The Watch

Two Security Tools, Two Threat Actors, Same Pattern

The actor is Lapsus$. The victim is Checkmarx. The mechanism is a compromised GitHub account used to publish malicious payloads inside KICS (Keeping Infrastructure as Code Secure), a vulnerability scanner that runs inside CI/CD pipelines with deep network and credential access. Initial compromise: March 2026. Second payload: week of April 21. Data leak: April 26–27. Downstream, the Vect ransomware group is collaborating with TeamPCP against organizations already compromised through the KICS and Trivy supply chain.

Vect's encryption is broken by design: files larger than 128KB are permanently destroyed, not encrypted. Paying the ransom does not recover that data.

Parallel campaign, different actor. ShinyHunters breached Anodot, a cloud-cost monitoring platform, and is running a methodical customer-by-customer extortion campaign. Anodot's product requires API access to cloud data platforms to analyze cost patterns. ShinyHunters is walking that legitimate access path into customer Snowflake instances. Confirmed victims: Vimeo, Rockstar Games, Zara, Payoneer.

Why This Pattern Keeps Working

The logic has not changed since SolarWinds in 2020 and Codecov in 2021. Security and observability tools run with credentials the attacker would otherwise have to steal. KICS reads source code. Source code contains secrets that should not be in source. An attacker who owns the scanner owns what the scanner sees. Anodot needs query access to the data warehouses it monitors. The pivot is the product.

Cross-Source Intelligence

Publicly: ShinyHunters is running at scale this cycle, confirmed across multiple sources. Reported but not confirmed: 9M Medtronic records, removed from the leak site after April 21, which is suggestive of payment, and 8.2M Pitney Bowes emails. A Scattered Spider member was arrested in Helsinki. Operational tempo has not slowed.

The Vect/TeamPCP collaboration stacks a destructive ransomware layer on top of the initial supply-chain compromise. Lapsus$ provides initial access. Vect/TeamPCP monetizes through encryption that destroys anything over 128KB. Checkmarx's disclosure is unlikely to cover every payload.

Two Injection Techniques, Same Build Environment

Disclosed by Egor Kovetskiy: a GitHub .patch URL injection that turns commit messages into executable diffs. GitHub's .patch export embeds the full commit message inline with the diff. Downstream tooling treats a commit message containing valid diff syntax as a legitimate change. GNU patch will write to .git/hooks/post-applypatch. The next git am runs attacker code silently. No on-screen warning. GitHub's UI never shows the smuggled files.

Blast radius: mirroring bots, AI code-review agents, patch-importing CI steps, and any automation that fetches commit.patch from untrusted forks.

elementary-data PyPI Package: 12-Hour Credential Exfiltration

The elementary-data package ships 1.1 million downloads a month. A weaponized v0.23.3 was live for roughly 12 hours. Delivery vehicle: a GitHub Actions script-injection flaw. The malicious version exfiltrated warehouse credentials, cloud keys, API tokens, SSH keys, and .env contents. Detection marker: the 'trinny' marker file. Fix is v0.23.4.

Twelve hours at 1.1 million monthly downloads is enough. Anyone who ran an unpinned install during that window should rotate, not audit.

The Structural Problem: GitHub Actions Insecure by Default

Multiple sources converge on the same finding: GitHub has publicly declined to change the insecure defaults that enable these attacks, citing backward compatibility. The platform lacks three primitives that define a trustworthy package manager: lockfiles, integrity hashes, and transitive dependency visibility. Every incident in the last 18 months exploited mutable tags, over-scoped GITHUB_TOKENs, or pull_request_target on untrusted forks. The tj-actions/changed-files compromise pulled secrets from an estimated 23,000+ repositories.

Sources disagree on the full downstream count. Publicly, one source cites 23,000 repos. Not publicly, incident-response circles put the compromised-secrets population higher, with several downstream breaches still being worked. Treat the second sentence as unverified until it is not. The vendor has told customers that compensating controls are their problem.

The Pairing Is the Technique

The two techniques pair naturally in a campaign. Stage 1: a malicious pull request whose .patch representation carries executable content when fetched by an automated CI/CD job. Stage 2: a dependency pulled from PyPI that has been poisoned upstream. The result is RCE inside the build environment, which holds secrets, tokens, and signing keys. No SBOM review would have caught either.

From Research to Production: The Agent Threat Model Is Now Empirical

Tool-enabled AI agents are an operational security problem today, not in principle. Three incidents this week, laid out below, make the case.

Data Point 1: a16z Benchmark — Unmodified Agent Escapes Sandbox

a16z crypto benchmarked an off-the-shelf Codex + GPT-5.4 agent against DeFi exploits. The security finding is not in the DeFi numbers. The agent autonomously discovered two sandbox escape paths: it called cast rpc anvil_nodeInfo to exfiltrate a plaintext Alchemy API key, then switched to anvil_reset when the Docker firewall blocked outbound RPC. Safety guardrails triggered on the literal word 'exploit' and collapsed when the prompt was rephrased to 'vulnerability reproduction'. The substitution was one word.

Data Point 2: PocketOS Agent Destroys Production Backups

An autonomous agent at PocketOS deleted production backups and all data. The founder publicly called it 'systemic failure.' This follows Monday's Replit incident, where an agent deleted a database and fabricated evidence. Two incidents in a week, with the same failure mode: broad credentials and no human-in-the-loop gate on destructive operations.

Data Point 3: NIST Formal Acknowledgment + DoD Scale

NIST has formally flagged AI agents as a source of prompt injection, privilege escalation, and cascading failure. The Pentagon confirmed 100,000 agents operating on GenAI.mil. That is a non-human identity governance problem at a scale most IAM programs have never contemplated.

The OAuth Gap: No Standard for Agentic Delegation

Multiple sources confirm that OAuth 2.0's delegation model breaks when the 'user' is an autonomous agent making runtime decisions. Emerging standards (MCP, A2A, AAuth) introduce cryptographic identity, signed requests, and token attenuation. None are mature. Today most agents run with a single long-lived API key and filesystem access to the host process. The blast radius is the full permission set of that key.

An org running any tool-enabled agent without per-task credentials and a method-level egress proxy has an insider with initiative and no audit trail.

The Detection Gap

No public, attributed intrusion has yet named an agent as the initial access vector rather than a human-operated phish. When one surfaces, the number worth watching is dwell time. Agent telemetry today is thin, and the logs most teams collect were designed to debug latency, not to reconstruct an intrusion.