The Watch

Situation

Two unrelated critical events, both live, both competing for the same analyst hours. Cisco disclosed active exploitation of CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager. No patch. In parallel, a self-replicating supply-chain worm called Miasma has compromised 73 GitHub repositories across four of Microsoft's own organizations. IronWorm has poisoned 50+ npm packages with a Rust-based information stealer.

Why This Is Different

The Cisco bug is a management-plane flaw on an internet-adjacent surface. Successful exploitation hands the attacker every branch and site managed by the compromised instance. There is no patch and no fix timeline. Compensating controls are the entire defense.

Miasma is the escalation we flagged as plausible after the npm incidents earlier this year. Self-replicating worm logic in package ecosystems means every CI run that pulls a contaminated package becomes a new propagation node. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets. That is the exact key ring needed to push poisoned versions further downstream. Microsoft's own repos were hit, which settles the question of whether platform owners are isolated from registry-level contagion. They are not.

Manual package poisoning has a linear blast radius. A worm has a compounding one. Every install becomes a new propagation node.

Compensating Controls for Cisco (Today)

1. Restrict SD-WAN Manager admin and API interfaces to jump-host-only access via ACL.
2. Enable enhanced audit logging. Deploy hunt queries for anomalous administrator session creation and configuration push events.
3. Subscribe to Cisco PSIRT for patch notification.
4. If possible, remove the management interface from direct internet exposure entirely.

Supply Chain Triage (This Week)

1. Diff your SBOM against the published Miasma and IronWorm IOC lists.
2. For any npm package installed or updated in the last 14 days from the affected set: rotate npm publish tokens, GitHub PATs, CI runner cloud credentials, and any secrets exposed to those builds.
3. Enforce npm ci with locked versions. Enable provenance verification.
4. Quarantine suspect packages at the proxy registry layer.

Separately, SolarWinds Serv-U was added to CISA KEV under active exploitation. Patch immediately if in environment. BOD 22-01 timelines apply for FCEB and contractors.

The Proof of Concept

The target: high-profile Instagram accounts. The vector: Meta's AI chatbot, socially engineered into changing the email address on those accounts. The mechanism: a credential-reset path fronted by an LLM, which treated the exchange as a support conversation rather than an identity-proofing one. No account was breached. The chatbot performed the takeover on the attacker's behalf.

This is not a theoretical risk category anymore. It is prompt-as-privilege-escalation, observed in the wild against a named platform.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

Why This Generalizes

The pattern — convince the AI to perform a privileged identity action that a human agent would have flagged — applies to any LLM wired to tools that mutate state. In MITRE ATLAS terms: LLM Prompt Injection → Privilege Escalation via Tool Use. In ATT&CK terms: Account Manipulation (T1098) and Account Access Removal (T1531), executed through a non-human intermediary.

The Meta incident is not isolated. Claude Code's MCP integration layer has documented weaknesses: MCP servers run with over-privileged access to filesystem, shell, and cloud credentials. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch. OpenAI shipping Lockdown Mode — which works by disabling capabilities rather than hardening them — is the vendor admitting the prompt-injection attack class has no clean technical fix.

Defensive Response

The fix is architectural. Any flow where an LLM can change email, phone, MFA factor, password, or recovery method requires out-of-band verification or a human reviewer. Treat the AI as an unauthenticated requester regardless of session context.

For Claude Code specifically: MCP servers must be allowlisted, signed, and scoped to least privilege. Default-allow posture for MCP is over. The bypassPermissions and dontAsk modes that suppress interactive approval must be blocked on any endpoint holding production credentials.

Four Trust Signals Degrading Simultaneously

Four pieces of defender infrastructure are weakening in the same cycle: vulnerability data, vendor transparency, AI platform isolation, and patch intelligence.

1. OpenAI Lockdown Mode: Amputation, Not a Cure

OpenAI shipped ChatGPT Lockdown Mode globally. The mechanism is disabling capabilities: Deep Research, Agent Mode, internet image fetch, and file downloads are off. Read it as an admission that prompt injection has no clean technical fix. Coverage extends to all personal accounts, free tier included. Enterprise and Team tenants are not explicitly covered in the rollout. DLP and tenant policy stay load-bearing.

2. Anthropic Suspected Cross-Tenant Exposure

Anthropic is the subject of a suspected cross-tenant output exposure consistent with a multi-tenant isolation failure during a scaling event. This is unconfirmed. No CVE, no advisory, no named victim. If it validates, prompt data, RAG context, and tool outputs sent to shared Claude inference may have crossed boundaries. That would put every major AI platform vendor at one or more credible cross-tenant or prompt-injection incidents in the last twelve months.

3. NIST NVD Backlog: Strategic-Planning Failure

The Commerce Inspector General is direct: "NIST's lack of strategic planning and decisive action have allowed the backlog of unprocessed vulnerabilities to continue growing." Scanners that depend on NVD for CVSS, CPE matching, or CWE classification will exhibit silent coverage gaps on recent CVEs. Compensating feeds: CISA KEV for exploitation-driven prioritization, EPSS for probabilistic scoring, GitHub Security Advisories for OSS.

4. IBM Breach Cover-Up Allegations

A former IBM cyber executive, now whistleblower, alleges IBM covered up several data breaches and declined to notify customers. If IBM is in scope — Cloud, Watson, Red Hat OpenShift, Maximo, mainframe, or consulting — treat it as a vendor-risk event now, not after confirmation. Cover-up allegations bear directly on breach-notification clauses, GDPR Art. 33/34 processor duties, and SOC 2 vendor management controls.

The CVE data used to defend the stack is degrading at the same moment the AI platforms holding the data are failing at isolation. These are not independent events. They compound.

Princeton Finding: Reliability Is Not Improving

Princeton's ICML 2026 study finds GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors. Any AI governance policy that cleared use cases on the basis of 'we'll use the latest model' is treating a marketing claim as a control. Reliability has to be enforced outside the LLM, via deterministic validators and human-in-the-loop gates on irreversible actions.