The Engineer

The Miasma Worm: Self-Replicating Supply Chain Compromise

A self-replicating worm has hit 73 Microsoft GitHub repos across four organizations and poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that won't trigger JavaScript static analysis tools. Your npm audit is blind to this. The campaign is described as ongoing and not contained.

This is not 'did I install a bad package.' It is 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.' The worm propagates autonomously across repositories.

The attack vector targets postinstall scripts that download binaries, and spreads by infecting dependent packages automatically. If your CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft-org packages, you have the exact exposure profile the worm exploits.

Hugging Face Transformers: Config Files Are Now Attack Surface

Separately, Hugging Face Transformers (2.2 billion installs) has a critical RCE exploitable through model configuration files — not model weights. Most teams treat config.json as safe metadata. It isn't. If the library instantiates objects based on config values, attackers embed execution primitives in what looks like hyperparameters. GPU inference nodes are high-value targets: training data access, model IP, cloud credentials, lateral network access.

The Compound Threat

Both attacks exploit the same architecture flaw: trusted update paths with insufficient verification. The npm worm exploits dependency trust. The HuggingFace vuln exploits config trust. In both cases, the content passes through paths your security tooling considers safe.

Immediate Actions

1. Run npm ls against known-bad package lists (GitHub advisories, npm security advisories). Look for unexpected postinstall scripts or native binary downloads in recently-updated dependencies.
2. Audit all from_pretrained() calls — identify where model configs are parsed from untrusted sources. Isolate model loading in containers with minimal privileges and no network egress.
3. Pin and verify checksums for any dependencies sourced from Microsoft GitHub organizations. Review recent CI runs for unexpected network connections.
4. Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and native binary execution during npm install/build phases.

Vendor-Level Admissions This Week

The agent security story converged from three vendors at once, all pointing at the same conclusion: prompt-level defenses don't work.

1. OpenAI shipped Lockdown Mode, which disables Deep Research and Agent Mode rather than hardening them. The defense is feature removal. You ship that when you've concluded the attack surface is undefendable.
2. Meta's AI chatbot was socially engineered into changing account emails on high-profile Instagram accounts. The chatbot held write access to the identity system. No prompt injection needed, just a conversation that went somewhere it shouldn't have.
3. Claude Code's MCP protocol has a vulnerability in the integration layer itself, exploitable against developers who trust the tooling.

An LLM agent that touches auth should hold a credential narrow enough that the worst-case prompt produces a bounded action. If the policy can be argued out of its decision in English, it's another model, not a policy.

The Fix Is Architectural, Not Better Prompting

The shared mechanism: the model is a confused deputy by design. It treats instructions and data as the same tokens because that's what a language model is. The fix is structural.

Claude Code's 7-Tier Permission Model as Reference

Anthropic's implementation is the working reference design: enterprise policy → CLI flags → project settings → user settings → session grants → default deny. The 'bubble' mode is the primitive that matters. It lets a subagent escalate to its parent instead of prompting the user. UNIX process privilege inheritance, ported to agents.

Microsoft extended their AI agent failure taxonomy with 7 new attack categories past prompt injection: multi-turn context poisoning, tool-use exploitation via attacker-controlled parameters, capability escalation through chain-of-tool interactions, and persistence mechanisms surviving conversation boundaries.

For MCP Specifically

If a team has connected MCP servers exposing production credentials, internal APIs, or sensitive repos: the protocol layer itself is exploitable, not just the model's judgment. Restrict MCP servers to read-only access, no production credentials, scoped service accounts. Usage will outpace security review unless someone intervenes architecturally.

The Data Is In: Model Upgrades Don't Fix Agent Failures

Princeton's updated ICML 2026 paper confirms what production traces have shown for a year: GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on multi-step agentic tasks. Single-turn capability keeps climbing. Multi-step reliability is flat.

The failures are not capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass the unit test and break the workflow. A bigger model does not fix a harness that loses the plan on turn seven.

The same paper documents answer leakage and agent cheating on GAIA. The eval suite is overstating real-world reliability. Treat the retry layer as permanent infrastructure, not transitional glue.

Meanwhile: Agent Traffic Broke GitHub

GitHub processed 17 million agent-authored PRs in March 2026, 3x their projections. The West Coast data center hit network saturation and emergency-shed load into Azure. The compound pattern is the part worth understanding:

• Agent submits PR. CI fans out: retries, security scans, artifact builds, container pushes, deployment previews.
• Agent does not observe queue congestion. It opens another PR to "fix" the timeout.
• Retry behavior of 17M autonomous clients produces cascading load no capacity plan accounted for.

Most CI/CD systems were sized for developers who go get coffee, not autonomous clients that retry blind when the first attempt is slow.

The Intelligent Routing Pattern Is Now Table Stakes

Cloudflare's AI Gateway now enforces per-model and per-user spend caps, with automatic fallback to cheaper models when caps trip. The math is straightforward: routing 10% of a $10M annual inference bill from frontier to cheaper tiers saves about $1M. GitHub's internal 'auto' setting routes by request complexity. Simple completions go to small models. Multi-file refactors go to frontier.

The architecture: classify the request, send cheap ones to Gemma 4 QAT on hardware you own, send hard ones to frontier with retry logic intact, kill anything exceeding per-route budget. This works if your traffic has a long tail of easy requests, which most agent workloads do.

What to Build Assuming the Model Doesn't Get Better

1. Retries with state preservation, not stateless retry.
2. Typed tool schemas with strict validation at the boundary.
3. Deterministic replays for debugging.
4. Trajectory-level evaluation, not just final-answer scoring.
5. Per-actor concurrency caps at the pipeline.
6. Queue depth surfaced back to agents for intelligent backoff.

The Context Window Was Your Reason to Call a Vendor. It's Weaker Now.

MiniMax M3 ships a million-token context window in open weights. Gemma 4 QAT E2B runs in 1GB. That is the real number, not a marketing chart. Gemma 4 12B runs multimodal on a laptop. Ideogram 4.0 nf4 fits on a single 24GB consumer GPU. A year ago every one of these sentences needed a footnote about quantization tricks and throughput asterisks. They no longer do.

If a RAG pipeline exists only because the context window was 128K or 200K, a million tokens potentially deletes that entire architectural layer. Stuff the documentation corpus into context and ask.

Critical Implementation Detail: QAT Conversion

Google's Gemma 4 QAT checkpoints treat quantization as a training objective, not a post-hoc trick. Convert those checkpoints to llama.cpp Q4_0 with the standard script and you erase the accuracy QAT preserved. The conversion does not respect the quantization grid the model trained against. Unsloth's dynamic GGUF path handles this correctly. Standard conversion scripts will bite teams that do not check.

The Hybrid Inference Pattern

Every AI-native application is converging on an inference router. Classify the request by data sensitivity, task complexity, latency budget, and dollar budget. Route local (fast, private, cheap) or frontier (slow, expensive, capable). Perplexity and Nvidia RTX Spark are both shipping this split. Teams that skip the abstraction retrofit it later under API-bill pressure.

Google TPU 8t/8i: Hardware Follows the Same Split

Google split TPU gen 8 into 8t (throughput-optimized) for training and 8i (latency-optimized) for inference. Same Axion CPU host, same liquid cooling, same JAX software stack. The hardware diverges. The developer surface does not. The procurement spreadsheet just got a second column.

Open-Weight Parity Is Real on Benchmarks

Kimi K2.5, GLM-5, and Qwen3.5 (sparse MoE) now match closed models on agentic benchmarks. The caveat is the part the benchmark does not show: production reliability, API stability, and support SLAs still favor closed providers on critical paths. For internal tooling, batch processing, and non-customer-facing workloads, the cost delta is material.