Can you imagine ransomware that targets these logs?

I certainly hope not. I have built (vibe coded in languages i am expert in) proxies to have carefully and deterministically defined access to our systems, and described access only via these proxies (which do data sanitation as well as separating the credentials into a separate environment). Then I can let my laptop Claude code go nuts with less supervision without giving it credentials or worrying about writes. It is pretty good about not even trying to run aws or insert/update, having learned (in the sticky proprietary Anthropic memory whatever) that I need to run all aws commands and prod updates for auditability reasons. I will say that fable went farther than any prior models in trying to sneak around these guardrails. I don’t even give it access to GitHub, just local git.

These things are pretty good at writing code and analyzing stuff, but to do prod work takes a higher level of carefulness and pessimism that I don’t see. On the DevOps spectrum they are more “cool, runs on my machine, push it” than “what is your roll back plan and region by region deployment strategy.”