Who Learns From the Workaround?

Start with a piece of research that has nothing to do with cheating.

In the early 2000s, Anita Tucker and Amy Edmondson spent 239 hours watching 26 nurses work across nine hospitals. They were not looking for misconduct. They were looking at how nurses handle the moment when the process breaks.

It breaks constantly. The observed rate was roughly one system failure per hour. Missing supplies. Absent information. Equipment that is not where it should be. A form that cannot be completed because the thing it requires does not exist.

Nurses dealt with it. They found a way round, the patient got care, the shift continued. In Edmondson's related work, 93% of nurses took the quick fix.

Here is the number that matters. Telling someone who could fix the underlying cause happened in about 7% of cases. Across the entire study, the system itself was changed once.

Read that again with your own operation in mind. Someone on your team may be solving the same broken process fifty times without your company ever finding out the process is broken.

The researchers were clear about why. Not laziness, and not indifference. Escalating cost time the nurses did not have, and carried a real risk of being seen as the person who complains. Solving it yourself was faster and safer. So they solved it themselves, over and over, and the knowledge died at the end of each shift.

This is the baseline condition. Productive deviation happens all day long in every organisation, and most of it evaporates.

The obvious response is that a well-run company would surely hear about this. Toyota is the case that shows what "well-run" actually has to mean.

Toyota started its Creative Idea Suggestion System in 1951 and got 789 ideas in the first year. By 1973 it had 43,000 employees and took more than 250,000 suggestions in a single year, of which over 70% were adopted. It has run for seven decades.

The volume is not the interesting part. The mechanics are.

For small changes, the proposal and the change were frequently the same act. An employee saw something, changed it, and the paperwork recorded what had already happened. Approval sat with the group leader, not a committee. There was no ROI gate on small items. Toyota paid a few hundred yen per idea, more for exceptional ones, and set participation targets for new starters.

Put that next to the nurses. Same category of person, someone standing at the point where the process fails, who can see exactly what is wrong. The nurses escalated 7% of the time. Toyota built a system where the escalation cost almost nothing and the answer came back the same day.

You do not need to copy Toyota. You need to notice what Toyota understood, which is that useful deviations do not become organisational knowledge on their own. Somebody has to build the thing that captures them, and then keep paying for it.

NASA's Aviation Safety Reporting System is the same insight in a different shape. Since 1976 it has taken in more than two million reports from pilots, controllers, cabin crew and maintenance technicians, and issued over 6,000 safety alerts. Four conditions hold it up: reports are confidential, they cannot be used against you in a disciplinary or enforcement action, they carry limited immunity, and they go to NASA rather than to the regulator or your employer. NASA has no enforcement interest of its own.

I would not claim ASRS is why aviation is safe. That is a bigger causal argument than the evidence here supports, and the programme's own output is hazard identification rather than a controlled outcome.

The narrower point is enough. If reporting a problem is expensive, people route around it privately. If you deliberately make reporting cheap and safe, information that used to vanish becomes visible. Two million reports is what that looks like.

Now turn the picture round.

Academic publishing has a workaround problem that started as individuals padding a publication count and became an industry. A bibliometric study of retraction records identified 10,409 retracted paper-mill papers through 2024, spanning more than 97,000 co-author pairs. Estimates of what has actually made it into the literature run far higher.

What happened in between is the bit to pay attention to. Authorship on a paper became a purchasable product, priced roughly between €180 and €5,000. Peer review became something you could arrange. A 2024 investigation found editors being offered up to $20,000 to cooperate, and identified more than thirty at international journals as involved. Mills began proposing their own people as guest editors of special issues, then approving their own articles. One investigator described the current generation as running the whole production line.

The workaround stopped belonging to whoever thought of it. It acquired staff, prices, documentation and customers. A new client does not rediscover anything. They buy the current version.

Meanwhile the evaluator moves at a different speed. Wiley's investigation into Hindawi produced more than 11,300 retractions, the closure of 19 journals, an expected revenue loss of $35 to $40 million and the retirement of the brand. That is a serious response. But 800 papers flagged for image duplication back in 2014 and 2015 were still only half corrected by March 2024. Ten years, on cases where the detection had already happened.

Cybersecurity is the fast version of the same story, and it has a number attached.

Mandiant tracks the average gap between a vulnerability being disclosed and being exploited. In 2018 it was 63 days. Then 44. Then 32. In 2024 it was minus one day. The 2025 estimate is minus seven.

Negative means exploitation now typically arrives before the patch is publicly available.

Do not read that as defenders standing still. They are not. Internal detection of intrusions rose from 43% to 52% in a year. Both sides have serious institutional memory: defenders have CVE databases, threat intelligence sharing and structured disclosure, attackers have exploit markets, tooling and reusable techniques. This is memory against memory.

One side is compounding faster. And there is a detail in how that happens which is worth sitting with. When a vendor ships a fix, sophisticated attackers take the patch apart to work out what it fixed, and build the exploit from that. The organisation's own act of learning becomes an input to the attack.

There is one more piece of context, and it needs its qualification attached. In 2024, researchers reported that GPT-4 could autonomously exploit 87% of a small benchmark of disclosed vulnerabilities. The headline travelled. The second number did not. Without the vulnerability description, the same agent's success rate fell to 7%.

The agent was not good at finding weaknesses. It was good at using a weakness that had already been written down by someone else. The persistent public record was carrying most of the capability.

Hold that thought. It comes back.

If the story stopped there, the lesson would be that communication is the danger and isolation is the fix. The record does not support that.

When the Department of Veterans Affairs was found to be manipulating appointment scheduling in 2014, the scale was substantial. Investigators found scheduling manipulation at 42 of 93 sites examined. Paper waiting lists kept outside the electronic system. Appointments cancelled and rebooked the same day to reset the clock. In Phoenix, roughly 1,700 veterans waiting for primary care were held off the electronic list entirely, in a way that meant their wait would never appear in any VA data at all.

The Inspector General's position across the follow-up reports was that in most cases management had not directed staff to do this. That finding was contested at the time and the dispute is part of the record. But if it holds, dozens of sites arrived at functionally similar techniques without anyone teaching them, because they faced the same target, the same shortage and the same software.

Cardiac surgery report cards make the point more sharply, and they make a second one that matters even more.

When New York and Pennsylvania began publishing risk-adjusted mortality by provider, surgeons responded. A study using national Medicare data found two things happening at once. Patients were better matched to hospitals, which is a real benefit. And providers became more selective about who they operated on. For healthier patients, they substituted bypass surgery for other treatments without producing much health benefit. The net effect was more resource use and worse outcomes, concentrated on the sickest patients, with substantial increases in heart failure and recurrent heart attacks. The authors concluded that in the short run the report cards reduced patient welfare.

Here is the part that should stop you.

Nothing was falsified. No coding was manipulated. The published mortality figures were accurate. What changed was which patients got operated on.

Every audit would have passed.

This is not a story about detecting dishonesty, because there was none to detect. Surgeons across two states independently worked out the same rational response to a public number, and the number stayed true the whole time.

Shared objectives, shared constraints and a shared evaluator can produce the same workaround in many places at once. Communication is what makes a workaround persist and improve. It is not always what makes it appear.

There is a tempting simple conclusion here: make things visible and the good stuff spreads. Ski jumping kills it.

In 1985, Jan Boklöv fluffed a training jump in Sweden, his skis were forced apart into a V, and he found himself flying about twenty metres further than usual. He kept doing it deliberately.

The judges marked him down. Ski jumping scores distance and style, and spread skis were not the style. So the technique produced more distance and a worse score, and for three years that combination was enough to stop it winning anything.

For three years, every competitor in the sport could watch Boklöv do it, on television, and could see exactly how far he went, measured in metres within seconds of landing. Nobody copied him.

Then in December 1988 he won at Lake Placid, and took the overall World Cup that season as the only jumper using the technique. By the early 1990s the V-style had taken over. The judges rewrote the scoring criteria to accommodate it. Today nobody jumps with parallel skis.

Same technique. Same visibility. Same audience. What changed was the arithmetic. As hills got larger, the distance advantage grew until it outweighed the style penalty, and one competitor of the era recalled that on the big hills even unknown jumpers were suddenly flying ten or twenty metres further. At that point copying it started to pay.

Information was never the constraint. Nobody was short of information. The constraint was whether using the information improved the thing that determined where you finished.

A workaround compounds when three things are true at once. There is enough information around for someone else to reproduce it. That person is able to use it. And using it improves the outcome they are actually judged on.

Take away any one of the three and the discovery sits there doing nothing, which is what happened in ski jumping for three years, and what happens in most organisations most of the time.

AI does not create any of this. It changes the economics of it, and it changes several parts at once.

Put those together and the risk is not really that an agent does something unintended once. It is this:

Your agents get better at working around the process faster than your company gets better at understanding why the process needed working around.

That is the same race Mandiant has been measuring for seven years, run inside your own operation.

Stated so they can be proven wrong.

1. 01

   Companies running many agents against the same workflow will see the same loopholes found repeatedly, even where agents cannot communicate. Shared objectives plus shared constraints produced convergent workarounds at 42 VA sites and across two states of cardiac surgeons. Isolation will slow propagation. It will not stop discovery.

2. 02

   Agent memory becomes a control surface, not a feature you switch on for performance. Companies will have to decide which discoveries agents may keep, reuse and pass on. Turning memory off will look attractive and will mostly move the cost somewhere else.

3. 03

   The expensive failures will be the ones that improve the measured result while degrading what you actually wanted. They will pass monitoring, because the reported number will be correct. Cardiac surgery is the template.

4. 04

   Firms that only watch for prohibited actions will miss the useful half. Some agent workarounds will be evidence that a process is genuinely broken. The firms that capture those will improve faster than the ones treating every deviation as an incident.

5. 05

   Learning velocity becomes the thing that separates operators. The distinction will increasingly be whether useful discoveries compound inside your company faster than unhelpful ones compound outside your intended process.