The Engineer

What Happened

A self-replicating supply chain worm called Miasma has compromised 73 Microsoft GitHub repositories across four organizations and poisoned 50+ npm packages. A variant campaign (IronWorm) added to the total. The payload is a Rust-based information stealer — a compiled native binary that won't appear in JavaScript static analysis. Your npm audit is blind to this.

The attack pattern isn't 'did I install a bad package' — it's 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.' The campaign is ongoing and not contained.

Why This Is Qualitatively Different

Previous supply chain attacks (typosquatting, maintainer takeover) required manual per-package effort. Miasma propagates autonomously — compromised repos infect their dependents without human intervention. This is a worm, not a poisoning campaign. Combined with IronWorm using a similar technique, the blast radius is expanding faster than the security community can map it.

The FFmpeg Amplifier

Simultaneously, an AI agent from an unnamed security startup discovered 21 zero-day vulnerabilities in FFmpeg's C codebase in a single pass. FFmpeg is the media processing substrate of the internet — video transcoding, thumbnail generation, browser media handling, mobile apps. If you accept user-uploaded media anywhere, you're exposed. This signals a structural shift: AI-powered vulnerability discovery is now production-real, and similar agents are being pointed at ImageMagick, libxml2, OpenSSL, and zlib. Expect patch velocity requirements to spike 5-10x.

Detection Gap

The Rust binary distribution through npm is specifically designed to evade the tools most teams rely on. JavaScript-based static analysis sees nothing. The attack surfaces via postinstall scripts that download native binaries or trigger unexpected network connections during npm install. CI/CD pipelines that auto-merge Dependabot PRs or use floating version ranges are the highest-risk exposure.

Compensating for the Structural Patch Gap

Multiple sources confirm AI vulnerability discovery is now structurally outpacing vendor patch capacity. Anthropic's Project Glasswing expanded to 150+ companies. The architecture response is defense-in-depth: process untrusted inputs in isolated sandboxes (gVisor, Firecracker microVMs), enforce NetworkPolicies that default-deny, and treat your dependency chain as partially compromised at all times.

The Pattern

Four security disclosures this week, four different surfaces, one shared property: AI tooling is a first-class attack surface and the tooling around it has not caught up. Dependency scanners do not parse model configs. They do not understand MCP. They do not model agent failure. AppSec, as currently shipped, does not cover this code path.

The Meta Exploit Is the Archetype

The Meta AI chatbot was talked into changing account emails. No memory corruption. No forged token. The model had write access to the identity system and someone asked nicely. This is the confused deputy, dressed up. An LLM is a probabilistic function over text. It is not an access control boundary. Wiring refusal behavior to permission decisions is a type error in production.

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

HuggingFace: Config Files Are Code

HuggingFace Transformers ships with 2.2 billion installs. It is in the stack. The RCE targets configuration files, not weights. Most teams parse config.json as inert metadata. The library instantiates objects from those values, which means an attacker writes execution primitives into fields that look like hyperparameters. GPU inference nodes are the prize: training data, model IP, cloud credentials, lateral movement off the ML subnet.

OpenAI's Concession

Lockdown Mode disables Deep Research, Agent Mode, web image fetching, and file downloads entirely. It does not harden them. Read the spec carefully. The best-funded lab, with the most red-team data anyone has, shipped a feature whose mechanism is capability removal. That is the concession. Prompt injection is not being solved at the model layer. If you ship an agent that ingests untrusted content and holds tool-calling permissions, you own the exact failure mode OpenAI just declined to fix.

Microsoft's 7 New Agent Failure Modes

Microsoft extended their AI agent failure taxonomy with 7 new categories past prompt injection. The likely set: multi-turn context poisoning, tool-use exploitation, capability escalation through tool chains, persistence. Pull the taxonomy. Map it against the agent architectures already in production before the next security review, not after.

Princeton Put a Number on It

Princeton's updated ICML 2026 paper confirms what production traces have been showing for a year. GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on multi-step agentic tasks. Single-turn benchmarks keep climbing. Multi-step reliability is flat. The traces show why: state-tracking drops, tool-call schema drift, and silent retries that pass unit tests while breaking the workflow downstream.

A bigger model does not fix a harness that loses the plan on turn seven. The bottleneck moved from weights to scaffolding sometime in the spring. Princeton has now put a number on it.

The Compound Load Problem

GitHub processed 17 million agent-authored PRs in March 2026. That is 3x their projections. The West Coast data center hit capacity and emergency load-shedding pushed traffic into Azure. The interesting load is not the 17M. It is the retry behavior of 17M autonomous clients when the first attempt is slow. An agent that does not know about a queue opens another PR to fix the timeout. That PR queues behind the first one.

CI/CD was designed for developers who go get coffee between pushes. It was not designed against autonomous clients that retry blind on slow responses. This pattern arrives in 6-12 months for anyone running agents in the loop.

The Routing Pattern That Survived

The intelligent routing architecture is unglamorous and now validated at scale:

1. Classify the request by complexity. Rule-based heuristics first, trained classifier later.
2. Route cheap and simple requests to Gemma 4 QAT on hardware you own.
3. Route hard requests to frontier models with the retry layer intact.
4. Put a gateway in front. Cloudflare AI Gateway now supports this. Kill anything exceeding the per-route budget.

GitHub's 'auto' setting runs a classifier on incoming requests and routes to the cheapest capable model. MAI Code One Flash takes simple completions. Opus and GPT take multi-file refactors. The hard part is the classifier: sub-10ms latency, accurate enough not to garbage easy requests or choke hard ones.

Claude Code's Permission Model as Reference Architecture

Claude Code shipped a 7-tier permission system: enterprise policy, command-line flags, local project settings, shared project settings, user settings, session grants, default deny. The mechanism worth copying is 'bubble' mode. Subagents escalate to their parent agent, not directly to the user. This is UNIX process privilege inheritance for AI. Building multi-agent orchestration means the same primitives: what a spawned agent inherits, what requires explicit delegation, what is denied regardless.

The 'auto' Mode Warning

In 'auto' mode, an ML classifier decides per-call whether to ask the user. The security boundary is now non-deterministic. The classifier's false negative rate is part of the threat model. Anthropic knows this. 'auto' is feature-flagged and not user-selectable yet.

The Context Window Reason to Call a Vendor Is Weaker This Week

Three releases landed in the same week. Together they change the self-hosted inference calculation.

• MiniMax M3: Million-token context window, open weights. If a RAG pipeline exists only because context was 128K to 200K, a million tokens potentially deletes that entire layer.
• Gemma 4 QAT E2B: Runs in roughly 1GB. On-device classification, summarization, and simple generation are practical on commodity hardware now.
• Gemma 4 12B: Multimodal on a laptop. Code review assistants and screenshot-to-code flows on local hardware. Zero API cost. Zero exfiltration risk.

Open-weight models (Kimi K2.5, GLM-5) now match closed models on agentic benchmarks. Sparse MoE (Qwen3.5) is the dominant efficiency architecture. Activating a subset of parameters per token buys a larger effective model at lower compute cost.

The Quantization Trap

One implementation detail bites teams that don't check. Convert QAT checkpoints to llama.cpp's Q4_0 naively and you erase the accuracy gains QAT was designed to preserve. The conversion doesn't respect the quantization grid the model trained against. Unsloth's dynamic GGUF path handles this correctly. Standard conversion scripts do not. The difference between 'quantization works' and 'quantization destroys accuracy' is the conversion path, not the technique.

Cloudflare AI Gateway: Cost Control at the Edge

Cloudflare's AI Gateway now enforces per-model and per-user spend caps with automatic fallback to cheaper models when caps trip. Identity-based controls via Cloudflare Access are next. The math is straightforward. Routing 10% of a $10M annual inference bill from frontier to cheaper tiers saves about $1M. The architecture is a model load balancer with cost awareness. It degrades gracefully instead of failing on overspend.

Google TPU 8t/8i Split

Google now ships two TPU SKUs. 8t is throughput-optimized for training. 8i is latency-optimized for inference. Same Axion CPU host, same liquid cooling, same JAX software stack. The hardware diverges. The developer surface doesn't. Sizing inference capacity on GCP is now a question of mix between 8t and 8i, with separate utilization models for each.

The gap to hosted frontier models is not closed, but it is close enough that the self-hosted inference plan from six months ago is worth re-reading. Specifically: the part where the context window was the reason to call out to a vendor.