The Board Room

Deep dives

1. 01

   Your Defensive Architecture Is Now Transparent — And Your AI Infrastructure Was Never Secured

   Two Failures Arrived in the Same Week

   The week produced two security findings that would each define a bad quarter on their own. Together they retire the operating model most security programs still run on. TrustedSec pointed LLMs at five commercial EDR products and found all five architecturally identical: YARA-style rules, behavioral logic, allowlists, prefilters, Lua-based scripted engines readable after a single decryption pass, and local ML classifiers. Reverse engineering work that used to take a skilled human weeks now takes days. The endpoint detection category has been running on obscurity, and the obscurity is gone.

   The security model assumed the cost of understanding the agent exceeded the value of bypassing it for most adversaries. That assumption no longer holds for a growing share of the threat population.

   In the same window, CISA added five AI infrastructure tools to its Known Exploited Vulnerabilities catalog, including LiteLLM, Ollama, and OpenClaw. These are tools most engineering teams adopted without security review, in the narrow gap between experiment and production that AI tooling closed in roughly two quarters. A Raspberry Pi honeypot configured as an AI stack was indexed by Shodan in 3 hours and absorbed 113,000 attacks per month, with 23% of traffic aimed at AI-specific endpoints.

   ---

   The Response Window Has Collapsed

   PraisonAI was weaponized within 4 hours of disclosure. An 18-year-old RCE in NGINX sat undisturbed across most of the web. Traefik shipped a CVSS 10.0 authentication bypass. Argo CD allows plaintext Kubernetes secret extraction at CVSS 9.6. Stack those disclosures against the same remediation teams, change windows, and testing capacity, and any organization on a quarterly patch cadence is operating with permanent known exposure.

   Microsoft's MDASH system found 16 exploitable flaws in a single Patch Tuesday cycle using multi-model AI analysis. That capability, or its functional equivalent, reaches adversaries within 12-18 months. The UK AISI confirms AI cyber task completion is doubling every few months, and Anthropic's Mythos became the first model to clear both simulated attack ranges. Congress is routing Mythos access through NSA rather than CISA, which is the clearest available signal about which use case the government treats as primary.

   ---

   The Foxconn Proof Point

   Nitrogen ransomware exfiltrated 8TB of confidential designs from Apple, Google, Intel, and Nvidia through a single contract manufacturer. The concentration of AI infrastructure work at a small number of assembly partners produces concentration of intellectual property, which produces concentration of target value. Supply chain data custody is now a first-class security surface, not a procurement annex.

   What Changed Since Tuesday's Coverage

   Tuesday's briefing argued that offensive capability was arriving. The finding this week is that defensive capability simultaneously failed. The endpoint agents are hollow. The AI infrastructure underneath them went into production without controls, and exploit windows are now compressed below most patch cadences. A reasonable skeptic will note that any single finding could be reversed by a vendor patch or a process change. The skeptic is right about any one of them. The point is that all of them landed at once, against the same teams, in the same week, which is what turns this from a patching problem into an architecture decision.