Microsoft spent early July marketing AI as the thing that keeps Azure running.

That’s right, get ready to blame AI when Azure goes down.

CTO Mark Russinovich introduced the awkwardly named Brain, an AIOps system described as a “digital twin” of Azure’s own health, credited with powering deployment safeguards and outage declaration, and billed as the foundation for agentic operations.

Sounds like the 1931 Frankenstein to me, where the assistant grabs the abnormal brain and the doctor wires it in without checking the label. Maybe nobody at Microsoft watches horror movies. I mean, it kind of shows. For God’s sake people, you have to check the label!

Two days before their modern Frankenstein brain-in-cloud announcement, Microsoft Incident Response published guidance on securing AI agents, positioning the company as the authority on machine-driven change gone wrong.

Ok, now for the part you probably already knew was coming:

On July 23 an Azure maintenance request took down the West US region for five hours. The preliminary post incident review shows what sits under the tone-deaf AI brand: a scope bug that flew through every single safety check, and then a three hour hunt by human engineers to find their own change ticket.

The timeline is the new horror film script.

Maintenance began at 14:44 UTC. And customer impact is listed at 14:44 UTC. That matters a lot because the safety check certified the work as “impact-less”. It had so little impact that impact began the exact same minute the change was made.

Predictive genius! Where can I get me one of these super Brain things from Microsoft to tell me the future?

Let’s recap. All hail their abnormal Brain.

What happened?

A routine request to isolate specific network paths at a West US datacenter entered Microsoft’s maintenance pipeline. The pipeline compiles human requests into device-level operations before execution. A bug in that compiler marked additional devices as part of the maintenance event, and IP routes between the datacenter and the wide-area network were withdrawn from far more devices than the request specified.

That’s an integrity breach.

Route withdrawal at the datacenter edge forces the backbone to reconverge traffic onto whatever paths remain. Withdraw from enough devices at once and there is nothing left to reconverge onto, which is why the failure first presented to Microsoft’s engineers as large-scale route churn across the WAN, and to customers as a region losing its ingress and egress.

The Register counted 27 affected services. The Azure status page listed Microsoft Sentinel, Log Analytics, Azure Monitor, Application Insights, Microsoft Graph, AKS and Azure Firewall among them. Microsoft 365 degraded downstream, where SharePoint drew 78 percent of Downdetector complaints under incident MO1437424.

Full recovery came at 19:41 UTC, four hours and fifty-seven minutes after impact began. Let’s call it five hours.

What went wrong and why?

The Microsoft review describes a control sequence: the request is compiled to machine-readable form, verified against the requirement that at least one of two redundant paths stays healthy, cleared by safety checks, and executed.

The ordering seems vague.

If the checks ran on the corrupted request, they evaluated the expanded device set and certified it anyway, which means the impact model behind the checks has no connection to actual traffic.

If the checks ran on the original request, then the pipeline verifies human intent, executes machine output, and rechecks …nothing.

Both versions are from the same defect. Validation gets attached to the declared scope of the change. Then execution operates on the actual scope. That’s a gap.

Mind the gap. Or get an outage.

How did Microsoft respond?

Here’s their reported timeline, condensed:

UTC	Event
14:44	Maintenance begins. Earliest customer impact.
14:45	Teams review traffic anomalies, routing behavior and recent changes.
15:00	Impact scope and blast radius assessment.
16:00	Routing behavior correlated to recent fiber maintenance activity.
17:45	Rollback initiated.
18:26	Rollback complete.
19:41	All services recovered.

Let’s dig into three numbers.

1. The rollback took 41 minutes.
2. Service recovery took another 75.
3. Finding the cause took three hours.

Engineers were reviewing recent changes at 14:45, one minute after impact. The cause was a maintenance event in Microsoft’s own change system, executed at exactly 14:44, touching exactly the devices where routes disappeared. Matching WAN-wide route withdrawal against the change record of the same minute is a join across two internal datasets. It took until somewhere between 16:00 and 17:45.

Part of the delay is in their flawed architecture. I mean, can the fire department put out a fire in their fire truck?

Sentinel, Log Analytics, Azure Monitor and Application Insights sat on the impacted services list, so the tools that observe the network went down with the network, for Microsoft and for every customer trying to diagnose the same event.

I’m sorry, but that’s just plain stupid. Like 1980s disaster recovery stupid. Is there nobody at Microsoft poking around saying “uh, guys, are we the baddies?”

Maybe the answer comes from the fact that their document also disagrees with itself about what the event was. The summary calls it device maintenance. The 16:00 entry calls it fiber maintenance activity. Is that two people or one with two voices? There’s confusion in the authoritative account, which reads like a review assembled from scrambled brains and shipped unreconciled.

How are they making incidents like this less likely or less impactful?

Microsoft has been publishing its answer for five years. Yeah, the big marketing machine has been on it!

The Advancing Reliability series introduced Gandalf, a safe deployment service that applies anomaly detection and “temporal and spatial correlation” to catch bad changes during rollout.

The Triangle System extended AIOps into incident management to cut time to resolution.

Brain arrived this July as the digital twin, credited with deployment safeguards and outage declaration.

Imagine launching Brain after you launch Gandalf. Did he not have a brain?

Now let’s place the marketing as a timeline overlay:

• A deployment safeguard built on temporal and spatial correlation exists to flag a change that begins at 14:44 when route churn begins at 14:44.
• An incident management AI exists to compress the three hours spent on attribution.

Whatever these heavily marketed systems did on July 23, the review instead credits detection to service degradation alerts and diagnosis to human engineers ruling out components by hand. The AI appears in the blog instead of the incident narrative, which seems exactly backwards.

The June 30 agent security guidance makes this disconnect from reality even worse. It’s like brain in a vat. It warned that intermediary layers converting intent into action fail at their trust boundaries, and that changes to machine-read instructions can activate without re-approval, a failure mode it named “silent re-trust.”

So fancy sounding. It was written about AI agents, as advice for customers to follow to be like Microsoft. And then the July 23 outage follows the same pattern inside Microsoft’s own maintenance automation: a compiler between human intent and device action, a scope change that activated with zero further review, and every individual route withdrawal fully legitimate under an approved ticket.

That has to burn. But seriously, I’ve written before here about a bypass flaw, that Microsoft agentic safety is strangely empty rhetoric.

How can customers make incidents like this less impactful?

The June guidance tells customers to treat every external dependency as part of their supply chain and to distrust self-certified capability claims. Hey, ok, so let’s apply that advice to its author!

A cloud region is a dependency whose maintenance automation changes production behavior with zero customer-visible review, certified safe by checks the customer never sees. The solution seems simple. Run monitoring outside the vendor’s failure domain. Treat vendor pre-checks as claims that require independent verification.

Sentinel customers in West US received the demonstration of Microsoft being bad at being Microsoft at 14:44.

In summary of this circus show with AI as the main act, Microsoft’s July publications put AI at every layer of Azure operations, from securing agents to declaring outages. The post incident review shows July 23 was in fact a buggy request compiler, and engineers hunting their own change ticket for three hours.

Very horror film. Much stupidity. You probably shouldn’t trust Franken-Microsoft, and maybe even ask why anyone should.

Make of this case what you will. It offers the facts as they stand today. A privacy company is implicated in extremist politics organized against the rights it sells, privacy first among them.

Opposites: A theme emerges that they are branded the “mole” company, a privacy leaker, yet they sell a VPN service. The co-CEO calls himself a libertarian anarchist, yet holds up royal families, the Catholic Church and the Order of Malta as his model sovereigns, with borders reduced to property lines where admission is sold or rented.

The record consists of the company’s own statements and the owner’s own essays. It requires no interpretation beyond reading. This is simple reasoning.

The Exhibits

A. Flamman, June 26, 2026. Daniel Berntsson donated five million kronor to Örebropartiet, 72 percent of the party’s annual income, the largest single private donation to any Swedish party in 2025.

B. Hacker News, June 27, 2026. Fredrik Strömberg, signed, states the donation is “not part of Mullvad’s values or mission” and offers refunds to departing customers.

C. mullvad.net, July 20, 2026. Unsigned corporate statement under the tag “Mullvad community”. Names no party, no amount, no platform, no surname. States “It should be clear by now how the party donation relates to this.” The refund offer is deleted. The company likens itself to a force of nature and to cryptography, operating with no human arbiters. It asserts that persecuted ideas sometimes become the self-evident truths of later history. It links to Berntsson’s personal blog for his rationale.

D. dberntsson.info, July 20, 2026. Four English essays published the same day as Exhibit C, on a blog dormant since September 2019 and previously written in Swedish.

E. Contents of the essays. Berntsson identifies as a libertarian anarchist. He defends the donation through the “transferiat” class framework of Allard and Kyeyune, naming welfare recipients and the public-sector middle class as the extractive enemy. He lists the sovereign individuals he admires: royal families, the Catholic Church, the Order of Malta. He concedes the party is unfit to govern and answers “Do I want ÖP to get a lot of power? No.” The word remigration appears in none of the four essays. His immigration essay reframes the question as border admission, arguing all parties already exclude 82.64 to 82.67 percent of humanity and disagree over 0.03 percent. His moral philosophy essay holds that ethnicity, clan, religion and nationality are irrelevant to moral concern.

F. dberntsson.info, January 2018. “Bygga en väljarbas”. Working immigrants are deported while welfare-dependent immigrants remain, closing with a Bergsjön district election result. The imported-electorate thesis, in his own words, eight years before the donation.

Findings on Berntsson

1. The label is false. His own text says so. His model sovereigns are monarchs, a church, and a crusader order. His borders are property lines where admission is sold or rented. The program abolishes public power and retains private power, which converts wealth back into rule. This is propertarianism wearing liberation vocabulary, the same propaganda that “remigration” performs on “migration”.

2. Intent predates the donation. Exhibit F establishes the imported-electorate thesis in 2018 and his 2026 rationale essay links back to it. Five million kronor was continuation, not impulse.

3. He knew. His own published ethics classifies ancestry-based exclusion as morally invalid. He funded a party built on it anyway, and wrote the ethics essay the same day as the defense. The record establishes knowledge, not confusion.

4. The evasion is structural. Four essays, thousands of words of justification, and the platform that caused the controversy goes unnamed. He substitutes admission policy for the expulsion of legal residents and citizens. A man who believed the platform defensible would defend it. The substitution is consciousness that it is not.

5. The disavowal convicts him. Funding 72 percent of an organization’s income while writing that you want it to hold no power establishes that he understands exactly what funding does. The sentence functions as deniability, drafted in advance.

6. The tradition is documented. He cites David Friedman’s anarcho-capitalism. The adjacent paleolibertarian branch built this politics deliberately: Rothbard’s January 1992 “Right-Wing Populism” essay proposed the alliance with the nativist right, and Hoppe’s Democracy: The God That Failed (2001) theorized covenant communities entitled to see dissidents “physically removed”, a phrase the far right adopted as a slogan. An anarcho-propertarian funding an expulsion party is that branch operating as designed.

Findings on Mullvad

1. The company reversed itself on the central question in 23 days. June: the donation has no relation to Mullvad’s values, and this is obvious. July: the relation should now be clear, after five paragraphs constructing it. The laundering ceased to be an inference and became stated corporate doctrine.

2. Non-involvement is refuted by logistics. A seven-year-dormant Swedish blog produced four English essays on the exact day the corporate statement linked to them. Synchronized publication plus corporate distribution is participation.

3. The July statement is an exercise in record management. Unsigned, anonymized, stripped of every specific: party, sum, platform, surname. The June statement carried a name. The company learned to leave fewer fingerprints, which demonstrates awareness of liability.

4. The refund deletion removed the one mechanism that acknowledged customer agency, replaced by a self-description as an agentless force of nature. The company disclaims human arbiters at the precise moment a human arbiter’s five-million-kronor decision is the question. Cryptography has no discretionary cash flow. Owners do.

5. The corporate philosophy now files ethnonationalist expulsion under ideas awaiting testing, with the persecuted-ideas-become-truth passage positioning the funded platform for future vindication. That sentence, in that statement, is an endorsement structure with the endorsement removed.

6. The danger. A VPN is a pure trust product; customers buy the owners’ judgment about what privacy is for. Mullvad’s owners have now demonstrated, across two statements and four essays, that their operative definition of privacy excludes its core function: protection against the state mapping populations by ancestry. Remigration proceeds only through exactly such a register. One owner funds the politics that requires the register. The other institutionalizes corporate neutrality toward it. Both statements, 23 days apart, avoid the privacy contradiction entirely, and the silence is the finding. A privacy company that cannot say a population registry is wrong has told you what it protects. It protects the owners.