The Engineer

The Threat Has Changed Shape

Supply chain attacks just graduated from manual package poisoning to autonomous propagation. The Miasma worm compromised 73 Microsoft GitHub repositories across four organizations, then a variant plus the IronWorm campaign poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that JavaScript static analysis tools, including npm audit, cannot detect. Your standard security tooling is blind to this.

The campaign is described as 'ongoing' and not contained. If you auto-merge Dependabot PRs or use floating version ranges for Microsoft packages, your CI pipeline may already be compromised.

Why This Is Different From Previous npm Incidents

Previous supply chain attacks (ua-parser-js, event-stream) required a human attacker to manually compromise a maintainer account and publish a malicious version. Miasma propagates autonomously — compromised repos infect their dependents without human intervention. Your exposure isn't just "did I install a bad package" — it's "did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days."

Compounding Factor: AI-Accelerated Discovery

In the same week, an AI agent from an unnamed security startup found 21 zero-day vulnerabilities in FFmpeg. FFmpeg is the media processing substrate of the internet — transcoding pipelines, thumbnail generators, browsers, mobile apps. Separately, Anthropic expanded Project Glasswing to 150+ companies, and speakers at Infosecurity Europe warned about next-gen models that will accelerate discovery further.

The structural implication is concrete: AI finds vulnerabilities faster than humans patch them. Your patch-when-available strategy now has a permanently growing exposure window you cannot shrink by waiting. The Cisco Catalyst SD-WAN Manager vulnerability (CVE-2026-20245, CVSS 7.8) is the existence proof — actively exploited, zero patches available.

Parallel Attack Surface: Model Configs as RCE Vectors

Hugging Face Transformers (2.2B installs) has a critical RCE exploitable through model configuration files. Most teams treat config.json as safe metadata. It isn't. If the library instantiates objects based on config values, attackers embed execution primitives in what looks like hyperparameters. GPU inference nodes are high-value targets with access to training data, model IP, and cloud credentials. Anyone calling from_pretrained() against untrusted sources needs isolation immediately.

Defense Architecture

• Immediate: Audit npm lockfiles against known-bad package lists. Look for unexpected postinstall scripts or native binary downloads.
• This sprint: Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and binary execution during npm install/build.
• Architecture: Process untrusted media and untrusted models in isolated sandboxes (gVisor, Firecracker). Default-deny NetworkPolicies.
• Compensating controls: RASP, virtual patching via WAF, aggressive network segmentation between services.

OpenAI Lockdown Mode: capability removal as defense

OpenAI shipped Lockdown Mode. Read the spec, not the announcement. It disables Deep Research, Agent Mode, web image fetching, and file downloads entirely. It does not harden them. The switch is off. This is the largest AI lab, with the most red-teaming telemetry, concluding that the only reliable defense against prompt injection is capability removal.

If the best-resourced lab won't defend agents that touch the open web, the signal isn't the blog post. It's the kill switch they shipped, and you are building on the same primitives.

Meta's chatbot: confused deputy, made concrete

F5 disclosed that Meta's AI chatbot was socially engineered into changing account emails on high-profile Instagram accounts. The exploit wasn't a memory bug or a forged token; it was a conversation that the chatbot was allowed to act on. The model held write access to the authentication system, and no out-of-band verification existed on that write path.

This is the confused deputy problem made concrete. The LLM is a probabilistic function over text. Its refusal behavior is a learned distribution, not a permission boundary. The auth system sees a service principal with scopes, and the scopes were broad.

Claude Code MCP: the developer tool attack surface

Claude Code's MCP (Model Context Protocol) has a security vulnerability being actively exploited. The problem is in the protocol layer itself. This is not prompt injection making Claude misbehave; it is the integration mechanism being exploitable. If engineers connected MCP servers exposing production credentials, internal APIs, or sensitive repos, an attacker exploiting this flaw gets that access without compromising the developer's machine.

Microsoft's publication of 7 new AI agent failure modes extends their taxonomy beyond prompt injection into multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries.

The architectural fix

The rule: If a policy can be talked out of its decision in English, it is not a policy. It is another model.

The Data

Princeton's updated ICML 2026 paper measures the thing benchmarks skip: multi-step agent reliability. The result is clean. GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on agentic tasks. Single-turn capability keeps climbing. Multi-step reliability is flat.

The failures are not capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass the unit test and break the workflow. A bigger model does not fix a harness that loses the plan on turn seven.

Why This Matters for Planning

If the plan was to delete retry and fallback logic on the next model bump, don't. That code is load-bearing permanent infrastructure. The same paper documents answer leakage and agent cheating on GAIA, which means production reliability is probably worse than the eval numbers. SWE-Marathon at 1B-token budgets (Slack clones, JAX→PyTorch rewrites, C compilers) shows coherence degradation at scale is the bottleneck. Short-task capability is not.

The Compound Load Problem

GitHub processed 17 million agent-authored PRs in March 2026. That is 3x their projections. The West Coast data center hit capacity. Network saturation forced emergency load-shedding into Azure. The load isn't 17M PRs. It's the retry behavior 17M autonomous clients exhibit when the first attempt is slow. One agent PR fans out into CI, security scans, artifact builds, deployment previews, notifications. The agent does not see the queue. It opens another PR to fix the timeout.

Agent-optimized tooling measures 6x token efficiency over raw API calls. CLI abstractions that encode domain knowledge beat letting the model rediscover it. Spend engineering effort on the scaffolding. Do not wait for a smarter model.

The Architecture That Works Now

1. Retry with state: Exponential backoff, model fallback chains, structured-output validators that re-prompt on parse failure
2. Typed tool schemas: Prevent the drift that causes silent failures on turn 7+
3. Deterministic replay: Reproduce and debug failed trajectories
4. Trajectory scoring: Evaluate the path, not just the final answer
5. Per-actor concurrency caps: Surface queue depth back to the agent so it backs off instead of retrying blind

Build this assuming Opus 4.7 is as good as the model gets for two quarters. If a stronger model ships, the harness still helps. If it doesn't, the harness is the product.