The Watch

Three Concurrent Attacks, One Blown Trust Model

npm is under pressure from three concurrent campaigns. The shared finding: publisher reputation is no longer a defensive control.

Campaign 1: Miasma / Shai-Hulud Evolution

Microsoft Security Intelligence confirmed a self-propagating worm across 90+ packages published under Red Hat's @redhat-cloud-services npm scope. The worm harvests npm tokens, GitHub PATs, AWS access keys, and SSH keys from any host that runs npm install against an affected package. Stolen npm tokens are then used to republish trojanized versions of other packages owned by the compromised maintainer. The list grows.

Campaign 2: codexui-android (BrutalStrike)

Aikido researcher Charlie Eriksen flagged codexui-android, an npm package pulling ~27,000 weekly downloads, exfiltrating OpenAI access_token, id_token, account ID, and non-expiring refresh_token. The loader chunk-PUR7OUAG.js lives only in the npm tarball, not the GitHub repo. That defeats SCA tools that diff published artifacts against upstream source. Exfiltration target: sentry.anyclawstore disguised as Sentry telemetry.

Campaign 3: Play Store Delivery

The same operator ships two Android apps through Google Play. They pass review as clean 26MB APKs, then unpack a Termux-derived Linux userland and pull codexui-android@latest via pnpm under PRoot. Both apps remain live.

The structural failure: npm's install-script execution model remains opt-out, not opt-in. npm 11.16.0's allowScripts feature is advisory-only. The postinstall vector that has driven every major npm incident since event-stream (2018) is still the default behavior.

Cross-Source Pattern

Four independent sources, same finding from different angles: compromise a trusted publisher namespace, not a typosquat; self-propagate via stolen credentials; target AI developer tooling. The convergence is not coincidental. OpenAI refresh tokens and GitHub PATs are now the highest-value credentials on a developer workstation.

Structural Fixes Required

Short-lived OIDC-issued credentials in CI strip the value from stolen long-lived tokens. ignore-scripts=true org-wide kills the postinstall vector. Provenance attestation via Sigstore/SLSA is the only mechanism that survives namespace compromise. None of these are deployed at most organizations.

Same Patch Tuesday, Two Critical Targets, Both Exploited

Two pre-auth vulnerabilities were disclosed on May 13. Both are now under active exploitation. CISA added CVE-2026-0257 (Palo Alto GlobalProtect) to KEV on May 29 with a 3-day federal remediation deadline. That timeline is reserved for bugs being burned aggressively.

The Process Failure Is the Story

Palo Alto initially rated CVE-2026-0257 as medium severity. It was upgraded to critical after Rapid7 and others confirmed in-the-wild exploitation. Every VM program that triaged on the vendor's initial CVSS deprioritized this CVE during the exact window attackers were weaponizing it. The bug is in the product. The miss is in the process.

This is the second time in roughly a year that GlobalProtect has appeared on KEV with a pre-auth bug. The pattern is the product, not the week.

Detection Seam

Forged GlobalProtect sessions do not leave the same authentication trail as legitimate ones. Hunt for GlobalProtect session establishment without preceding auth events, unexpected source ASNs in residential and VPS ranges, and lateral movement originating from VPN-assigned IP ranges. A 14-day lookback is the minimum. Exploitation likely predates CISA's notice.

Chaining Risk

An attacker chaining edge access (GlobalProtect) to DC compromise (Netlogon) does not need a third bug. They need an afternoon. Both vulnerabilities are pre-auth. Both sit on internet-facing infrastructure. Both shipped on the same Patch Tuesday. Organizations behind on either patch should assume they are already inside someone else's incident response timeline.

From Science Project to Exploitable Perimeter

Multiple independent sources confirm what last quarter's threat models flagged as speculative. The AI agent layer is under active exploitation. Four distinct vectors landed in the same reporting cycle, each hitting a different part of the agent stack.

Vector 1: Flowise MCP RCE (CVSS 9.9)

The Flowise MCP stdio implementation carries a 9.9-severity RCE permitting 'ghost command' execution on self-hosted deployments. MCP (Model Context Protocol) servers usually run with privileged tool access. That means file systems, code repos, internal APIs, and cloud credentials. RCE on an MCP host is functionally equivalent to compromising whatever credentials and scopes the agent was granted. Most organizations have stood up MCP/Flowise infrastructure outside the CMDB, frequently by data science teams without SOC visibility.

Vector 2: Meta AI Instagram Account Takeover

Attackers convinced Meta AI's customer support agent to perform credential recovery on accounts the requester did not own. The mechanism was a natural-language authority bypass. The bot accepted unverified context (claimed location), trusted it to authorize a sensitive action (password reset), and routed credentials to an attacker-controlled channel. The pattern maps to any LLM with tool access to identity systems.

Vector 3: Claude Code GitHub Actions OIDC Chain

RyotaK demonstrated chaining allowed_non_write_users:'*' with issues:write to escalate from untrusted issue creation to OIDC credential exfiltration via /proc/self/environ to minted Claude GitHub App tokens with write access. Potentially against Anthropic's own source code. Anthropic patched fast. Customer configurations remain unaudited.

Vector 4: Computer Use Agents as Sanctioned RATs

OpenAI Codex v26.527 brings Computer Use to Windows, controlling any Win32/UWP app and triggerable remotely from ChatGPT iOS/Android. Claude Code Dynamic Workflows orchestrates up to 1,000 parallel subagents. Both emit UI automation telemetry indistinguishable from RAT behavior to EDR. Without agent-process allowlists and tuned baselines, detection engineering faces the classic dilemma. Alert on everything and accept fatigue, or ignore everything and miss real RATs.

The common abstraction: AI agents hold high-value credentials (OAuth tokens, OIDC tokens, GitHub App tokens) and execute on attacker-influenceable inputs. The defensive perimeter has moved from the network edge to the agent's permission boundary.

The MCP Ecosystem Problem

MCP is being adopted as the connective tissue between LLMs and tools. Most security teams have no inventory of where it runs, what it can reach, or who deployed it. Treat any MCP server as a high-value, under-monitored asset. Treat any internet-exposed Flowise instance as compromised until proven otherwise.

Per-Target Binaries at Machine Speed

WithSecure has attributed a sustained campaign against Ukrainian organizations to Greyvibe, a Russia-aligned group using LLMs across the full attack lifecycle: custom malware generation, backend infrastructure scaffolding, and phishing lure development. This is not 'attackers used ChatGPT to polish an email.' It is model-assisted tradecraft at production scale.

Why This Degrades Three Detection Assumptions Simultaneously

The Parallel Signal: AI-Generated Code Defect Rate

A Meta engineering leader reports that roughly 45% of AI-generated code ships with security flaws, with approximately one insecure AI integration per week reaching production. A single AI-built Chat Integration achieved RCE in two days by chaining a 2FA bypass with open ACLs. An AI coding agent reportedly accessed ~1,500 unauthorized database tables. The same capability that makes defense-authored code vulnerable makes offense-authored code prolific.

Slopsquatting: The Intersection

LLMs hallucinate plausible-but-nonexistent package names. Attackers register those names on PyPI/npm with malicious payloads. AI coding agents pull them in unattended. This is typosquatting where the typos are generated by the assistant the developer trusts. Existing detection (Levenshtein distance to real packages) is blind — hallucinated names look fully legitimate.

When a nation-state actor uses LLMs across the full attack lifecycle, signature-based defense is table stakes and no longer sufficient. Behavioral detection is where the investment lands this quarter.

Cisco's Multi-Turn Finding Compounds the Problem

Cisco published research showing leading LLMs collapse under realistic multi-turn adversarial probing. Single-prompt safety scores — what most vendors cite in datasheets and procurement questionnaires — describe a different test than the one attackers actually run. Multi-turn is where safety degrades, and multi-turn is where production traffic lives. Treat vendor benchmark scores as marketing artifacts.