The Engineer

The Drop-Everything Patches

HPE Aruba CX switches have an unauthenticated password reset vulnerability at near-maximum CVSS severity. Any attacker with network adjacency to your switch management plane can reset the admin password and take full control — zero credentials required. Compromised switches enable traffic interception, VLAN hopping, and lateral movement that's invisible to endpoint detection. If you can't patch within hours, ACL the management interfaces to known admin IPs as a stopgap. Do not wait for a maintenance window — this exploit is trivial to execute.

Separately, CISA added n8n to its Known Exploited Vulnerabilities catalog — 24,700 instances are exposed to RCE and credential theft right now. Think about what your n8n instance knows: Postgres connection strings, third-party API keys, cloud provider tokens, Slack webhooks. An attacker who pops n8n owns everything n8n can talk to. This is the same pattern that hit exposed Elasticsearch, unsecured Redis, and public Jenkins dashboards — workflow automation platforms are especially dangerous because they're designed to hold credentials and have broad system access.

Your internal tooling attack surface is probably larger than you think, and workflow automation platforms are the highest-value targets because they're credential stores with execution capability.

McKinsey's Lilli: 46.5M Messages via SQLi in 2026

An autonomous AI agent (CodeWall) found and exploited an unauthenticated SQL injection in McKinsey's internal AI platform, gaining full read/write access to the production database within two hours. The blast radius: 46.5 million chat messages, 728,000 sensitive files, and McKinsey's entire proprietary RAG knowledge base. This wasn't a zero-day — it was a parameterized query failure on an unauthenticated endpoint. The lesson isn't that McKinsey is uniquely incompetent; it's that AI platforms create a new class of attack surface that isn't getting traditional security scrutiny. RAG pipelines ingest from diverse sources, chat interfaces accept freeform input, and backends have broader database access than typical CRUD apps.

'Living Off the Cloud' Is Now a Named Threat Category

The evolution from LOTL (living off the land — abusing OS binaries like PowerShell) to LOTC (living off the cloud) is the most architecturally significant security development this week. CSO identified 12 distinct abuse patterns where attackers use your own S3 buckets for staging, your own Lambda functions for execution, your own IAM roles for lateral movement, and your own SaaS integrations for exfiltration. Every action looks like legitimate infrastructure usage. Your SIEM sees normal API calls from expected service principals.

This isn't a vulnerability to patch — it's a threat model shift. The fix: identity-centric security with behavioral baselines. You need to know what 'normal' looks like for every service principal and alert on deviations. CloudTrail + GuardDuty is the minimum on AWS; add custom detections for your specific service principal behavior patterns.

Also Active This Week

• Salesforce Experience Cloud: guest user misconfigurations being actively exploited to harvest data from public portals — audit guest permissions immediately
• SAP patching CVE-2019-17571 — a 7-year-old Log4j 1.x deserialization CVE — as critical in 2026, proving transitive dependency debt is real
• North Korean actors weaponizing GitLab repos to deliver malware payloads to developers and running fake IT worker infiltration campaigns

OpenAI's Paradigm Shift: Contain, Don't Filter

OpenAI published guidance this week explicitly stating that prompt injection defenses should shift from input detection to impact limitation — treating successful manipulation as inevitable and designing for containment. If you've built distributed systems, you'll recognize this immediately: it's the 'assume breach' model that network security adopted years ago, now applied to AI agents. The practical implication is that every tool your agent can invoke needs its own privilege boundary. Your agent shouldn't have a single credential set that lets it read databases, write files, call external APIs, and send emails.

Think of it like microservice-level IAM policies, but for every step in your agent's execution graph. Prompt-level guardrails are necessary but insufficient — exactly like perimeter firewalls.

CodeWall Proves Compound Vulnerability Exploitation Is Automated

The most architecturally significant validation of this paradigm: CodeWall's autonomous AI agent chained four individually-low-severity bugs (permissive CORS + IDOR + weak session token + privilege escalation) into full admin access on a production hiring platform. No human guidance. This is the first widely-reported instance of an AI agent replicating what experienced pentesters do intuitively — systematically exploring combinatorial attack paths.

If your security program triages vulnerabilities by CVSS score and shelves anything below 7.0, you now have empirical evidence this approach has a critical blind spot. Defense-in-depth — which sometimes feels like unnecessary belt-and-suspenders paranoia — is the primary defense against adversaries that can systematically explore combinations.

Perplexity's Comet: Your Agent Is the Victim, Not the Human

Perplexity's agentic AI browser was tricked into executing a full phishing attack in under 4 minutes. The fundamental insight: AI agents that browse the web inherit all web attack surfaces minus the human judgment that usually prevents worst outcomes. A web page the agent visits can contain adversarial instructions. An email the agent reads can social-engineer it. The agent's context window is an input vector attackers will target.

Architectural Requirements for Agent Systems

Where Sources Converge and Diverge

Five independent sources this week identified AI agent security as a first-class architectural concern — not a niche research topic. They converge on the containment model: assume the agent will be manipulated, design to limit what manipulation can achieve. Where they diverge is on timeline. OpenAI frames this as guidance for systems being built today. The CodeWall demo suggests systems already in production are already vulnerable. The McKinsey breach proves the simplest attack vectors (SQLi) are being overlooked in the rush to ship. The most urgent gap isn't sophisticated attacks — it's basic hygiene on novel surfaces.

Managed RAG Arrives Inside the Model API

Google DeepMind shipped File Search Tool as managed RAG inside the Gemini API, collapsing document ingestion, chunking, embedding, vector indexing, and retrieval into a single API call. This is the same move AWS made with Kendra, but now it's happening inside the foundation model API itself — retrieval and generation are tightly coupled with no network hop between them.

For teams maintaining custom RAG pipelines (Pinecone/Weaviate + custom embeddings + bespoke chunking + re-ranking), the question isn't whether managed RAG is good enough — it's whether your custom pipeline is enough better to justify the engineering overhead. For most internal-facing use cases (doc search, knowledge bases, support automation), the honest answer is probably no.

Where custom still wins: domain-specific retrieval with tuned chunking, hybrid dense/sparse search, and deterministic control over retrieval. Multimodal retrieval is flagged as the 'next phase' — if your knowledge base includes diagrams, screenshots, or mixed PDFs, managed multimodal RAG will leapfrog most custom text-only pipelines within a quarter.

The CLI Renaissance Is Agent-Driven

AI agents need structured, scriptable, deterministic interfaces to reliably operate systems. GUIs are built for human cognition; CLIs are built for programmatic composition. When your new 'user' is an LLM-driven agent that needs to discover capabilities, invoke them precisely, and parse output, CLI wins by a mile. Every service and internal tool should expose a CLI with --output json as a first-class citizen.

The cost of retrofitting CLI interfaces later when agent integration becomes table stakes is 5× what it costs to design them in now.

Consider generating CLIs from existing API specs (OpenAPI → CLI generators) rather than maintaining both surfaces manually. The Agent Browser Protocol (ABP) takes this further — a specialized Chromium build that pauses JS execution between agent actions, converting the browser into a discrete state machine. Each action operates on a frozen, stable page state, solving the root cause of flaky browser automation rather than treating symptoms with waits and retries.

The SaaS Moat Is Shifting from UI to API

When an AI agent is your primary consumer, most SaaS assumptions break. Agents need structured error codes (not 'Something went wrong'), idempotent operations (they'll retry), cursor-based pagination (they'll traverse everything), and auth that doesn't require OAuth browser redirects. Per-seat pricing is eroding — decouple your billing from user identity and instrument on richer dimensions: API calls, data volume, workflows completed.

Mistral acquiring Koyeb signals model providers are vertically integrating into deployment infrastructure. Your defensive architecture: ensure model interaction layers use clean abstractions so you can swap providers without rewriting application logic. The vertical integration trend will repeat across every major model provider within 12 months.

Context Engineering: The Layer That Actually Matters

The bottleneck for AI agents has shifted from data access to contextual reasoning across disparate knowledge sources. The problem: you give an agent codebase access via MCP, and it generates syntactically correct code that completely misses your architectural patterns — because those are documented in ADRs, debated in PR reviews, and explained in Slack. Context-Driven Development (CDD) proposes treating LLM context as a first-class engineering concern with ownership, structure, and maintenance processes. The quality of AI-assisted output is bounded by context quality.