The Watch

The Situation

Two zero-day-class events landed this week with no vendor remediation available for either. Cisco disclosed active exploitation of CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager, the management plane that fronts the entire WAN fabric. Separately, the Miasma worm did what manual package poisoning never managed: self-replicated across 73 GitHub repositories inside four of Microsoft's own organizations. A parallel campaign tracked as IronWorm has contaminated 50+ legitimate npm packages.

Why Miasma Is Different

Registry-worm theory has been a conference-talk staple for a decade. It is now operational. Earlier supply-chain attacks were linear: one compromised package, one blast radius. Miasma is compounding. Every CI run that pulls a contaminated package becomes a new propagation node. The Rust-based info-stealer payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets, which is the exact credential set needed to push poisoned versions further downstream. Microsoft's own repositories getting hit settles a long-running argument inside platform-security teams: internal repos are not insulated from registry-level contagion just because they sit behind a vendor's logo.

The Cisco Problem

CVE-2026-20245 targets the admin/API interface of Catalyst SD-WAN Manager. Exploitation gives an attacker the ability to push configuration changes across the entire WAN. The blast radius is every branch and site managed by that controller, not a single device. No patch is available. Compensating controls on an internet-adjacent management plane is the only posture on offer this week, and operators who delayed segmenting their SD-WAN orchestrators last patch cycle are finding out why that was a bad call.

Concurrent Active Threats

Self-replicating worm logic has reached package ecosystems. Every install becomes a new propagation node. The assumption that repositories owned by platform vendors are quarantined from registry contagion is falsified.

Three AI Stack Vulnerabilities, One Pattern

The shared mechanism across this week's AI-stack disclosures is straightforward. They exploit trust boundaries developers treat as inert. The stack in question went to production over the last eighteen months without a security review worth the name.

HuggingFace Transformers RCE

Remote code execution via crafted model configuration files. The package carries 2.2 billion installs. The trigger path weaponizes a file most pipelines treat as metadata, the byproduct of pulling a model from the Hub. Successful exploitation lands on GPU-accelerated inference hosts, historically the worst-instrumented machines in the enterprise: no EDR, no egress inspection, elevated privileges for CUDA access.

Claude Code MCP Integration

The Model Context Protocol is the connector layer that gives LLM clients access to tools, files, and credentials. It has known security weaknesses. MCP servers with wildcard filesystem or shell access grant the model access to ~/.aws/credentials, SSH keys, and source code. MCP traffic is rarely logged, and detection maturity is effectively zero in most environments.

Claude Code itself ships with a seven-tier permission model including bypassPermissions and dontAsk modes that suppress interactive approval for shell commands. A developer running either mode on a machine with production credentials has created an unmonitored insider with execute rights reading attacker-controlled inputs.

Anthropic Cross-Tenant Exposure

A suspected multi-tenant isolation failure at Anthropic may have leaked outputs across tenant boundaries. Unconfirmed. No CVE, no advisory, no named victim. Even so, every major AI platform vendor has now logged at least one credible cross-tenant or prompt-injection incident in the last twelve months. OpenAI's global rollout of Lockdown Mode, which works by amputating capabilities rather than hardening them, is an implicit admission that prompt-injection exfiltration has no clean technical fix.

Detection Maturity Across AI Attack Surfaces

The model config was never meant to be executable, and the MCP server was never meant to read ~/.aws/credentials. Each vulnerability exploits a developer mental-model assumption. That is why they work.

The First Clean Proof of Concept Against a Named Platform

The actor is unattributed. The target was high-profile Instagram accounts. The mechanism: attackers socially engineered Meta's AI chatbot into changing the account email on the credential-reset path. The chatbot treated the exchange as a support conversation, not an identity-proofing one. The account was not breached in the conventional sense. The attacker convinced the chatbot to do it for them.

In MITRE ATLAS this is LLM Prompt Injection → Privilege Escalation via Tool Use. In ATT&CK it maps to Account Manipulation (T1098) and Account Access Removal (T1531), executed through a non-human intermediary. The Instagram takeover is not the story. The story is that the pattern generalizes to any LLM wired to tools that mutate identity state.

Why This Matters Beyond Meta

Scope: every customer-facing AI assistant, internal helpdesk bot, and IAM self-service flow with the authority to change email, phone, MFA factor, password, or recovery method. The attack works because the AI inherits trust it was never designed to carry — the session tokens and account-recovery flows of the product it was bolted onto. Count the organizations that wired a model into password reset and called it customer experience.

Adjacent Context

Two data points from the same cycle. Cloudflare now reports bots outnumber humans on the open web. Bright Data's iOS SDK has been documented turning consumer apps and smart TVs into web-scraping exit nodes, which retires the assumption that residential ASNs are low-risk traffic. The throughline is automated traffic at scale, model-assisted tradecraft on offense, model-mediated trust decisions on defense.

OpenAI has shipped Lockdown Mode globally. It disables Deep Research, Agent Mode, internet image fetching, and file downloads. Read it as the vendor-side concession that LLMs can be weaponized through their own interfaces. The mitigation is capability amputation, not a technical fix. That is the current state of the art.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.