ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,255 words · 3 moves to watch
The Signal

Two active items this week.

CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, exploited in the wild, no patch. Separately, the Miasma worm has reached 73 Microsoft-owned GitHub repositories and 50+ npm packages, dropping a Rust-based info-stealer. The WAN management plane and the JavaScript dependency graph are both compromised at once.

In Play

  1. Active Exploitation Sprint: Unpatched Cisco Zero-Day + Self-Replicating Supply-Chain Worm

    Cisco CVE-2026-20245 is actively exploited with NO vendor patch — defenders are in pure ACL/logging mode. Simultaneously, Miasma worm infected 73 Microsoft GitHub repos across 4 orgs and IronWorm poisoned 50+ npm packages with credential-harvesting payloads. SolarWinds Serv-U DoS added to CISA KEV. Treat this week as an incident sprint.

    Ask Clarity

  2. AI Development Pipeline Is Now a Tier-1 Attack Surface

    HuggingFace Transformers RCE (2.2B installs) exploitable via model config files. Meta's AI chatbot was socially engineered into hijacking Instagram accounts — prompt-as-privilege-escalation is now proven in the wild. OpenAI shipped Lockdown Mode globally as an admission prompt injection has no clean fix. Anthropic may have leaked outputs across tenant boundaries.

    Ask Clarity

  3. Agent-Scale Code Pipeline: 17M Non-Human PRs Rewriting Supply Chain

    GitHub processed 17M agent-authored pull requests in March 2026. Copilot moved to usage-based billing June 1 — stolen tokens now trigger real invoices. OpenAI is merging Codex into ChatGPT, widening prompt-injection blast radius. Claude Code's bypassPermissions mode gives agents unmonitored shell access on developer machines.

    Ask Clarity

  4. NVD Collapse & AI Discovery Outpacing Remediation

    Commerce IG officially declared NIST's NVD backlog a strategic-planning failure — your scanner data is degrading. An AI agent found 21 FFmpeg zero-days in one cycle. Project Glasswing expanded to 150 critical-infrastructure firms. Patch SLAs are structurally obsolete; virtual patching must become the primary control.

    Ask Clarity

  5. Vendor Trust Erosion: IBM Cover-Up, Anthropic Leak, Reliability Plateau

    IBM whistleblower alleges multiple undisclosed breaches — a vendor-risk event for any IBM customer. Anthropic's suspected cross-tenant exposure is unconfirmed but pattern-consistent. Princeton's ICML study finds GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are NOT more reliable than predecessors. AI vendor maturity is below what enterprise pricing implies.

    Ask Clarity

Deep Dives

Active Exploitation Sprint: Unpatched Cisco Zero-Day and Self-Replicating Supply-Chain Worm

Situation

Cisco shipped no patch this week for CVE-2026-20245 (CVSS 7.8), which is under active exploitation in Catalyst SD-WAN Manager and remains vendor-unaddressed. The Miasma worm, a self-replicating supply-chain payload, has compromised 73 GitHub repositories across four Microsoft-owned organizations. The related IronWorm campaign poisoned 50+ legitimate npm packages with a Rust-based information stealer. CISA added a SolarWinds Serv-U DoS flaw to KEV the same week.

Why Miasma Is Different

Manual package poisoning has a linear blast radius. A worm has a compounding one. Replication is autonomous, and propagation tracks CI runs rather than human publish events. The Rust payload harvests CI tokens, .npmrc credentials, SSH keys, and environment secrets, which is precisely the credential set needed to push poisoned versions further downstream. Microsoft's own repos sitting in the compromised set indicates that platform ownership confers no isolation from registry-level contagion.

Worm logic is now resident in npm and GitHub, with propagation tied to CI execution rather than human commits. Treat any pipeline that consumed the affected packages as suspect until proven otherwise.

The Cisco Exposure

CVE-2026-20245 targets the management plane of Catalyst SD-WAN Manager, an internet-adjacent surface with WAN-wide blast radius. With no patch available, defenders are in pure compensating-controls mode: ACL restriction to jump hosts, enhanced audit logging, and active hunting for anomalous API calls and session creation events.

Cross-Incident Comparison

IncidentPatch StatusBlast Radius
Cisco SD-WAN CVE-2026-20245None availableWAN-wide via management plane
Miasma (Microsoft GitHub)Cleanup in progress; worm self-replicatesAll consumers of affected repos + transitive deps
IronWorm (npm)Per-package; pin/audit requiredAny CI pulling fresh deps in last 14 days
SolarWinds Serv-UPatch availableAny Serv-U instance; BOD 22-01 timeline
FFmpeg 21 zero-daysStagingAnything touching video processing

The FFmpeg Signal

One AI agent autonomously disclosed 21 zero-days in FFmpeg in a single research cycle. FFmpeg ships inside container base images, Slack, browser-side wasm, and ML preprocessing pipelines, which is broader than most asset inventories acknowledge. The pattern to watch is AI-assisted discovery producing disclosure volume faster than vendor patch cycles can absorb.

What to do

  1. Restrict Cisco Catalyst SD-WAN Manager admin interfaces to jump-host-only via ACL and enable full audit logging. Hunt for anomalous session creation and config push events.

  2. Run emergency npm/GitHub dependency audit: identify packages installed or updated in the last 14 days matching Miasma/IronWorm IOCs. Rotate all CI tokens, npm tokens, and developer credentials from suspect builds.

  3. Patch all SolarWinds Serv-U instances and document remediation against BOD 22-01 timelines.

  4. Inventory all FFmpeg usage (services, containers, client apps, wasm, ML pipelines) and pre-stage emergency patch playbooks per service tier.

  5. Enforce npm ci with lockfiles, enable provenance verification, and quarantine suspicious packages at the proxy registry layer.

AI Development Pipeline Is Now a Tier-1 Attack Surface — Four Concurrent Vectors

The Pattern

Four AI-stack attack surfaces escalated in the same week. Each one exploits a trust boundary developers assumed was implicit. That is why they work.

The model config was not supposed to be executable. The MCP server had no business reading ~/.aws/credentials. A chatbot should not be mutating account emails. Every one of those assumptions failed this week.

1. HuggingFace Transformers RCE (2.2 Billion Installs)

A remote code execution reachable through crafted model configuration files. The trigger path weaponizes what most pipelines treat as inert metadata. "Just downloading a model" from the Hub becomes code execution. Blast radius lands on GPU inference hosts, Jupyter environments, and MLOps runners, historically the worst-instrumented boxes in any enterprise. Detection maturity is low. Most ML hosts run without EDR or egress inspection.

2. Meta AI Chatbot Account Takeover (Exploited in the Wild)

Attackers socially engineered Meta's AI chatbot into changing the email address on high-profile Instagram accounts. Read it as prompt-as-privilege-escalation: the chatbot performed an identity-state mutation a human agent would have flagged. The pattern generalizes to any LLM wired to tools that can mutate identity, payments, or data. In MITRE ATT&CK terms, T1098 (Account Manipulation) executed through a non-human intermediary.

3. Claude Code MCP Integration Flaws

MCP is the protocol teams use to hand LLMs tools, files, and credentials. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch. This is not shaped like a deserialization bug. The threat model for MCP is not settled, and over-privileged servers with wildcard filesystem access are the default rather than the exception.

4. OpenAI Lockdown Mode (Shipped Globally)

OpenAI's mitigation works by removing capabilities, not hardening them. Deep Research, Agent Mode, internet image fetch, and file downloads are all disabled. That is an honest admission that prompt injection has no clean technical fix. Available on all personal accounts. Enterprise and Team tenants are not explicitly covered, so tenant-level DLP remains load-bearing.

Anthropic Cross-Tenant Exposure (Unconfirmed)

Reports describe a possible cross-tenant output leakage during an Anthropic outage, consistent with multi-tenant isolation failure. Treat as unverified until a vendor statement confirms. If it validates, every major AI platform vendor will have had at least one credible isolation incident in the last 12 months.

Detection Maturity Assessment

SurfaceDetection MaturityPriority Control
HF Transformers on ML hostsLow — no EDR, no egressPatch + egress controls + FIM on model dirs
LLM-fronted identity flowsVery low — MCP traffic rarely loggedHuman-in-the-loop on all recovery actions
Prompt injection via connectorsEmerging — Lockdown Mode is first vendor controlEnable Lockdown Mode + DLP on connector egress
Multi-tenant LLM inferenceLow — no SOC 2-comparable isolation testingPreserve logs, demand RCA from vendor

What to do

  1. Inventory all hosts running HuggingFace Transformers (GPU inference, notebooks, MLOps runners) and pin to patched version. Block loading untrusted model configs from the Hub at egress proxy.

  2. Audit every LLM-fronted support, helpdesk, and IAM flow for ability to mutate identity state. Require human-in-the-loop or out-of-band verification for any account recovery action via AI agent.

  3. Mandate ChatGPT Lockdown Mode for high-sensitivity users (execs, legal, M&A, IR). Document capability trade-offs in AI acceptable-use policy.

  4. Allowlist and sign all MCP servers; enforce least-privilege scopes; log MCP traffic. Default-allow is over.

  5. Open vendor incident review with Anthropic: request RCA, scope, and tenant-list confirmation for suspected cross-tenant exposure. Preserve all Claude API call logs from the affected window.

17 Million Agent PRs Per Month: The Code Supply Chain, Identity Perimeter, and Financial Attack Surface All Moved

The Scale Shift

GitHub reported 17 million agent-generated pull requests in March 2026. One month. One platform. Review pipelines built for human-authored diffs are now triaging machine output at machine cadence. The control assumes a human on at least one side of the change. At this volume that assumption is a budgeting problem, not a policy.

Code review was designed around the assumption that the author was a human with a job title and a Slack handle. Agents do not have those. They have API keys and prompts — and the prompts are increasingly authored by other agents.

Three New Attack Surfaces

1. Agent-Authored Code at Scale

Repositories already contain non-trivial agent-generated code merged by humans on review fatigue. Observed failure modes: slopsquatting via hallucinated dependencies, over-permissive IAM in IaC, secrets in test fixtures, license contamination. SAST and SCA were tuned to a slower cadence than the one shipping the code.

2. Copilot Usage-Based Billing (Financial DoS)

Since June 1, GitHub Copilot runs on usage-based billing with semantic routing across MAI Code One Flash, Opus, and GPT. A compromised developer credential no longer just leaks code. It spends money. A stolen PAT looped against an agent endpoint produces an invoice, not just an incident.

3. Claude Code's Dangerous Permission Modes

Claude Code ships seven permission tiers, including bypassPermissions and dontAsk, which suppress interactive approval on tool calls and shell commands. Enabling either on a workstation with cloud SSO or signing keys delegates execution authority to a model whose input channel includes every README, issue, and dependency in the repo.

OpenAI Codex-to-ChatGPT Merger

OpenAI is collapsing Codex into ChatGPT. Developer code, secrets, and proprietary logic will traverse the same endpoints as general chat traffic. DLP rules scoped to coding-tool endpoints go blind. Prompt-injection blast radius widens because the unified assistant carries broader tool access and context.

Concentration Risk

GitHub is shedding load into Azure after hitting single-data-center limits. Dev pipeline (GitHub), identity (Entra), productivity (M365), and AI tooling (Copilot/OpenAI) now share fate. BCP plans that model GitHub-only outages are stale.

SurfaceWhat ChangedDetection Gap
Agent-authored PRs17M/month; dominant inputSAST/SCA tuned for human cadence
Copilot billingUsage-based since June 1No SOC alerts on spend anomalies
Claude Code permissionsbypassPermissions = unmonitored shellEDR not fingerprinting agent configs
Codex→ChatGPT mergeCode flows shift to chat endpointsDLP rules scoped to Codex miss

What to do

  1. Implement branch protection requiring SAST, secret-scan, SCA, and dependency-confusion checks on any PR from a Copilot or agent identity. Tag and sample for human audit.

  2. Reclassify Copilot tokens and PATs as financially sensitive credentials. Enforce short TTL, conditional access, IP allowlists, and per-user/per-org spend caps with anomaly alerts.

  3. Publish AI coding-agent permissions policy banning bypassPermissions and dontAsk on any workstation with production credentials. Enforce via MDM/EDR detection of Claude Code config flags.

  4. Update DLP/CASB rules ahead of Codex-to-ChatGPT merger: broaden monitoring from coding-tool-specific endpoints to all chat.openai.com/api.openai.com developer traffic.

  5. Tabletop a correlated GitHub + Azure + M365 + OpenAI degradation scenario and document degraded-mode CI/CD procedures.

The bottom line

Your dependency graph is under attack by a self-replicating worm (Miasma, 73 Microsoft repos, 50+ npm packages), your Cisco SD-WAN management plane is actively exploited with no patch available, and your AI development pipeline — from HuggingFace model configs to LLM-fronted identity flows to 17 million agent-authored PRs per month — is now a Tier-1 attack surface that most security programs haven't instrumented. Treat this week as an incident sprint: audit dependencies against Miasma IOCs, restrict Cisco SD-WAN admin access to jump hosts, and mandate human-in-the-loop on any LLM that can mutate identity or spend money.