The Engineer

The Miasma Worm: Self-Replicating Supply Chain Attack

This is not another malicious npm package. Miasma is a self-replicating worm that propagates autonomously across repositories. It compromised 73 Microsoft GitHub repos across four organizations and poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that evades JavaScript static analysis entirely. Your npm audit is blind to it.

The propagation mechanism is the key differentiator: compromised repos infect their dependents automatically. Your exposure isn't "did I install a bad package" — it's "did any transitive dependency pull from a compromised Microsoft repo in the last N days." The campaign is ongoing and not contained. If CI/CD auto-merges Dependabot PRs or uses floating version ranges, stop and audit immediately.

A self-replicating worm in npm means your exposure is multiplicative, not additive. One compromised transitive dependency infects everything downstream.

HuggingFace Transformers: RCE Via Config, Not Weights

With 2.2 billion installs, Transformers is almost certainly in your ML stack. The attack vector is insidious: it's the configuration files, not model weights. Most teams treat config.json as safe metadata — just hyperparameters and architecture specs. Wrong. If the library evaluates or instantiates objects based on config values, attackers embed execution primitives in what looks like benign data.

GPU inference nodes are high-value targets: they typically have access to training data, model IP, cloud credentials, and lateral network access to ML infrastructure. Every from_pretrained() call against an untrusted source is now an RCE vector.

LLM Authorization: The Architecture Pattern Everyone Is Getting Wrong

Three separate sources this week confirm the same failure pattern. Meta's AI chatbot was social-engineered into changing account emails — not a prompt injection, but an authorization architecture failure. The chatbot had write access to the identity system with no out-of-band verification. OpenAI responded to the same class of problem by shipping Lockdown Mode, which disables features entirely rather than hardening them — an admission that prompt injection is unsolvable at the model layer. Claude Code's MCP protocol has a separate exploitable flaw in the integration mechanism itself.

If a system can be talked out of its decision in English, it is not a policy. It is another model. The fix is capability scoping at the tool layer, not the prompt layer.

Microsoft's 7 New Agent Failure Modes

Microsoft published an extended taxonomy — not a one-off blog post — of AI agent failure modes. This signals systematic, reproducible categories they're finding across implementations. Your threat model was probably built around prompt injection and data exfiltration. These new categories likely include: multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries.

Princeton's Finding: The Model Got Bigger, The Failures Didn't Change

Princeton's ICML 2026 paper puts a citation on what most teams already suspected. GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on multi-step agentic tasks. Single-turn capability keeps climbing. Multi-step reliability is flat.

The failures are not capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass unit tests and break workflows. A bigger model does not fix a harness that loses the plan on turn seven. The same paper documents answer leakage and agent cheating on GAIA, which means the eval suites overstate real-world reliability by a margin nobody has bothered to quantify.

The bottleneck moved from weights to scaffolding sometime in the spring. Princeton has now put a number on it. The work to do is unglamorous and mostly about logs.

GitHub's 17M Agent PRs: The Compound Load Problem

GitHub's CPO confirmed agent-generated activity hit 3x projections in March 2026. The number, 17 million agent-authored PRs, saturated West Coast network capacity and forced an emergency Azure migration. The raw PR count is not the real problem.

Here is the compound load. An agent submits a PR, which triggers CI with retries on test failures, security scans, artifact builds, deployment previews, and notification fanout, all on the same event. One agent generates dozens of PRs per day. When CI queues behind other agent PRs and timeouts fire, the agent, which has no signal about the queue, opens another PR to fix the timeout. That PR queues behind the first.

Most CI/CD systems were designed against developers who go get coffee. They were not designed against the retry behavior that 17 million autonomous clients exhibit when the first attempt is slow.

The Planning Implication

Three planning implications follow.

1. Do NOT simplify retry/fallback logic on the strength of model upgrades. Princeton confirms it is still load-bearing.
2. Implement per-actor concurrency caps in the CI/CD pipeline, and surface queue depth back to agents so they back off instead of retrying blind.
3. Build the intelligent routing layer now. Classify requests by complexity, route cheap ones to Gemma 4 QAT, route hard ones to frontier with retry logic intact. Let the gateway kill anything exceeding budget.

The tradeoff is context-dependent. This works if traffic has a long tail of easy requests, which most agent workloads do. If every call is a twelve-step research task, routing savings are noise and reliability is the only problem worth solving. Measure the distribution before committing to the topology.

The Numbers That Changed This Week

Three releases landed in the same window. Together they move the self-hosted inference math.

Why This Changes Architecture Decisions

Six months ago the context window was the reason to call a vendor. A million tokens of open-weight context potentially deletes the entire RAG layer for internal tooling. Stuff the docs corpus into context and ask. Caveats: long-context quality at the extremes is unproven, and the VRAM bill at that length is real. For controlled internal workloads, benchmark it against the current RAG stack before committing.

Gemma 4 QAT in a 1GB footprint makes on-device classification and simple generation practical. One implementation detail that bites: convert the QAT checkpoint to llama.cpp Q4_0 naively and you erase the accuracy gains. The default conversion does not respect the quantization grid the model trained against. Unsloth's dynamic GGUF path does. Standard scripts will silently regress accuracy on teams that do not check.

The intelligent routing pattern is unglamorous. Classify the request. Send cheap ones to Gemma 4 QAT on a box you already own. Send hard ones to frontier with the retry layer intact. Let the gateway kill anything exceeding budget. None of this is novel. All of it is finally cheap enough to be the default.

The Hybrid Inference Router Pattern

Every AI-native app is converging on the same component. A router classifies the request and routes local (fast, private, cheap) or frontier (slow, expensive, multi-step capable). The axes: data sensitivity, task complexity, latency budget, dollar budget. Perplexity is shipping this split between PC and cloud. Nvidia's RTX Spark is positioned for it. Cloudflare's AI Gateway enforces it at the edge with per-model spend caps and automatic fallback.

Teams that skip this abstraction retrofit it later under API-bill pressure. The component is a model load balancer with cost awareness. It sits at the gateway. It routes on budget policy. It degrades rather than fails when spend exceeds the cap.

The MoE Caveat

Sparse MoE (Qwen3.5) is the dominant efficiency architecture right now. Larger effective model, compute closer to a smaller dense one. The cost is serving complexity. You need routing logic, and the inference framework has to handle sparse activation efficiently. Before self-hosting, confirm vLLM, TGI, or TensorRT-LLM actually supports the specific routing mechanism the target model uses. Read the release notes, not the README.