The Engineer

The npm Worm That Spreads Itself

The Miasma worm is not just another malicious npm package. It's a self-replicating campaign that propagates autonomously across repositories with no human in the loop. It has hit 73 Microsoft GitHub repos across four organizations. A variant called IronWorm poisoned 50+ additional npm packages. The payload is a Rust-based information stealer, a compiled native binary that will not show up in JavaScript static analysis. The npm audit is blind to this.

The relevant question is not whether you installed a bad package directly. It is whether any transitive dependency pulled from a compromised Microsoft repo in the last N days. The campaign is ongoing and not contained.

Compromised repos infect their dependents automatically. If you auto-merge Dependabot PRs or float version ranges for Microsoft packages, you are in the blast radius. The signals worth grepping for are postinstall scripts downloading binaries, unexpected network calls during builds, and new native files appearing in node_modules.

ML Model Configs Are Now an RCE Vector

Hugging Face Transformers (2.2 billion installs) has a critical RCE reachable through model configuration files. The vector is config, not weights. Most teams already harden against pickle deserialization in weights, but nobody treats config.json as executable input. It is. The library evaluates or instantiates objects based on config values, which gives an attacker execution primitives in what looks like benign metadata.

The targeting is deliberate. GPU inference nodes typically hold training data access, model IP, cloud credentials, and lateral paths into ML infrastructure. In my context, anything calling from_pretrained() against an untrusted artifact runs in an isolated sandbox with minimal privileges and no network egress. If you are loading models you don't fully control from a request handler, do not do that.

The Meta-Signal: AI-Powered Discovery at Scale

An AI agent autonomously found 21 zero-day vulnerabilities in FFmpeg. FFmpeg is the media processing substrate of the internet, sitting under your video pipeline, thumbnail generator, browser, and mobile app. Similar agents are now being pointed at every foundational C/C++ library. In my context I am budgeting for 5-10x the patch velocity we planned for last year. The vulnerability management process most teams run was not designed for that throughput.

Meta's Chatbot Was the Attack Surface

Attackers took over high-profile Instagram accounts by asking Meta's AI chatbot to change the account email. The chatbot had write access to the identity system. No out-of-band verification on the path. This was not prompt injection in the classic sense. The model did exactly what it was authorized to do. The exploit was a conversation. The model is a confused deputy by construction.

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

The right shape: the LLM proposes, a separate deterministic system authorizes via cryptographic challenge, human approval, or MFA. The LLM is never the final authority on identity changes, financial transactions, or credential mutations. This is the same lesson as never letting the requester sign their own capability token.

OpenAI Concedes: Lockdown Mode Disables, Doesn't Harden

OpenAI shipped Lockdown Mode. Read the spec. It disables Deep Research, Agent Mode, web image fetching, and file downloads entirely. It does not make them safer. It turns them off. The industry leader, with the largest red team and the most telemetry, is declining to defend agents that touch the open web.

The implication is direct. If a system ingests documents from the internet, parses email, or runs user-uploaded files through an LLM that also holds tool-calling, it has the exact vulnerability OpenAI just conceded they cannot fix. Prompt injection is a property of the architecture, not a bug in the build.

MCP Protocol Itself Is Exploitable

Claude Code's MCP (Model Context Protocol) has a vulnerability in the protocol layer itself. This is not Claude being talked into bad behavior. The integration mechanism is exploitable on its own terms. Developers wiring up MCP servers that expose production credentials, internal APIs, or repositories hand attackers that access without anyone compromising the developer's machine. Microsoft published 7 new attack vectors for AI agents the same week, all extending past prompt injection.

The Architectural Pattern to Adopt

Princeton's Finding: The Model Isn't Getting More Reliable

Princeton's updated ICML 2026 paper has the data point that should reshape upgrade plans. GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are NOT meaningfully more reliable than their predecessors on agentic tasks. Single-turn benchmarks keep climbing. Multi-step trajectories stall in the same places: state-tracking failures, tool-call schema drift, and silent retries. Those are harness problems, not capability gaps.

Reliability is not arriving in the next model checkpoint. It is arriving in the harness around the model: retries with state, typed tool schemas, deterministic replays, and an evaluator that scores trajectories rather than final answers.

Plan accordingly. Build the retry and fallback layer as if Opus 4.7 is the ceiling for the next two quarters. If a stronger model ships, the harness still helps. If it doesn't, the harness is the product.

GitHub: 17M Agent PRs Hit a 3x Projection Miss

GitHub's CPO confirmed agent-generated activity came in at 3x their projections. That saturated the West Coast network and forced an emergency Azure migration. The interesting failure is the load shape. An agent PR fans out to CI, security scans, artifact builds, container pushes, deployment previews, and notification webhooks. One agent files dozens of PRs a day. The bottleneck stops being compute and becomes the seams between systems.

Most CI/CD was sized against humans who get coffee between pushes. Agents don't get coffee. When a stage runs slow they retry, compounding the load instead of absorbing it. Per-actor concurrency caps and queue depth fed back to the agent are the minimum viable fix.

The Intelligent Routing Pattern Is Now Mandatory

Flat reliability plus exploding volume forces one architecture: semantic routing. Classify the request. Cheap ones go to Gemma 4 QAT, which is 1GB and runs on commodity hardware. Hard ones go to frontier models with the retry layer intact. The gateway kills anything that exceeds budget. GitHub's 'auto' mode is exactly this: a classifier routes simple completions to MAI Code One Flash, multi-file refactors to Opus or GPT. Cloudflare AI Gateway enforces it with per-model and per-user spend caps and automatic fallback.

The math is unsentimental. Move 10% of a $10M annual inference bill off the frontier tier and that is roughly $1M saved. The hard part is the classifier: sub-10ms latency, and accurate enough not to send hard problems to the small model.