses, it runs an AI model that makes decisions, and it has authority to act on the physical world. Now compromising it gives you three different prizes at once, and this is the part the article misses entirely. There’s a ladder of stakes here, and each rung is more dangerous than the last:

1. Value — the device itself, the cheapest prize.
2. Access and information — the keys, certificates, network map, firmware, and the very protocol grammar that makes the node’s peers believe it. This is the dangerous middle rung. A stolen diamond is just a lost diamond; a compromised smart node is a master key, the building’s blueprints, and a valid employee badge, all taped to a lamppost. You haven’t taken one asset — you’ve been handed the means to reach the others.
3. Control — the ability to make physical equipment do what you want. This is the top of the ladder, and it’s a category beyond data theft. Stuxnet (2010) quietly drove industrial centrifuges to destruction while reporting normal readings upstream. The Triton/Trisis attack (2017) went after the safety system whose only job was to shut things down before they got dangerous.

Notice that the security need doesn’t climb gently up these rungs — it jumps. A thinking, acting node needs protection on an entirely different order than a smart bulb, which already needs vastly more than a dumb lamp.

And the octopus model’s proposal, stated plainly, is: put the top rung everywhere. Take the most dangerous capability in the system — autonomous control, bundled with the keys and topology that unlock everything else — and ship it out to the headlight, the field cabinet, the factory-floor motor: physically exposed, unattended, individually too cheap to guard, and too numerous for anyone to watch. You’ve inverted the security gradient. The most dangerous capability now lives in the least defensible place, multiplied by the node count.

The rest of the failure modes all follow from that single inversion.

The trust problem: the actuator just obeys

The article’s showcase example is a smart actuator that receives “accelerate to 3000 RPM” and carries it out on its own. That autonomy is sold as the feature. It is also the vulnerability.

The networks these systems run on (CAN and CAN FD) broadcast messages with no authentication — any node that can put a well-formed message on the wire is believed. The 2022–2023 wave of “CAN injection” car thefts (catalogued as CVE-2023–29389) exploited exactly this. Thieves reached the bus through a car’s headlight wiring, injected fake messages telling the vehicle to unlock and start, and drove off in under two minutes. The hardware cost about ten dollars and hid inside a Bluetooth speaker case. The headlight node was worthless as value — but it was a trusted speaker on the bus, so physical access to it became authenticated control of the car. That’s the middle and top rungs of the ladder, reached through the cheapest possible node.

The blindness problem: you switched off the one thing watching

A centralized system gives you a single place to inspect what’s happening and a single place to pull the plug. The article even praises this — as a debugging convenience — and then throws it away. Security-wise, that one vantage point is also your monitoring and your kill switch.

Distribute everything and there is no single place to watch for an attacker moving from node to node. Firmware and model updates now have to be pushed across a whole fleet of different devices, which means a single compromised update channel can poison thousands of them at once. And the article’s proudest efficiency trick — letting the central brain drop into deep sleep to save power — means the one component that might have noticed trouble is, by design, asleep. A sleeping brain is a blind brain. The carbon saving and the monitoring gap are the same decision.

The resilience he sells has a second edge

Give Harvie his strongest claim at full strength, because he earns it. He is right that distribution removes operational single points of failure. If the central processor stalls, an edge control loop keeps running. If one node dies, the publish-subscribe layer routes around it. An arm can broadcast an emergency stop without waiting to be polled. As an availability argument — will the system stay up under load and component fault — this is sound engineering, and he sells it as a clean win.

The problem is that he never turns the claim over. “No single point of failure” and “no single point of control” are the same sentence read from opposite ends. The very property that keeps the system from going down by accident is the property that keeps it from being shut down on purpose — by you, when you need to halt it, and by a defender trying to stop a compromise from spreading. Resilience is not a dial you turn up; it is a direction. Whether the redundancy serves you or serves an attacker depends entirely on who is trying to take the system down at that moment — and a deployed system does not get to choose.

Hercules fighting the Hydra https://static.perseus.tufts.edu/Herakles/Hpix/1990.05.0243.jpeg

[embed]Herakles & the Lernaean Hydra Hydria (ceramic water container) depicting Heracles killing the Lernaean Hydra (an ancient serpent-like water monster)…www.worldhistory.org

This is the Hydra he built without naming it. The beast was unkillable for one reason: cut off a head and two grew back, because no single head was essential — distributed redundancy, the exact trait being sold here. That is also precisely why it was a nightmare to fight rather than a joy to defend. The trait isn’t borrowed from another story; it is sitting inside his own architecture, filed under benefits. You already saw the modern version earlier in this piece: when law enforcement disrupted four major IoT botnets in 2026, the infected devices stayed infected and ready to be conscripted again. The heads grow back, because a distributed fleet has no neck to cut.

And the myth is just as blunt about how the fight is actually won. Herakles did not beat the Hydra head by head — that is the losing game. He won by stopping the regeneration at its source, cauterizing each neck, and then pinning the one immortal head that made the whole creature persist. Out of myth and into defense: you do not secure a thousand autonomous nodes by chasing breaches arm by arm. You secure them by concentrating control where the system’s reach and trust originate — or you spend forever swinging at heads that grow back. Which is exactly where an honest version of this architecture has to end up.

The AI problem: you can’t audit a verdict

The article tags itself “AI” and puts a model at the edge that decides things — “bearing fault, 92% confidence” — which the rest of the system then trusts. But a model that makes the call is a model that can be made to call wrong, and three things follow.

It can be fooled at the moment of decision. Researchers stuck a two-inch strip of tape on a 35 mph speed-limit sign and made a Tesla’s camera read it as 85 mph. Stickers on a stop sign can make a classifier see a speed-limit sign, reliably, from multiple angles and distances. In the octopus model the brain has thrown away the raw data to save bandwidth, so it has nothing to check the verdict against — the conclusion is all it ever sees.

It can be poisoned before it ships. A backdoored model can pass every acceptance test and behave perfectly until it sees a trigger only the attacker knows, then misbehave on cue. In a fleet of nodes each running its own model, there is no central place to catch this.

And the models themselves are now a supply-chain target. The standard way of packaging a model (Python’s pickle format) runs code when the model is loaded. Attackers have planted hundreds of malicious models on public model hubs that open a backdoor the instant they’re loaded — security scans of one major hub flagged hundreds of thousands of unsafe model files. On an ordinary laptop that’s bad. On a node wired to a motor or a valve, loading a poisoned model is remote code execution on a machine that moves things in the physical world.

There’s an offensive multiplier too: a sprawl of cheap, varied, individually weak nodes is exactly the terrain that automated, AI-driven attack tooling thrives on. The fleet diversity the article sells as sustainable modularity is, to an automated adversary, just a longer menu.

The contradiction at the center

Here is the part that should stop the article in its tracks, because it uses the article’s own sustainability claim against it.

The efficiency comes from stripping each node down to the cheapest thing that performs its function — the smallest chip, no spare cycles, raw data discarded, the center asleep. Security is everything you have to add back on top of that minimum: a hardware security module per node, secure boot, encrypted and authenticated messaging, signed-and-verified model loading, tamper-resistant enclosures, local anomaly detection, and human attention to watch it all. None of that advances the node’s actual job. All of it costs silicon, power, bandwidth, and attention — the very things the design saved by leaving them out.

So securing a distributed system means re-adding, at every one of its many nodes, precisely the overhead you distributed the architecture to shed. And it doesn’t merely add — it multiplies. In a centralized design you buy one hardened room, one secure module, one monitoring team, and amortize all of it across everything inside. Concentration lets you pay once. Spread the value, access, and control across N locations and the protection bill scales with N: N secure elements, N verification chains, N tamper enclosures, and an N-fold monitoring load that no realistic headcount covers.

Which leaves three honest options, and the architect has to pick one:

• Secure every node properly. You re-add the hardware, crypto, enclosures, and monitoring at each endpoint. Cost, power draw, and footprint balloon past the centralized baseline. The “sustainable, smaller-footprint” claim is gone.
• Keep it lean and cheap. The nodes stay at sidewalk-grade security, and the value-access-control ladder stays wide open at every unguarded location. The security claim is gone.
• Split the difference. You get neither — partial controls that raise the cost without closing the gap, plus a false sense that the problem’s been handled.

There’s no fourth door, because the conflict is structural. Efficiency wants to concentrate nothing. Security needs to concentrate everything. The octopus model chooses concentration-for-efficiency and then quietly assumes it can also have concentration-for-security. It can’t. You can buy the security back, but only by spending the exact resources the design was sold to you as saving — measured in watts and silicon instead of open doors.

What honest distribution looks like

None of this means distributed intelligence is wrong. It means the tradeoff has to be stated honestly instead of waved away.

Distribute computation where it genuinely earns its keep — local control loops, edge filtering, latency-critical reflexes. But keep the high-stakes rungs of the ladder, the credentials and the real control authority, concentrated where they can actually be defended. Where you must push authority outward, pay for it openly: authenticate every message on the bus, attest each node’s identity and firmware, verify models before they load, and run anomaly detection at the edge even while the center sleeps. Cauterize the source of trust rather than chase every breach at the perimeter. That costs real resources, and the moment you budget for it, the sustainability math changes — which is the point.

Both the octopus and the Hydra are sharper metaphors than the article realizes, and they fail it the same way. Each gets its power from the same trick — redundancy and intelligence pushed out to the limbs, no single point of failure. But a real octopus earns that distributed autonomy with reflexes, camouflage, and an immune system: a whole body evolved around the risk for millions of years. The article wants the many smart arms. It is not building the immune system. Bolt distributed agency onto cheap hardware with none of the evolved defenses that make distributed biology survivable, and you don’t get an octopus or a Hydra — you get a thousand thinking lampposts, each holding the keys to the street, and no one watching any of them.

Let the brain strategize and the arms do the work, by all means. Just don’t pretend the arms guard themselves.

The spy agency’s patch was honest in both directions, and the second direction is the one that matters here. Nothing is beyond our reach — and once intelligence is bolted onto every arm, every node, every lamppost, nothing is beyond an attacker’s reach either. Distribute the reach and you distribute the exposure. That is not a flaw in the metaphor. It is the metaphor working exactly as the people who chose it first understood it.