The Engineer

What's Different This Time

This is not another malicious package upload. Miasma is a self-replicating worm that propagates autonomously across repositories. It compromised 73 Microsoft GitHub repos across four organizations and injected payloads into 50+ npm packages. A related campaign (IronWorm) is operating simultaneously. Both are described as ongoing and not contained.

Your exposure isn't 'did I install a bad package' — it's 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.'

The payload is a Rust-based information stealer — a compiled native binary that JavaScript static analysis tools and npm audit cannot detect. It won't show up in your existing security scanning. Look for unexpected postinstall scripts, native binary downloads, and new network connections during npm install/build phases.

Why Traditional Defenses Are Blind

The attack exploits a structural gap. Most teams trust packages from Microsoft organizations. The worm specifically targets that trust by compromising the repos themselves, then infecting dependents automatically. If your CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, you are in the blast radius without any direct action on your part.

Simultaneously, an AI agent discovered 21 zero-day vulnerabilities in FFmpeg's C codebase in a single pass. FFmpeg is the media processing substrate of the internet — it's in your video transcoding, thumbnail generation, and likely your mobile app's media handling. These zero-days don't have patches yet. If you accept user-uploaded media anywhere in your stack, you're exposed.

The Structural Shift

Two patterns are converging: AI-powered vulnerability discovery is finding bugs faster than vendors can patch (Anthropic's Project Glasswing now at 150+ companies), and self-replicating attack tooling can weaponize those discoveries without human operators. The era of 'patch when available' as a primary strategy is ending. Defense-in-depth and blast radius containment are now primary, not secondary.

The Pattern Across Five Signals

The disclosures below share a root cause. Treating LLM refusal as a security boundary is a category error. The vendors have now said so on the record.

The Correct Architecture

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

The fix is structural, not prompting. OpenAI's own answer is to remove capabilities, not harden them. The pattern that holds up under load:

1. The LLM proposes actions. It never executes them directly.
2. A deterministic policy layer authorizes: cryptographic challenge, human approval, or scoped capability token.
3. Tool calls are signed and bounded, so the worst-case prompt produces a bounded action.
4. Untrusted content processing is separated from tool-calling. Different model call, different credential scope.

Microsoft's 7 new AI agent failure modes go past prompt injection. The taxonomy covers multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries. Mapping it against an existing agent architecture is a useful afternoon. Most architectures cover one or two of the seven.

HuggingFace: The Quiet One

The Transformers RCE via config files ships against 2.2 billion installs. By volume, it is probably the most broadly exploitable item on the list. Most teams treat config.json as inert metadata. It is not. Calling from_pretrained() against anything outside your control executes arbitrary code on your GPU inference nodes. Those nodes typically hold training data, model weights, cloud credentials, and a path into the rest of the network. The config file is the payload.

Multi-Step Reliability Is Flat Across the New Checkpoints

Princeton's updated ICML 2026 paper puts numbers on the suspicion: GPT 5.5, Claude Opus 4.7, and Gemini 3.1 Pro are not meaningfully more reliable than their predecessors on multi-step agentic tasks. Single-turn capability keeps climbing. Multi-step reliability does not. The dominant failure mode is state-tracking. Around turn seven the harness loses the plan and never recovers it; tool-call schema drift at the boundary is a secondary effect, and the silent retry that follows still passes unit tests while breaking the workflow downstream.

A bigger model does not fix a harness that loses the plan on turn seven.

The same paper documents answer leakage and agent cheating on GAIA, which means production reliability is likely worse than the evals suggest. SWE-Marathon at 1B-token budgets (Slack clones, JAX→PyTorch rewrites, C compilers) shows coherence degrading at long trajectories. ALE's economically-mapped tasks come in at 2.6% pass rates on the hardest tier.

Treat the Retry Layer as Permanent Infrastructure

Error handling, retry logic, and output validation around the model are permanent infrastructure. Not transitional glue waiting to be deleted by the next checkpoint. The planning assumption worth holding: Opus 4.7 is as good as the model gets for the next two quarters. Build accordingly.

The reliability work is unglamorous:

• Retries with state — preserve trajectory context across failures
• Typed tool schemas — catch drift at the boundary, not in the response
• Deterministic replays — reproduce failures without re-running the model
• Trajectory-level evaluation — score the path, not just the final answer

CI/CD Load from Agent PRs

GitHub processed 17M agent-authored PRs in March, three times their projections, which saturated the West Coast network and forced an emergency Azure migration. Most CI/CD systems were designed against developers who go get coffee, not machines that retry at machine speed. One agent PR fans out into Actions runs, security scans, artifact builds, and notification delivery. The agent does not see queue depth, so when its first attempt is slow it opens another PR, and the fanout compounds against the same pool.

Agent-optimized tooling yields 6x token efficiency over raw API calls. The fix has three knobs: concurrency caps per actor at the pipeline level, queue depth surfaced back to agents so they back off instead of resubmitting, and semantic routing so cheap requests land on cheap models.