The Engineer

The Miasma Campaign Is Qualitatively Different

This is not another malicious npm package. Miasma is a self-replicating worm that propagates autonomously across repositories. It compromised 73 Microsoft GitHub repos across four organizations and, together with the IronWorm variant, poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that will not appear in JavaScript static analysis tools. Your npm audit is blind to this. The campaign is described as ongoing and not contained.

Your exposure isn't 'did I install a bad package' — it's 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.'

The attack pattern exploits automated dependency workflows. If your CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, you're in the blast radius. Look for: postinstall scripts that download binaries, unexpected network connections during builds, new native files in node_modules.

AI Is Now the Vulnerability Discovery Engine

An AI agent from a security startup found 21 zero-day vulnerabilities in FFmpeg — the media processing substrate of the internet. FFmpeg is in your video transcoding pipeline, your thumbnail generator, your browser. Simultaneously, Hugging Face Transformers (2.2 billion installs) has an RCE exploitable through model configuration files — not weights, not pickle, but config.json. Most teams treat this as safe data. It isn't.

The meta-signal: AI-powered vulnerability discovery is production-real. Similar agents are being pointed at every foundational C/C++ library. Expect 5-10x the zero-day disclosure velocity you've planned for. Anthropic expanded Project Glasswing to 150+ companies. Infosecurity Europe warned about next-gen models ('son of Mythos'). The structural gap where discovery outpaces patching is now permanent.

Defense Architecture

The correct response is not 'patch faster.' It's assume compromise and contain blast radius:

• Process untrusted media in isolated sandboxes (gVisor, Firecracker microVMs) with no network egress
• Run from_pretrained() against any model you don't fully control in containers with minimal privileges
• Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and binary execution during npm install/build
• Supplement NVD (backlog growing, no strategic plan) with OSV.dev and GitHub Advisory Database
• Default-deny NetworkPolicies in Kubernetes — a compromised dependency cannot pivot laterally

A Week of Vendor Concessions on Agent Security

Meta's AI chatbot was social-engineered into changing account emails on high-profile Instagram accounts. The LLM had direct write access to the identity system with no out-of-band verification. There was no memory bug or forged token; attackers convinced the model to perform an action it was already authorized to perform.

OpenAI shipped Lockdown Mode, which disables Deep Research, Agent Mode, web image fetching, and file downloads outright. It does not harden these surfaces; it removes them. The vendor with the largest red team and the most telemetry is declining to defend agents that touch the open web.

Claude Code's MCP protocol has a security flaw under active exploitation against developers. The bug is in the integration mechanism, not in prompt injection, which means it is exploitable regardless of the model's refusal behavior.

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

Why This Keeps Happening

The pattern is identical across all three. An LLM is a confused deputy by construction: it treats instructions and data as the same tokens, and its refusal behavior is a learned distribution rather than a permission boundary. Treating refusal as access control is a category error. The auth system does not know it is talking to a model. It sees a service principal with scopes, and the scopes were broad.

Microsoft published 7 new failure modes specific to AI agents, extending the prior taxonomy past prompt injection: multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries.

The Fix: Claude Code's 7-Tier Model as Reference Architecture

Anthropic's Claude Code ships a graduated permission ladder. It is the best working example I have seen of capability-based security for AI agents:

The critical design choice: the LLM proposes, a separate system authorizes. Mutations sit behind a deterministic policy layer the model cannot argue with. The 'bubble' mode is the escape hatch, promoting an operation back up the chain mid-run so the agent does not hit the all-or-nothing trap.

The Data: Frontier Models Don't Fix Multi-Step Failures

Princeton's ICML 2026 study confirms what eval traces have shown for a year: GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors on agentic tasks. Single-turn capability keeps climbing. Multi-step reliability is flat. The failure modes are state-tracking drift, tool-call schema mismatches, and silent retries that pass unit tests and quietly corrupt workflows.

A bigger model does not fix a harness that loses the plan on turn seven. The bottleneck moved from weights to scaffolding sometime in the spring. Princeton has now put a number on it.

The same paper documents answer leakage and agent cheating on GAIA, so the public eval suites are probably overstating real-world reliability. SWE-Marathon tests at 1B-token budgets (Slack clones, JAX→PyTorch rewrites, C compilers) and finds coherence degrades at scale. We flagged the scaffolding ceiling last week. The numbers are now on the page.

Meanwhile: 17M Agent PRs Are Breaking CI/CD

GitHub's CPO confirmed agent-generated activity hit 3x projections in March. 17 million agent-authored PRs per month saturated the West Coast network and forced an emergency Azure migration. The compound load pattern is the actual mechanism:

1. Agent submits PR. CI pipeline triggers.
2. Pipeline queues behind other agent PRs already in flight.
3. Agent does not see the queue. It opens another PR to fix the timeout.
4. Retry behavior from 17M autonomous clients turns into cascade load.

CI/CD was designed for developers who go get coffee. It was not designed against the retry pattern of autonomous clients. Per-actor concurrency caps and queue-depth feedback to agents are the minimum viable fix.

The Intelligent Routing Pattern Is Now Default

The synthesis across sources is convergent: build a model router, not a model dependency. Classify by complexity and route:

• Easy requests → Gemma 4 QAT (1GB, on hardware you own) or equivalent
• Hard requests → frontier model with the retry/fallback layer intact
• Budget enforcement → Cloudflare AI Gateway per-model/per-user spend caps with automatic fallback

GitHub's 'auto' setting runs a classifier on incoming requests and routes to the cheapest viable model. Google's TPU 8t/8i split admits the same constraint in silicon: you cannot optimize throughput and latency on one chip. The architecture is splitting because the workloads demand it.