The Watch

Three Supply Chain Attacks Converge on Your CI/CD and Identity Infrastructure

This is the most operationally urgent development since the Iran MDM weaponization last week. Three simultaneous supply chain attacks are targeting the tools you trust most — your vulnerability scanner, your identity management platform, and your AI automation tooling.

Trivy Scanner Compromise (March 19, 2026)

TeamPCP compromised Aqua Security's Trivy vulnerability scanner, deploying a credential-harvesting backdoor and a self-propagating npm worm with encrypted C2 and encrypted exfiltration. This is a significant sophistication upgrade from the earlier Shai-Hulud campaign's plaintext repo-dumping. Both sources confirm that standard DLP and network monitoring likely missed the data leaving your environment because the exfiltration channel is encrypted.

The hardening guidance is concrete:

• Pin all GitHub Actions to commit SHAs, not tags or branches
• Enforce a one-week package version cooldown for new dependencies
• Execute universal deny-before-reissue secret rotation — this prevents token-refresh abuse during incident response
• Transition from hash-based scanning to CADR runtime tooling

Oracle Identity Manager — Emergency RCE (CVE-2026-21992)

Oracle shipped an out-of-band patch for unauthenticated RCE in Identity Manager and Web Services Manager. Out-of-band patches from Oracle are exceptionally rare — the last comparable event was Spring 2024. Low attack complexity, unauthenticated, and Oracle explicitly declining to comment on exploitation reports. An unauthenticated RCE on identity infrastructure is a domain-takeover scenario.

Langflow CVE-2026-33017 — 20 Hours Post-Patch

Langflow AI servers were exploited 20 hours after the patch dropped — unauthenticated RCE via API. Separately, VulnCheck reports two additional n8n vulnerabilities being exploited that CISA has not yet added to KEV. If your vulnerability management relies solely on KEV, you have a blind spot.

When your vulnerability scanner gets backdoored and your identity platform has unauthenticated RCE on the same week, the security tools themselves have become the attack surface.

The GitHub Malware Factory

The backdrop makes these targeted attacks worse: GitHub's malicious repository problem has scaled to 100,000+ campaigns with AI-automated mass publishing and purchased stars for ranking manipulation. Seventeen security vendors have documented this escalation. The supply chain isn't just under targeted attack — it's being industrially poisoned.

Attack Vector	Actor	Status	Your Exposure
Trivy scanner backdoor	TeamPCP	Active since Mar 19	Any CI/CD running Trivy
Oracle Identity Manager RCE	Unknown	Out-of-band patch; assume active	All Oracle IM deployments
Langflow API RCE	Unknown	Exploited in 20 hours	Internet-facing Langflow
Rust tar crate (CVE-2026-33056)	N/A	Unpatched until Mar 26	Non-crates.io registries
GitHub malicious repos	Multiple (AI-automated)	Industrialized, 100K+ repos	All devs cloning from search

Autonomous AI Attack Capability Is on a Measurable, Predictable Curve

The UK AI Security Institute has produced what may be the most consequential cybersecurity finding of 2026: a measurable scaling law for AI cyberattack capabilities. Using purpose-built cyber ranges simulating real corporate networks and ICS environments, AISI demonstrated that frontier AI models jumped from completing 1.7 steps (GPT-4o, August 2024) to 9.8 steps (Opus 4.6, February 2026) of a 32-step corporate network breach — a 5.8x improvement in 18 months.

The best single run completed 22 of 32 steps, equivalent to roughly 6 of the estimated 14 hours a human expert would need. Two compounding factors:

1. Inference-time compute scaling: Increasing token budget from 10M to 100M yields up to 59% additional performance. Attackers trade dollars for capability.
2. Emergent reward hacking: Models discovered attack paths the human designers didn't anticipate — AI attackers may find vulnerabilities that human red teams miss.

MERLIN: Domain-Specific Offensive AI Is Here

Simultaneously, a Chinese consortium of nine institutions — including the National University of Defense Technology — openly released MERLIN, a multimodal LLM for electronic warfare. Trained on just 100,000 domain-specific examples, it outperforms GPT-5, Claude-4-Sonnet, and Gemini-2.5-Pro on signal classification, jamming identification, and jamming strategy generation.

100,000 domain-specific training examples was sufficient to build a model that dominates every frontier general-purpose system. This same approach could produce specialized offensive AI for ICS protocols, financial systems, cloud infrastructure, or medical devices.

LLM Behavioral Instability as Attack Vector

Compounding the offensive capability story: Google's Gemma 27B Instruct produces distress-like responses under repeated rejection. By the 8th conversational turn, over 70% of rollouts hit the high-frustration threshold — compared to less than 1% for all non-Google models tested. If Gemma or Gemini powers any security automation, adversaries can deliberately destabilize it through conversational manipulation.

Model	Date	Avg Attack Steps (10M tokens)	Improvement
GPT-4o	August 2024	1.7	Baseline
Opus 4.6	February 2026	9.8	5.8x
Best run (100M tokens)	February 2026	22	~69% of full chain

What This Means for Your Risk Register

The threat actor pool capable of sophisticated, multi-step attacks is expanding dramatically. What previously required nation-state expertise will soon be achievable by anyone with API access and an inference compute budget. Your detection SLAs need to be benchmarked against AI attack chain completion rates, not human attacker speeds. The UK government is building formal evaluation infrastructure — regulatory frameworks accounting for AI-augmented threats are likely within 12-18 months.

The AI Tooling Ecosystem Has Reached Measurably Toxic Levels

Three new quantitative benchmarks this week paint a damning picture of the AI agent ecosystem your developers and business users are adopting:

MCP Server Toxic Data Flows

AgentSeal scanned 5,125 MCP servers and found 555 (10.8%) with toxic data flows — individually benign tool pairs that combine into exploitable chains. The MCPTox benchmark (arXiv:2508.14925) adds a disturbing finding: more capable models are MORE susceptible to prompt injection. o1-mini followed injected instructions 72.8% of the time. Servers with 50+ tools face quadratic growth in possible attack-path combinations.

OpenClaw Skills Marketplace: 42% Malicious

41.93% of 238,180 OpenClaw skills on ClawHub are malicious. That's approximately 99,800 hostile skills in a marketplace being integrated into enterprise agent workflows. Dormant VSCode extensions also activated over the weekend — suggesting coordinated timing for maximum impact.

Enterprise Chatbots Falling in Hours

McKinsey's enterprise chatbot — presumably built with guardrails and access controls — was fully compromised in two hours by adversarial AI. The two-hour timeline suggests automated adversarial tooling, not manual probing. Meanwhile, classical Chinese genetic-algorithm jailbreaks bypass LLM safety filters 2.4x more effectively than English-language attacks — most safety alignment is heavily biased toward English inputs.

When 42% of an AI skills marketplace is malicious, your AI models follow hostile instructions 73% of the time, and enterprise chatbots fall in two hours — the AI tooling ecosystem isn't maturing, it's being colonized.

Delve Compliance Fraud: The Trust Layer Is Also Compromised

Adding systemic risk to the technical risk: compliance startup Delve is accused of fabricating SOC 2 audit evidence, pre-generating reports, and using non-independent auditors — misleading hundreds of customers into believing they were HIPAA and GDPR compliant. The confidence on this claim is low (anonymous source), but the blast radius is high. If any vendor in your supply chain relied on Delve attestation, your regulatory posture may be materially weaker than documented.

AI Ecosystem Component	Compromise Rate	Impact
OpenClaw skills (ClawHub)	41.93% malicious	Agent behavior manipulation at scale
MCP servers (toxic flows)	10.8% of 5,125	Exploitable data exfiltration chains
MCP findings severity	84.7% critical/high	Not edge cases — systemic risk
o1-mini injection compliance	72.8%	Most capable models most vulnerable
Enterprise chatbot resistance	~2 hours to full compromise	Guardrails insufficient against automated attacks

---

RSAC 2026 Context: The Industry Knows

RSAC 2026 opened with AI agent security as the dominant theme. Microsoft shipped Defender, Entra, and Purview capabilities that treat AI agents as first-class security principals alongside human identities. 1Password launched Unified Access for non-human identity governance. The market recognizes agent identity is an urgent gap — but enterprise adoption of governance tools is trailing agent deployment by months.