The Watch

The Finding

The artifact is a 'Co-Authored-by Copilot' trailer that Microsoft's VS Code is writing into git commits from developers who never turned on AI assistance. Publicly: the unauthorized trailer is appearing in production commits. Not publicly confirmed: the affected version range, the total scope, or whether the fix has shipped. The trailer sits under the developer's commit signature either way. Signed commits are now attesting to authorship claims the signer did not make.

This is not a telemetry story. It is a supply-chain integrity story. Any pipeline that trusts commit metadata for provenance — SLSA attestations, SOC 2 SDLC evidence, regulated-code policies, IP ownership determinations — is running on contaminated data for the affected window.

The Broader Pattern: AI Code Is the Majority, and Controls Haven't Caught Up

The VS Code contamination lands next to two related data points. Airbnb disclosed that 60% of new code is now AI-generated. Treat that as the industry floor, not the ceiling. Separately, widely-read tutorials now walk non-developers through standing up full OAuth-connected Gmail clients in a weekend using Codex, with gmail.modify scopes cached in local SQLite on unmanaged hardware.

Research also put a number on the drafting side: LLMs corrupt approximately 25% of document content in long editing workflows. That finding extends to any GRC, legal, or compliance pipeline using AI-assisted drafting.

The signature on the commit covers the metadata the committer did not author. That is a supply-chain question, not a telemetry question.

Cross-Source Analysis

Three independent sources point the same direction: the provenance assumptions that held in 2022 no longer hold. VS Code contaminates metadata silently. AI agents let any employee stand up an unsanctioned OAuth client against corporate SaaS. The share of AI-authored code reaching production has crossed the majority line. Detection engineering should now treat AI-authored commits as the common case, not the exception.

The Numbers — And Why They Diverge

Two independent intelligence sources report that Mozilla's agentic AI pipeline, running on Anthropic's Claude Mythos Preview, surfaced a record volume of Firefox vulnerabilities. The counts do not match:

• Source A: 423 Firefox vulnerabilities over 12 months, against 31 the prior year. Thirteen-fold increase.
• Source B: 271 previously unknown vulnerabilities in a single pipeline run.

The two figures are measuring different things. 423 reads as cumulative annual output. 271 reads as a single batch from one execution. Neither source has confirmed CVE assignments, severity distribution, or disclosure status. Treat both as intake numbers, not shipping-exploit numbers. Historical triage-to-exploitable ratios on fuzzer output sit in the low single digits. At 3 percent, 271 findings yield 8 to 13 exploitable bugs from one browser in one cycle.

Patch SLAs written for a 2022 threat model assume a human-paced discovery curve. That assumption is the part that broke.

What This Means for Your Fleet

Expect a prolonged Firefox advisory tail across the next several release cycles. Rolling CVEs for weeks, weighted toward memory-safety and sandbox-escape classes where agentic fuzzers find signal. The second-order effect matters more: the technique is public and will be pointed at Chromium, WebKit, and every Electron fork in the fleet.

Thursday's briefing covered Mythos against Microsoft products. The Firefox numbers are the first production-scale confirmation of AI-driven discovery applied to consumer-facing software. Frontier models are compressing discovery from months to days. The window between discovery and patch is now the entire story.

VP Vance Warning Adds Political Context

Publicly: VP Vance warned tech CEOs this week that Mythos-class models could enable cyberattacks on banks, hospitals, and water systems. A federal AI oversight regime is under active consideration. Not publicly stated at the podium, but implicit in the threat model: if one model surfaces 271-plus bugs in one browser in one run, legacy patch timelines do not hold.

The Coverage Gap

Berkshire Hathaway and Chubb are excluding AI-related damages from standard commercial cyber and E&O policies. Regulators are approving roughly 80% of these exclusion requests. This is not repricing. It is refusal to underwrite. Projected AI liability runs from $40M in 2024 to $5B by 2032. Absent an affirmative AI rider or a specialty carrier, that loss sits on the enterprise balance sheet.

The carve-outs are specific:

• Model output errors. Hallucinations and incorrect recommendations.
• Training data exposure. Copyright and PII in training sets.
• Unreviewed deployments. Anything without a documented security review.

The carrier reads the exclusion. The sponsor reads the operating agreement. The CISO reads an incident report she was not permitted to write.

The Governance Bypass

In parallel, PE sponsors — TPG, Brookfield, Blackstone, Goldman — are mandating AI adoption top-down into portfolio companies, explicitly routing around IT and security review. The mandate arrives from the board. Implementation lands on ops teams that were never consulted. The pattern is consistent across portfolios: shadow deployments, customer data in prompts, vendor contracts signed without DPAs because procurement was told to move.

The collision is visible. Uninsured AI exposure plus ungoverned AI deployment means the first loss lands entirely on the company. No carrier. No clawback from the sponsor.

The Procurement Shift Compounds It

OpenAI has exited Azure exclusivity and now runs across AWS, Google Cloud, and Oracle simultaneously. Every DPA, data-residency commitment, and sub-processor notification drafted when OpenAI was Azure-only is now stale. The vendor most likely being deployed via PE mandate is the same vendor whose infrastructure just fragmented across four clouds. Sub-processor lists reference a single provider that is no longer the only provider.