The Engineer

The Attack Has Evolved Past Your Tooling

The Miasma worm is not another malicious npm package. It's a self-replicating worm that propagates autonomously across repositories. It compromised 73 Microsoft GitHub repos across four organizations, and a variant plus the IronWorm campaign poisoned 50+ npm packages. The payload: a Rust-compiled information stealer that downloads as a native binary during install.

Your npm audit is blind to this. The payload is compiled Rust, not JavaScript. Static analysis tools that scan JS source miss it entirely.

The propagation model is the qualitative shift. Compromised repos infect their dependents automatically. Your exposure isn't just "did I install a bad package" — it's "did any transitive dependency pull from a compromised Microsoft repo in the last 7 days." The campaign is described as ongoing and not contained.

Simultaneous: AI-Discovered Zero-Days at Scale

An AI agent from an unnamed security startup found 21 zero-day vulnerabilities in FFmpeg — the media processing substrate embedded in your video transcoding, thumbnail generation, and likely your browser. Separately, Hugging Face Transformers (2.2 billion installs) has a critical RCE exploitable through model configuration files — not weights, not pickle deserialization, but config.json files most teams treat as benign metadata. GPU inference nodes are specifically targeted because they hold training data, model IP, and cloud credentials.

The Meta-Signal

AI-powered vulnerability discovery is now production-real. If one agent found 21 zero-days in FFmpeg, similar agents are being pointed at every foundational C/C++ library. Anthropic's Project Glasswing expanded to 150+ companies focused on critical infrastructure. Infosecurity Europe speakers warn about next-gen discovery models ("son of Mythos"). Your vulnerability management process needs to handle 5-10x the patch velocity you've planned for.

The structural shift: discovery now outpaces remediation. Your security model must assume permanently-exposed dependencies and contain blast radius accordingly.

Detection Approach

• Look for unexpected postinstall scripts or native binary downloads in recently-updated dependencies
• Check for unexpected network connections during npm install/build phases
• Verify any dependency sourced from Microsoft GitHub organizations against known-bad lists
• For FFmpeg: confirm media processing runs in sandboxed environments (gVisor, Firecracker)
• For HuggingFace: isolate any from_pretrained() call against untrusted sources in containers with no network egress

Four Independent Failures, One Root Cause

Four distinct agent security failures landed this week. They share one architectural mistake: treating the LLM as a trust boundary.

The Correct Architecture

The labs are now saying the same thing out loud. OpenAI's defense is feature removal, not hardening. Meta's failure was a confused deputy with broad scopes. The fix is never at the prompt layer. It is structural:

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

1. Split the trust boundary: One model reads untrusted input and emits structured proposals. A separate deterministic path authorizes side effects.
2. Scope credentials narrowly: The worst prompt should produce a bounded action. Read-only by default. Mutations sit behind a policy layer the model cannot invoke directly.
3. Claude Code's 7-tier model as reference: Enterprise policy → command-line flags → project settings → user settings → session grants → default deny. The interesting part is the "bubble" mode. Subagents escalate to parents, never directly to users.
4. Out-of-band verification for privilege: MFA, cryptographic challenge, or human approval for identity changes, payments, deletions. LLM confidence is not part of the check.

What Microsoft's 7 New Failure Modes Likely Cover

Microsoft extended their taxonomy. That is the tell: not a one-off post, but reproducible categories. Expect multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through chain-of-tool interactions, and persistence that survives conversation boundaries. Most agentic threat models were built around prompt injection and data exfiltration. These are additional categories, not refinements.

The MCP-Specific Risk

Claude Code's MCP wires Claude to databases, file systems, APIs, and shell access. The vulnerability is in the protocol layer. It is not about prompt injection making Claude misbehave. The integration mechanism itself is exploitable. Engineers keep using it anyway because the productivity gain is too compelling to drop. That is shadow IT for AI tooling. Restrict MCP servers to read-only with no production credentials until the patch ships.

The Reliability Plateau Is Now Peer-Reviewed

Princeton's updated ICML 2026 paper puts numbers on what the harness logs have been saying since spring: GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on agentic tasks. Single-turn capability is up. Multi-step reliability is flat. The failures are not capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass unit tests and break workflows.

A bigger model does not fix a harness that loses the plan on turn seven. The bottleneck moved from weights to scaffolding sometime in the spring. Princeton has put a number on it.

Meanwhile, Agent Traffic Is 3x Projections

GitHub processed 17 million agent-authored PRs in March 2026, three times planned capacity. The West Coast data center saturated and load-shed into Azure. The interesting part is the compound pattern. One agent PR triggers CI, security scans, artifact builds, and deployment previews. When the first attempt queues, the agent does not know there is a queue, so it opens another PR to fix the timeout. That PR queues behind the first one.

What This Means For Your Infrastructure

Two contradictory facts hold at once:

• Agents are unreliable at multi-step tasks (Princeton)
• Agent traffic is growing exponentially anyway (GitHub)

The implication is operational. Pipelines will absorb 3-5x CI/CD load from unreliable autonomous clients that retry blindly when they fail. The pipeline was sized for humans who go get coffee between PRs.

The Harness Is The Product

Princeton's data confirms the retry layer, the fallback chain, and the structured-output validator are permanent infrastructure. Do not simplify them on the next model bump. The work is unglamorous and mostly about logs:

• Retries with state: exponential backoff that preserves trajectory context
• Typed tool schemas: prevent the schema drift that causes silent failures
• Deterministic replays: reproduce agent failures from logged trajectories
• Trajectory scoring: evaluate the full path, not just the final answer
• Per-actor concurrency caps: surface queue depth back to agents so they back off instead of retrying blind

SWE-Marathon runs at 1 billion token budgets show coherence degradation as the bottleneck, not short-task capability. The 2.6% pass rate on economically-mapped hard tasks (ALE) says autonomous agents are not replacing knowledge work soon. Build accordingly.

The Numbers That Changed This Week

Three releases moved the self-hosted inference calculus this week:

If a RAG pipeline exists only because the context window was 128K, a million-token open-weight model potentially deletes that entire layer. Stuff the documentation corpus into context and ask.

The Routing Architecture Is Now Table Stakes

Every AI-native application is converging on the same shape: an inference router that classifies the request, sends cheap ones to a local model, and forwards the hard ones to a frontier endpoint with retry intact. Cloudflare's AI Gateway now does this at the infrastructure layer. The config exposes per-model and per-user spend caps with automatic fallback to cheaper models when a cap trips. Identity-based controls for per-team cost attribution are on the roadmap, not shipped.

The arithmetic is unsubtle. Route 10% of a $10M annual inference bill off frontier and you save ~$1M. Start with rule-based heuristics: token count, multi-file references, complexity keywords. Graduate to a trained classifier once you have labeled routing data. Not before.

Implementation Warning: Naive Quantization Destroys QAT Gains

Here is what actually happens when you convert Gemma 4 QAT checkpoints to llama.cpp's Q4_0 format with the default script. The conversion doesn't respect the quantization grid the model trained against, so it erases the accuracy gains QAT was designed to preserve. Use Unsloth's dynamic GGUF path. It handles the grid correctly. Standard conversion scripts degrade quality silently. There is no warning in the logs.

When This Doesn't Apply

If every call is a 12-step research task, routing savings are noise. The reliability problem flagged by Princeton is the only problem worth solving. Measure your request distribution before committing to the topology. The router pattern earns its complexity when traffic has a long tail of easy requests, which most agent workloads do. If yours doesn't, skip it.