The Engineer

What Happened

A self-replicating worm called Miasma has autonomously propagated across 73 Microsoft GitHub repositories spanning four organizations, and a variant (IronWorm) poisoned 50+ npm packages. This is not manual package poisoning — the worm propagates across repositories automatically, infecting dependents without human intervention. The payload is a Rust-based information stealer compiled to a native binary, which means JavaScript-focused static analysis tools and npm audit cannot detect it.

Why This Is Different

Previous supply chain attacks required an attacker to manually compromise each package. Miasma automates the propagation step. Your exposure isn't limited to "did I install a bad package" — it extends to "did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days." The campaign is described as ongoing and not contained.

If you're running CI/CD that auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, stop and audit. The worm propagates through the update mechanism itself.

Detection Signatures

• Unexpected postinstall scripts that download native binaries
• New Rust/native files appearing in node_modules after recent updates
• Unexpected outbound network connections during npm install or build phases
• Recently-updated dependencies from Microsoft GitHub organizations

The Meta-Signal

Separately, an AI agent autonomously discovered 21 zero-day vulnerabilities in FFmpeg. FFmpeg processes media in your video pipeline, your thumbnail generator, your mobile app. Combined with Miasma, the picture is clear: both the discovery rate (AI finding bugs faster) and the propagation rate (worms spreading autonomously) have shifted. Your vulnerability management process needs to handle patch velocity that's 5-10x what you've planned for.

Architectural Response

The correct posture is defense-in-depth assuming compromise:

1. Process untrusted media in isolated sandboxes (gVisor, Firecracker microVMs)
2. Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and binary execution during install/build
3. Pin dependencies with verified checksums, not floating ranges
4. Default-deny NetworkPolicies in Kubernetes

Four Data Points, One Conclusion

The week confirmed from independent directions what last month's incident reports already suggested: LLMs with write access to sensitive operations are exploitable by design, and prompting does not fix it.

The Meta Exploit Is the Clearest Example

Attackers hijacked high-profile Instagram accounts by asking Meta's AI chatbot to change the account email. The chatbot had write access to the identity system. No memory corruption or forged token; the model did exactly what it was allowed to do. This is the confused deputy problem, and it is structural.

An LLM is a probabilistic function over text. Its refusal behavior is a learned distribution, not a permission boundary. Treating refusal as access control is a category error.

OpenAI's Lockdown Mode Is the Industry Admitting Defeat

Lockdown Mode does not harden Deep Research or Agent Mode. It turns them off entirely. That is the move you make when you have concluded prompt injection cannot be solved at the model layer, and the lab with the largest red team and the most telemetry is declining to defend agents that touch the open web.

MCP: The Shadow IT Problem for AI Tooling

Claude Code's MCP protocol has a vulnerability at the integration mechanism itself. This is not prompt injection making Claude do bad things; the protocol is exploitable on its own. Engineers wiring up MCP servers that expose production credentials, internal APIs, or sensitive repos hand attackers that access without machine compromise. Usage will outpace security review unless someone intervenes architecturally.

The Architectural Pattern That Works

The fix is the same across all four cases: the LLM proposes, a separate system authorizes.

1. LLM produces structured proposals (read-only comprehension)
2. Deterministic policy layer validates against an allowlist
3. Out-of-band verification gates mutations (MFA, human approval, cryptographic challenge)
4. If the policy can be argued with in English, it is not a policy. It is another model.

The Data

Princeton's updated ICML 2026 paper measured agentic task reliability across GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7. The finding: these models are not meaningfully more reliable than their predecessors on multi-step tool-use tasks. Single-turn capability keeps climbing. 12-step trajectory reliability stays flat because the failures aren't capability failures. They are state-tracking failures, tool-call schema drift, and silent retries that pass unit tests and break workflows.

A bigger model does not fix a harness that loses the plan on turn seven. The bottleneck moved from weights to scaffolding sometime in the spring. Princeton has now put a number on it.

GitHub's Infrastructure Proved the Same Point

GitHub processed 17 million agent-authored PRs in March 2026, 3x their projections. The West Coast data center hit network saturation and emergency load-shedding spilled into Azure. The compound load isn't 17M PRs. It is the retry behavior that 17M autonomous clients exhibit when the first attempt is slow. An agent doesn't go get coffee. It opens another PR. That PR queues behind the first. The cascade multiplies.

What This Means for Planning

Plans to simplify retry logic, fallback chains, or structured-output validators on the back of the next model release should be shelved. Don't. That code is load-bearing and will remain so. The Princeton data argues for planning as if Opus 4.7 is as good as the model gets for the next two quarters.

The Intelligent Routing Pattern (Now With Cost Math)

Flat reliability at the top plus Gemma 4 QAT at 1GB at the bottom dictates the architecture:

• Classify requests by complexity at the gateway
• Route easy requests (the long tail) to local QAT models. Zero API cost.
• Route hard requests to frontier models with the full retry harness intact
• Cloudflare AI Gateway now enforces per-model/per-user spend caps with automatic fallback

The math: routing 10% of a $10M annual inference bill from frontier to cheaper tiers saves about $1M. This only works if traffic has a long tail of easy requests. If every call is a 12-step research task, the routing savings are noise and reliability is the only problem worth solving.

CI/CD Capacity Planning

GitHub's 3x miss is the canary. Capacity plan against PR volume × agent retry multiplier × CI pipeline fan-out, not PR count alone. Enforce per-actor concurrency caps. Surface queue depth back to the agents so they back off instead of retrying blind.