The Engineer

What Happened

A self-replicating supply chain worm called Miasma has autonomously infected 73 Microsoft GitHub repositories across four organizations, and a variant (IronWorm) poisoned 50+ npm packages. This is not a targeted, manual package-poisoning attack. It is an autonomous worm that propagates across repositories, infecting their dependents automatically.

The campaign is described as 'ongoing' and not contained. If you have any npm dependencies pulled in the last week, you need to audit immediately.

Why Your Existing Defenses Are Blind

The payload is a Rust-based information stealer — a compiled native binary distributed through npm packages. This means:

• npm audit will not flag it (checks known CVEs, not binary payloads)
• JavaScript static analysis tools cannot inspect compiled Rust binaries
• Standard lockfile review won't catch postinstall scripts that download binaries at build time

Your exposure is transitive. The question isn't just "did I install a bad package" — it's "did any dependency in my tree pull from a compromised Microsoft repo in the last N days." If CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, stop and audit now.

Detection Signatures

• Unexpected postinstall scripts that download binaries or make network calls
• New native files appearing in node_modules after recent updates
• Unexpected network connections during npm install or build phases
• CI run logs showing HTTP calls to unfamiliar endpoints

Architectural Response

This attack class — worms using package registries as propagation vectors — cannot be addressed by better lockfile hygiene alone. The defensive architecture needs:

1. Runtime behavioral monitoring in CI/CD: detect unexpected network calls and binary execution during install/build
2. Pinned checksums for all dependencies from Microsoft GitHub organizations
3. Network egress controls on build agents: allowlist only known registries and artifact stores
4. SBOM diffing on every PR that touches package.json or lockfiles

The Pattern

Four independent AI security failures landed this week. They look different at the surface. Underneath, they are the same bug: an LLM got write access to a system, and something talked it into using that access.

OpenAI's Lockdown Mode disables Deep Research and Agent Mode entirely. It does not harden them. That is the move you make once you have concluded prompt injection is not solvable at the model layer.

The Meta Exploit: A Conversation Was the Attack

F5 Labs disclosed that attackers hijacked high-profile Instagram accounts by asking Meta's AI chatbot to change the account email. The chatbot had write access to the identity system with no out-of-band verification. The model is a confused deputy by design. If it can call the privileged operation directly, someone will eventually talk it into doing so. The fix is not a better prompt. The fix is a second channel the model cannot forge.

The Hugging Face RCE: Your Config.json Is Executable

Hugging Face Transformers has 2.2 billion installs. If you run ML inference, it is almost certainly in your stack. The attack targets configuration files, not weights. Most teams treat config.json as inert metadata. It is not. The library instantiates objects based on config values, and an attacker embeds execution primitives in fields that look benign. GPU inference nodes are the prize: training data, model IP, cloud credentials, lateral network access.

Microsoft's 7 New Agent Failure Modes

Microsoft extended its AI agent failure taxonomy. Not new research. New categories. They are systematic and reproducible, and they sit beyond prompt injection: multi-turn context poisoning, tool-use exploitation, capability escalation through tool chains, and persistence across conversation boundaries. If your threat model stops at prompt injection, your threat model is incomplete.

The Architectural Fix

All four share one solution pattern:

1. The LLM proposes, a separate system authorizes. Cryptographic challenge, human approval, or deterministic policy gate. Never the LLM as final authority on state mutations.
2. Capability scoping at the tool layer, not the prompt layer. If a policy can be talked out of its decision in English, it is not a policy. It is another model.
3. Read-only by default. Mutations sit behind a deterministic layer the model cannot argue with.

The Princeton Data

Princeton's updated ICML 2026 paper says what production teams have been logging for months: GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on multi-step agentic tasks. Single-turn benchmarks keep going up. Multi-step reliability is flat.

The failures are not capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass the unit test and break the workflow. A bigger model does not fix a harness that loses the plan on turn seven.

The same paper documents answer leakage and agent cheating on GAIA benchmarks, which means the public evals are overstating real-world reliability. If the plan was to delete retry and fallback logic on the next upgrade, don't. That code is load-bearing.

The Infrastructure Consequence: 17M Agent PRs/Month

GitHub's CPO confirmed agent-generated activity hit 3x projections, saturated West Coast network capacity, and forced an emergency Azure migration. The compound pattern is the real story. One agent PR triggers CI, retries on test failure, fans into security scans, artifact builds, and deployment previews. The agent does not know about the queue and opens another PR to fix the timeout it caused.

The fix is per-actor concurrency caps at the pipeline and queue depth surfaced back to the agent. Neither is exotic. Both were deferred because the load was not there. It is there now.

The Routing Response

Two solutions converged from independent sources this week:

• Semantic routing: GitHub's 'auto' setting classifies the request and routes to the cheapest viable model. Simple completions go to a small model. Multi-file refactors go to frontier. Start with rule-based heuristics. Graduate to a trained classifier when the heuristics stop holding.
• Cloudflare AI Gateway: per-model and per-user spend caps with automatic fallback to cheaper models when caps trip. Identity-based controls are next. Routing 10% of a $10M inference bill away from frontier tiers saves about $1M. That is the whole math.

What to Build Assuming Current Models Are As Good As It Gets

1. Retries with full state preservation, not blind retries
2. Typed tool schemas with strict validation
3. Deterministic replay for debugging failures
4. Trajectory-level evaluation, not just final-answer scoring
5. Per-actor concurrency limits in CI/CD

If a stronger model ships, the harness still helps. If it does not, the harness is the product.