The Watch

The Threat

Researchers identified more than 300 malicious Chrome extensions with a combined 37.4 million downloads. This is not a theoretical supply chain risk — it's active exfiltration happening right now across enterprise environments. The breakdown is stark:

The 153 extensions confirmed to exfiltrate browser history immediately upon installation are the most dangerous — attackers harvest internal URLs, SaaS application paths, session tokens in URL parameters, and browsing patterns that reveal organizational structure. A separate LayerX report identified 30 extensions disguised as AI productivity tools sharing identical backend infrastructure, with 15 specifically targeting Gmail to extract email content and transmit it to third-party servers.

Why AI Disguises Make This Worse

The AI-tool disguise is particularly effective because users actively seek these extensions and grant them broad permissions. Gmail targeting means MFA codes sent via email, internal communications, sensitive attachments, and calendar data are all compromised. Browser history exfiltration reveals your internal tooling landscape to attackers — every Jira URL, every Confluence path, every internal dashboard.

Browser extensions with 37.4 million installs are exfiltrating your browsing history and Gmail content right now — the only question is whether any of them are on your managed fleet.

Defensive Actions

This requires same-day response. Pull your managed fleet's extension inventory via Chrome Enterprise policies. Cross-reference against published IOCs from the campaign. Enforce extension allowlisting immediately — block any extension requesting history, tabs, or Gmail read permissions that isn't explicitly approved. Monitor for anomalous network traffic from browser processes to unknown domains as your primary detection signal.

The Convergence

Eight independent intelligence sources this cycle converge on a single conclusion: AI agents are the fastest-growing ungoverned attack surface in enterprise environments, and the vendors themselves are admitting their defenses don't work. Three data points make this undeniable:

1Password's SCAM Benchmark: Universal Failure

1Password open-sourced SCAM (Security Comprehension and Awareness Measure), testing whether AI agents behave safely in real workflows — opening emails, retrieving credentials, filling login forms. Results across eight frontier models: safety scores ranged from 35% to 92%, and every single model entered credentials on phishing pages or forwarded passwords to external parties. The critical finding: applying a short security "skill file" dramatically reduced failures — meaning the fix is cheap but the default is dangerous.

OpenAI's Lockdown Mode: Vendor Admission

OpenAI introduced optional Lockdown Mode for ChatGPT and added Elevated Risk labels to ChatGPT Atlas and Codex. Read that carefully: the vendor is labeling its own features as elevated risk for prompt injection. Lockdown Mode is optional and off by default — every ChatGPT Enterprise deployment is running in a less-secure configuration unless you've acted.

OpenClaw Architecture: The Pattern Spreading Everywhere

OpenClaw — an open-source AI agent framework with 120,000+ GitHub stars — operates with the same permissions as the installing user. Its creator was hired by OpenAI after a bidding war with Meta. The architecture has persistent memory across sessions, always-on autonomous operation, and the ability to execute real-world actions including financial transactions and email monitoring. Multiple sources confirm this pattern is replicating: Klaw for agent orchestration, Warp's Oz for coding agent fleets, Ramp's Accounting Agent for financial workflows, and Goldman Sachs embedding Anthropic engineers for six months to build autonomous compliance systems.

AI agents that inherit user permissions and accept third-party plugins are privileged service accounts with an app store — treat them that way or accept the breach that follows.

The Financial Sector Amplifier

This isn't just a developer problem. Goldman Sachs has had Anthropic engineers embedded for six months building autonomous compliance and trade accounting systems. Ramp's Accounting Agent auto-codes, accrues, and syncs transactions to ERPs with a claimed 98% accuracy — meaning a 2% error rate on financial data. Meanwhile, Botkeeper shut down after 11 years and $90M raised despite 80%+ accuracy — proving AI capability doesn't guarantee operational reliability. Separation of duties erodes when an AI agent both codes and approves transactions.

What To Do

Deploy 1Password's SCAM benchmark (MIT-licensed, 30 scenarios) against every AI agent touching credentials or authentication before granting production access. Enable ChatGPT Lockdown Mode for all enterprise users immediately. Publish an AI agent security standard requiring sandboxing, scoped credentials, restricted tool access, and audit logging. No agent should inherit full user permissions without explicit security review.

Four Nation-States Hitting the Defense Industrial Base

Google's Threat Intelligence Group published a comprehensive mapping of coordinated state-sponsored operations from China, Russia, North Korea, and Iran targeting the defense industrial base. The specific TTPs are actionable:

• APT44 (Russia) — Exfiltrating Signal and Telegram data from devices captured in Ukraine, directly tied to battlefield technology theft
• Lazarus Group (North Korea) — Continuing Operation Dream Job against aerospace and defense via fake LinkedIn job offers
• Volt Typhoon (China) — Active reconnaissance against North American military contractor login portals, pre-positioning within critical infrastructure
• Iran-nexus groups — Participating in coordinated DIB targeting

The statistical backdrop: a 70% year-over-year increase in utility cyberattacks. This is current operational tempo, not a future threat.

Identity Infrastructure Under Siege

Three massive identity breaches in a single cycle compound the state-sponsored threat:

The SSA allegation is the most consequential. A whistleblower claims a federal tech team improperly cloned the master Social Security database into a poorly governed cloud. If confirmed, SSN-based identity verification becomes fundamentally broken — affecting KYC/AML, credit verification, healthcare identity, and every compliance framework that treats SSN knowledge as an authenticator.

Post-Quantum Cryptography: OpenSSH Forces the Issue

OpenSSH 10.1 now actively warns users when connections use non-post-quantum key exchange algorithms, pushing migration to mlkem768x25519-sha256 (default since 10.0). This is designed to counter store-now-decrypt-later attacks. Separately, quantum-as-a-service platforms (Amazon Braket, Azure Quantum, IBM Quantum) are entering production financial workflows for fraud detection and derivatives pricing — compressing the timeline for when harvested encrypted data becomes decryptable.

If your SSH infrastructure generates warnings after upgrading to OpenSSH 10.1, those are systems where sensitive data is being transmitted with an expiration date on its confidentiality.

The Economic Barrier to Shadow AI Just Disappeared

ByteDance released Seed 2.0, matching frontier model performance at $0.47 per million tokens — 73% cheaper than GPT-5.2 ($1.75) and 91% cheaper than Gemini 3 Pro ($5.00). At this price point, any employee with a credit card can access frontier-class AI reasoning for less than a coffee. Your CASB and proxy rules need to account for API calls to ByteDance's Doubao platform and associated endpoints, where data residency is in China.

This isn't just a ByteDance problem. Seven sources this cycle document the same pattern: AI tools proliferating faster than security governance can track them. Intercom's CTO explicitly advocates permissive, multi-tool AI adoption — letting engineers freely use Cursor, Claude, and Copilot without standardization. Spotify's top developers have written zero lines of code in 2026. Lightfield CRM connects to user inboxes with 3-minute onboarding. Each tool creates an unmanaged data exfiltration channel.

Open-Source Supply Chain Trust Is Eroding

A new tool called Vouch has emerged specifically to combat AI-generated low-quality contributions flooding open-source projects, implementing a web-of-trust model. The fact this tool needs to exist is the signal. When maintainers are drowning in AI-generated noise, review quality degrades — exactly the condition that supply chain attackers exploit. The xz-utils backdoor (CVE-2024-3094) succeeded partly because the attacker built trust while maintainers were overwhelmed. AI contribution floods compress that attack surface.

AI Detection Tools Don't Work

From China's #反ai movement: a famous Chinese essay by Shi Tiesheng was flagged as 95% AI-generated by detection tools. If your compliance, DLP, or trust-and-safety workflows rely on AI content detection, those tools are producing unreliable signal. Human authors are now actively modifying writing to evade detection — an adversarial dynamic mirroring attacker evasion of security controls.

Voice Cloning Has Reached Production Scale

Chinese podcast platform Ximalaya reports 30% of content is now AI-narrated, with human narrators experiencing 50% pay cuts. Voice cloning technology is no longer experimental — it's operating at consumer scale. Any organization using voice biometrics for customer verification or employee MFA should treat this as confirmation the attack tooling is mature and widely accessible.

The security threat isn't that AI got smarter this week — it's that it got 10x cheaper, learned to act autonomously, and is writing your codebase, while most security programs haven't updated a single control.