The rubric graded an empty chair

The academic assessment system does one thing. It evaluates a submitted artifact and converts that evaluation into a durable claim about a person’s understanding. A university like Brown does not measure cognition directly. It cannot. It reads an essay, a problem set, an examination response, and it treats the quality of that artifact as a proxy for the quality of the mind that produced it. The grade is not a measurement of learning. It is a measurement of output, recorded as if it were a measurement of learning.

The credential is the accumulation of those proxy measurements. A degree, a transcript, a GPA. These are attestations. They assert to a third party, an employer, a graduate program, a licensing board, that the holder possesses a body of understanding that was verified at the point of assessment. The entire value of the credential rests on the reliability of that verification. When a Brown professor says that AI cheating leads to a failed society, and that we cannot choose to become idiots, the statement is aimed at students. The failure it describes is not located in students. It sits in the coupling between the artifact and the understanding the artifact is trusted to represent.

The large language model did not attack this system. It produced an artifact. The assessment then did exactly what it was built to do. It evaluated the artifact against a rubric and issued a proxy score. Both components performed their designed function. A proxy that held for a very long time stopped holding, and the system that depends on that proxy continued to read it as though the world behind it had not moved.

The assumption was that an artifact of sufficient quality could only be produced by a mind that already held the corresponding understanding. This is the load-bearing assumption underneath every essay, every take-home examination, every graded submission at an institution like Brown. Producing a coherent argument about a text implied having read the text and understood it. The artifact was trusted because the cost of producing it was believed to be inseparable from the competence it demonstrated.

Trust was treated as transferable, from the artifact to the person, and as persistent once granted. The assessment validated the essay. The credential inherited that validation and carried it forward as a standing claim about the person. Once the transcript recorded the grade, the grade became fact. The system retained the score. It did not retain any link back to the conditions under which the artifact was produced, because it had no reason to. Trust, once resolved at the moment of grading, was never resolved again.

The assumption also held that the difficulty of production was stable. A 5-page analysis of a primary source carried a roughly fixed cost in time, effort, and comprehension. That cost was the security control. It was never documented as a control because nothing had to enforce it. The barrier to producing a passable artifact was understanding itself. The system was built on the belief that the output could not be faked without possessing the input, and for a long time that belief was correct.

What changed was not the students and not the assessment. What changed was the cost of producing the artifact. A large language model produces a coherent 5-page analysis of a primary source at near-zero cost in time and at zero cost in comprehension. The coupling between the quality of the artifact and the understanding behind it, the coupling the entire system was built on, came apart. The proxy and the reality separated. The assessment continued to read the proxy.

That assumption no longer holds, and the system was never designed to test it. The assessment does not re-evaluate whether a strong essay implies a strong mind. It evaluates the essay. It inherited its trust in the artifact from a world in which the coupling was reliable, and it carried that trust into a world in which it is not. Brown’s assessment did not malfunction. It graded artifacts accurately, and the artifacts were exactly as good as they appeared. What the artifacts no longer carried was the thing the credential asserts they carry.

This is where the framing of the scandal misleads. The warning that we cannot choose to become idiots, that this ends in a failed society, locates the failure in a choice. The system never presented a choice between rigor and its absence. It presented an assessment that can only see artifacts and a credential that converts the score into standing. The system optimized for efficient credentialing. It rewarded the artifact rather than the understanding, because the artifact was the only thing it was ever able to observe. When the cost of the artifact collapsed, the incentive the system creates did not change. It kept issuing attestations at the rate the artifacts arrived, and each attestation kept asserting an understanding the system had never measured.

The assessment resolves a single question, and it is not the question the credential answers. It resolves whether an artifact submitted under a person’s name satisfies a set of criteria. The system reads a file that arrived through a submission portal, confirms the file is bound to an enrolled identity, measures the file against a rubric, and records a score against that identity. Every step is externally observable and every step reports success. What the system never does is observe the conditions under which the file was produced, because there is no channel through which it could. The transaction it can see is complete and correct. The transaction the credential describes is not one it can see at all.

This is how reference came to stand in for validation. The submission binds a name to a document. Authentication establishes that the document came from the enrolled student. It establishes nothing about whether the understanding the document displays exists in that student, and it was never built to. Identity of source replaced integrity of content. The system verifies the reference, that this artifact was submitted under this name, and then treats the reference as though it were the thing referenced, that this understanding lives in this mind. The grade attaches to the identity and the credential inherits the grade. At no point is the second binding, the one between a person and a body of understanding, actually tested. It is assumed to follow from the first.

Nothing in this is a bypass. No control was defeated because the relevant control was never a mechanism, it was an economic assumption about the cost of production. A well-formed artifact arrived, was evaluated, and was scored, and the system did precisely what it was designed to do. The condition stayed green throughout. And that is the exact shape of the failure, because the assessment cannot distinguish an artifact produced by understanding from one produced without it. It was never instrumented to see production, only output. If you cannot see it, you do not control it, and the academic assessment has never been able to see cognition. It reads the shadow that cognition casts. For a very long time the shadow could not be cast without the object. That is no longer true, and the reader continues to read the shadow.

The pattern is not academic and not new. A system that executes on a reference instead of verifying the thing the reference stands for will keep executing correctly long after the reference stops corresponding to reality. The reference resolves. Execution follows. Correspondence between the reference and the reality behind it is assumed at the moment of design and never checked again at runtime. The system is not broken when the correspondence breaks. It is doing the one thing it was built to do, faithfully, against a world that has moved out from under the assumption.

Watch the same mechanism operate in software supply chains. A build system resolves a dependency by name and semantic version. It retrieves whatever content currently answers to that reference from a registry like npm or PyPI, and it executes that content, because the version string resolved. The version reference is trusted to point to the same benign content it pointed to before. When Cisco’s CI/CD infrastructure executed a malicious update to a trusted dependency, it did not require direct access or social engineering. The registry answered the reference and the build did exactly what it was built to do. Identity of source, the package name and version, stood in for integrity of content, and the content had changed while the reference had not. The build verified that the reference resolved. It did not verify what it resolved to.

Brown’s assessment and Cisco’s pipeline are the same system wearing different clothing. Both resolve trust by reference. Both execute on the resolution. Neither revalidates the correspondence between the reference and the reality it once reliably indicated. This is why attackers do not need to break either system. They do not defeat the assessment or the build. They produce a valid reference, a well-formed artifact under a real name, a real version string pointing to altered content, and let the system extend its designed trust to it. The exploit is not an intrusion. It is the system operating as specified.

The academic credential resolves trust once, at the point of assessment, and never again. The transcript does not revalidate. The degree carries forward as a standing claim a trust that was resolved against an artifact and only ever assumed against a mind.

The large language model did not create this exposure. It removed the cost that had been silently enforcing the assumption, and the assumption was load-bearing precisely because nothing else was holding the weight. The system optimized for what it could measure, and it kept issuing attestations at the rate the artifacts arrived.

The system did not fail. It graded what it could see and attested to what it could not. The control exists. The outcome does not.