The Watch

The Architecture That Changed This Week

OpenAI's Codex coding agent now integrates into VS Code, JetBrains, and Xcode, with 5x usage growth in early 2026. Michael Bolin, the open-source Codex lead, detailed an architecture that security teams must internalize: Codex gives agents direct terminal control — not discrete file-read APIs, but a shell. Within the sandbox, the agent executes arbitrary commands, reads environment variables, inspects processes, and accesses any permitted file.

Codex doesn't use discrete file-read tools — it gives the agent a shell. Fork the open-source harness with a non-OpenAI model, and the sandbox remains but every safety guardrail on what the agent decides to do vanishes.

Sandbox Maturity Varies Dramatically by Platform

Your Windows developer fleet runs the least-tested sandbox in the stack. If you must prioritize, that's your highest-risk platform.

Three Compounding Vectors

1. agents.md: The New Poisoned .bashrc

The agents.md convention — a repo-root file containing instructions for AI agents — is now standard practice. Developers are instructing agents to self-update these files after tasks. A malicious PR that subtly modifies agents.md alters agent behavior for every developer on the project. This is prompt injection via version control, and it persists across sessions.

2. GitHub OAuth Scope Creep

Codex now has GitHub integration with access to issues, PRs, and PR conversations. Combined with org-wide OAuth tokens (vs. repository-scoped GitHub Apps), a compromised or manipulated agent session can harvest sensitive context routinely exposed in repo discussions — including security vulnerability details, infrastructure configs, and credential references.

3. Multi-Agent Pipelines Are Already in Production

Practitioners report running 5-7 agents in production CI/CD workflows: code review, testing, security scanning, performance analysis, PR merging, and regression checks. These agents are making security-critical decisions autonomously — approving code, validating scans, merging pull requests. Yet they aren't governed as privileged service accounts. No least-privilege scoping, no credential rotation, no audit logging to your SIEM.

OpenAI's roadmap makes this worse: multi-agent and sub-agent architectures where the harness becomes a network of agents across machines, with context connectors to email, documents, and web browsers. From a MITRE ATT&CK perspective, this maps to expansion across lateral movement (TA0008), collection (TA0009), persistence (TA0003), and execution (TA0002).

The NanoClaw Wild Card

NanoClaw — a 6-week-old framework with 22K GitHub stars — positions itself as a "secure alternative" to OpenClaw and just integrated Docker Sandbox for execution isolation. It was born from a 48-hour coding sprint by a solo developer. Your engineering teams may already be running it. AI agent frameworks execute arbitrary code by design — treat them with CI/CD-level security rigor.

Three Risk Events, One Vendor, One Quarter

Meta is executing three simultaneous moves that compound into significant vendor risk for any organization in their ecosystem — and you are almost certainly in their ecosystem, whether through advertising, identity, APIs, Instagram business communications, or Workplace.

1. Instagram DM Encryption Dies May 8

Meta confirmed that end-to-end encryption for Instagram DMs will be removed on May 8, 2026, citing low opt-in rates. A Meta spokesperson directed users to WhatsApp for encrypted messaging. This means:

• All Instagram DM content becomes accessible to Meta's infrastructure — and to legal process, government data requests, or infrastructure compromise
• Man-in-the-middle interception risk increases for messages in transit
• Any employee using Instagram DMs as a shadow communication channel for business loses their privacy layer

The most exposed roles are executives, PR, marketing, and customer-facing teams who routinely use Instagram DMs for business discussions they wouldn't put in email.

2. 20%+ Workforce Cut Creates Dual Risk

Meta plans to cut ~15,800 employees (20%+) while investing $600B in AI infrastructure through 2028. The security implications are twofold:

• Direct insider threat: Thousands of employees with production access, proprietary data knowledge, and potential grievances departing in compressed timelines. Rushed offboarding historically produces orphaned credentials.
• Third-party risk degradation: Meta's internal security team is losing headcount. Expect slower incident response, delayed patches, and reduced security operations capacity for the next 6-12 months.

3. Litigation Exposes Security Decision-Making

Internal Meta documents from the New Mexico child safety trial reveal executive debates about encryption trade-offs. This sets a precedent: your vendor's internal security architecture discussions are discoverable. More importantly for your organization, it means your own informal security trade-off discussions — in Slack, email, or meeting notes — could face the same exposure.

If Meta is in your vendor ecosystem — and it almost certainly is — these three signals compound: your communications lose encryption, your vendor's security team shrinks, and their internal security decisions are being litigated in open court.

Parallel Signal: Meta Licensing Google's Gemini

Meta delayed its next-gen AI model "Avocado" after it failed to beat competitors, and leaders are now contemplating licensing Google's Gemini to power Meta AI products. If your organization uses Meta AI features in Workplace, WhatsApp Business, or Instagram integrations, the underlying model — and therefore the data processing pipeline — could shift to Google infrastructure without explicit customer notification.

Two Capability Leaps, Zero Detection Coverage

Two developments converged this week that create data exfiltration channels your current security stack has no visibility into. Neither involves a vulnerability. Both involve legitimate features working exactly as designed.

Chrome v146: MCP Goes Native in the Browser

Chrome v146 now includes native Model Context Protocol (MCP) support, demonstrated with a LangChain agent that continuously browses and compiles information. MCP is Anthropic's protocol for connecting AI agents to tools and data sources. Embedding it in Chrome means agents can act through the browser — and potentially inherit whatever authenticated sessions the user has open.

Consider what your employees access via Chrome: SSO-protected internal apps, cloud consoles, HR systems, financial tools. An MCP-enabled agent operating in that browser context could access any web application the user is authenticated to. Your CASB sees a Chrome session. Your WAF sees legitimate requests from a known IP. Your DLP sees nothing, because the data flows through a protocol your rules don't recognize.

Chrome auto-updates. By the time you read this, your managed endpoints may already be running v146 with native MCP support. Your CASB, WAF, and DLP have no rules for this protocol.

1M-Token Context: Mass Exfiltration in a Single API Call

All three major LLM providers — Anthropic, OpenAI, and Google — now offer 1M-token context windows in GA. Anthropic removed the API surcharge and beta header requirement. One million tokens is approximately 750,000 words — the equivalent of an entire codebase, policy manual, or customer database in a single API request.

Your DLP rules were calibrated for the era of 4K-128K context windows. A single API call carrying 1M tokens to api.anthropic.com is now normal developer behavior. How do you distinguish legitimate large-context usage from data exfiltration? The answer, for most organizations, is: you can't.

The Compounding Effect

These two developments interact dangerously. An MCP-enabled agent in Chrome can browse authenticated internal applications and pipe that content into a 1M-token API call. The entire workflow looks like legitimate developer activity. The data traverses protocols your network monitoring doesn't parse, in volumes your DLP thresholds don't flag, to endpoints your block lists don't include because they're production LLM APIs your developers need.

This isn't a theoretical attack chain — it's the normal workflow for any developer or analyst using MCP-connected AI tools with large context windows. The malicious version is indistinguishable from the legitimate one.