The Engineer

Trivy: The Scanner That Scanned You

Aqua Security's Trivy vulnerability scanner — the tool you put in your CI pipeline specifically to improve security — was compromised by a financially-motivated group called TeamPCP. The payload included an encrypted C2 channel and a self-spreading npm worm. This is a step-change from earlier supply chain attacks: encrypted exfiltration means your standard egress log grep for suspicious plaintext payloads won't catch it. Any CI environment that ran the compromised Trivy since March 19 could have propagated malware into the npm ecosystem through your org's publish credentials.

Your vulnerability scanner became an attack vector. If it ran in CI since March 19, every secret accessible to those runners is compromised until proven otherwise.

The incident response protocol matters: use deny-before-reissue for secret rotation, not simple rotation. A basic rotate can still be exploited via token refresh if the attacker cached the old token. Deny first, wait for propagation confirmation, then reissue. Pin all GitHub Actions to commit SHAs (not tags — tags can be repointed), and implement a one-week cooldown on new package versions across all registries.

Cargo CVE-2026-33056: Your Build Environment Is the Blast Radius

A malicious Rust crate can modify permissions on arbitrary filesystem directories when Cargo extracts it during a build. crates.io blocked exploitation on March 13 and confirmed no published crates were affected, but alternative registries remain exposed until Rust 1.94.1 lands March 26. If you run internal mirrors, private registries, or vendor registries — you have a three-day exposure window starting now. Every secret mounted into that build environment is within blast radius.

The Broader Pattern: Trust Is Breaking at Scale

These attacks aren't isolated. This same week: North Korean actors appended malware to hundreds of real npm repos (not fakes — legitimate packages). Dormant VSCode extensions activated maliciously over the weekend. 100K+ malicious GitHub repo clones use fake stars and AI-automated SEO to poison search results. And Langflow's unauthenticated RCE (CVE-2026-33017) was exploited 20 hours after the patch dropped.

If your patch deployment involves 'file a ticket, schedule a maintenance window next Tuesday,' you're operating with a 2015 threat model in a 2026 reality.

The AI tooling surface is particularly exposed: 42% of OpenClaw skills on ClawHub are malicious (out of 238,180 scanned), and 10.8% of 5,125 MCP servers have toxic data flows where individually benign tools combine into exploitable chains. The MCPTox benchmark found o1-mini follows prompt-injected instructions in tool outputs 72.8% of the time, and more capable models are MORE susceptible.

The Human-Agent Handoff Is the Failure Mode

A Meta engineer asked an internal AI agent for help, applied the suggested fix without independent verification, and triggered a Sev 1 data exposure incident that took two hours to contain. Meta's response — 'the engineer should have known better' — is organizational denial. Amazon reports the same pattern: multiple outages linked to AI-assisted code changes. The failure isn't in the AI output; it's in the handoff. When you ship agents to every engineer and train them to trust the tool, blaming the human for trusting the tool is a structural failure, not a training gap.

The fix isn't 'tell engineers to be more careful' — it's designing verification gates that don't depend on human vigilance, because human vigilance degrades proportionally with agent reliability.

McKinsey's chatbot tells the same story from the security side: fully compromised in two hours in an AI-on-AI attack. Any agent with tool access and external input is a security boundary, and most teams aren't treating it as one.

AI-Generated Code Has Different Bug Signatures

A 470-codebase empirical survey from CodeRabbit and Stack Overflow provides the first meaningful signal that AI coding agents produce categorically different bug patterns than humans — not just more or fewer bugs, but different kinds at different severities. Your entire QA pipeline — linting rules, SAST policies, the heuristics reviewers carry in their heads — was calibrated over years of human error patterns. If AI code has a different failure signature, your gates have systematic blind spots you haven't characterized.

Separately, AI-generated SQL is bypassing established database governance. A developer asks Copilot to write a query, pastes it in, ships it. Your DBA never saw it. Your query plan analyzer never profiled it. Your access control layer may not handle the join patterns it uses.

The Non-Human Identity Gap

Multiple sources converge on the same conclusion: AI agents are becoming first-class security principals, and your IAM stack can't model them. Microsoft shipped a unified agent control plane across Defender, Entra, and Purview. RSAC 2026 centered on agent governance. Agents have delegated human authority but non-deterministic behavior; they're long-lived but context-dependent; they need dynamic scoping that changes per task.

Notion's engineering org provides a counterpoint: they've systematically mapped different agents to different task classes. Junior engineers use Claude Code for intuitive prompting; senior engineers prefer Codex for 8-hour autonomous sessions. But those 8-hour sessions introduce a new failure mode: if Codex misinterprets a task at minute 15, you get 7 hours and 45 minutes of compounding wrong decisions. You need intermediate checkpoints, diff-size anomaly detection, and intent verification at intervals — infrastructure nobody is building yet.

The Pricing Gap Has Become a Chasm

The LLM pricing market is splitting into two distinct tiers, and if you're still hardcoded to a single model, you're carrying unnecessary cost and availability risk. The numbers this week make the case starkly:

M2.7 at 14x cheaper input and 21x cheaper output than Opus delivers 90% of quality and excels specifically at bug detection and floating-point calculations, while falling short on thorough fix generation. A single full-time agent at 700M tokens/week costs $840/week on M2.7 vs. $12,250/week on Opus — $594K annual difference per agent.

Replace token consumption metrics with cost-per-completed-task as your primary agent KPI. A model that costs 2x per token but completes tasks in fewer turns can be cheaper overall.

Cursor's Self-Summarization Is the Architecture Pattern to Study

Cursor's Composer 2 introduced compaction-in-the-loop RL: the model is trained to recognize token-length triggers during multi-step execution and compress its own action history from 5K+ to ~1K tokens mid-run. Result: 50% fewer compaction errors and materially better long-horizon task completion. This isn't a bolt-on summarization call; it's a learned behavior. You can approximate it without custom training by inserting structured summarization prompts at context checkpoints in your orchestration layer.

Agentic RAG: Fix Your Chunking First

ByteByteGo's analysis confirms what many teams learn the hard way: agentic RAG loops cost 3-10x more and add 5-10x latency (10s+ vs 1-2s). At 10K queries/day, standard RAG costs ~$600/month; agentic pushes to $6,000/month. At 100K queries/day, you're at $60K/month. The evaluator paradox is the deeper problem: when your LLM judges retrieval quality, it has the same blind spots as the generator. Layer evaluation with hard signals — vector similarity thresholds, chunk freshness, source authority scores — and add circuit breakers (max 3 retries, return best-so-far).

The pragmatic path: start with a query router (classify and route to vector store, SQL, or web search). Only reach for full ReAct loops when you have concrete evidence simpler approaches can't handle your query complexity distribution.

Self-Hosted Options Are Getting Real

Mistral Small 4 ships as a 119B-parameter MoE with 128 expert modules activating only 4 per request, under Apache 2.0. Flash-MoE runs Qwen3.5-397B from SSD on a MacBook Pro with 48GB RAM at 4.4 tok/s via custom Metal shaders — no Python, no frameworks. For air-gapped environments, compliance-sensitive workloads, or cost avoidance, the local inference frontier has meaningfully advanced.