The Watch

Two Trends Colliding at Scale

The Miasma self-replicating worm compromised 73 GitHub repositories across four Microsoft-owned organizations this week. A parallel variant plus the related IronWorm campaign poisoned more than 50 legitimate npm packages with a Rust-based information stealer. Meanwhile, GitHub disclosed that 17 million agent-generated pull requests were processed in March 2026 alone — a single month, a single platform.

These are not two separate stories. They are the same attack surface. The worm propagates through the same CI pipelines that are now processing code at a velocity human reviewers cannot service. Every install or CI run that pulls a contaminated package becomes a new propagation node. The compounding blast radius of worm logic is meeting an environment where review fatigue is structural, not anecdotal.

Why This Is Different from Package Poisoning

Manual package poisoning has a linear blast radius. You compromise one package, it infects consumers of that package. A worm has a compounding one. The Rust-based info-stealer payload harvests exactly the credentials needed to push poisoned versions further: CI tokens, .npmrc credentials, SSH keys, and GitHub PATs. Each compromised developer workstation or CI runner becomes a launch point for the next wave.

Microsoft's own GitHub organizations being hit signals that even platform owners cannot assume internal repos are isolated from registry-level contagion. Set this against the agent-PR backdrop: code review pipelines built for thousands of human PRs are now filtering machine output at machine volume. The human reviewer reads the diff, not the lockfile.

Self-replicating worm logic has arrived in package ecosystems at the same moment human review capacity was overwhelmed by agent-authored code. The window between compromise and detection is widening on both sides.

The Financial Attack Surface Compounds It

GitHub Copilot moved to usage-based billing on June 1, 2026 with semantic routing across frontier models. A compromised developer credential no longer just leaks code — it spends money. A stolen PAT looped against an agent endpoint is a financial denial-of-service with a real invoice. Most SOCs do not alert on Copilot spend anomalies.

Cross-Source Pattern

The Miasma campaign targets developer credentials. Copilot's new billing model makes those credentials financially exploitable. Agent-authored PRs make the insertion of malicious code harder to spot. These three vectors feed each other in a loop that conventional SAST/SCA tooling was not designed to interrupt.

Immediate Actions

Run an emergency dependency audit: identify any npm packages installed or updated in the last 14 days matching the Miasma/IronWorm IOC lists. Rotate CI tokens, npm publish tokens, GitHub PATs, and cloud credentials touched by suspect builds. Enforce npm ci with locked versions and enable provenance verification. Gate agent-authored PRs with mandatory SAST, secret-scan, SCA, and dependency-confusion checks at the branch-protection level. Reclassify Copilot tokens as financially sensitive credentials with short TTL, conditional access, and spend alerting.

The First Clean Proof of Concept Against a Named Platform

The actor is unattributed. The target was high-profile Instagram accounts. The mechanism: attackers socially engineered Meta's AI chatbot into changing the account email on the credential-reset path, an LLM that treated the exchange as support rather than identity proofing. No account was breached in the traditional sense. The chatbot did the breach on the attacker's behalf.

In MITRE ATLAS terms, LLM Prompt Injection to Privilege Escalation via Tool Use. In ATT&CK, Account Manipulation (T1098) and Account Access Removal (T1531), executed through a non-human intermediary. The technique is no longer theoretical.

The Pattern Generalizes

This is not a Meta-specific defect. It is the default architecture shipped across consumer AI features for the last 18 months: an assistant bolted onto a product that already holds session tokens and recovery flows, inheriting trust it was never scoped to carry.

The conclusion converges from multiple sources. Any LLM wired to a tool that mutates identity, money, or data is a Tier-1 attack surface. The MCP protocol behind Claude Code's tool access has known security weaknesses with no disclosed patch timeline. Claude Code's bypassPermissions and dontAsk modes suppress interactive approval for shell commands, which turns the agent into an unmonitored insider on any machine carrying production credentials.

The Instagram hijack is the proof of concept the board will hear about next. Every LLM-fronted identity flow is now in scope for the same attack pattern at machine speed.

Why Traditional Controls Fail

The attacker did not need credentials, a phishing kit, or an MFA bypass. They needed conversational patience, and automation supplies that at infinite scale. Abuse cases authored for human social engineers have to be re-run against a counterpart that is more polite, more patient, and available 24/7. Rate-limit logic tuned for human cadence is structurally insufficient against automated prompt-injection campaigns.

OpenAI shipping Lockdown Mode globally is the clearest vendor admission that prompt-injection-driven exfiltration is a live attack chain, not a research curiosity. Lockdown Mode works by amputating capabilities: disabling Deep Research, Agent Mode, internet image fetch, and file downloads. That is an honest concession that no clean technical fix for prompt injection exists yet.

Convergence with Bot Majority

Cloudflare now reports that bots outnumber humans on the open web. Combine that with LLM-mediated attacks that need only API calls and patience, and automated identity-manipulation attempts against any LLM-fronted service are set to rise by orders of magnitude. Bright Data's residential-proxy SDK, which turns consumer devices into exit nodes, further erodes IP-reputation defenses.

Three Vendor Trust Failures in One Cycle

Three distinct trust-degradation events at AI vendors this cycle:

1. Anthropic: suspected cross-tenant output exposure during an outage. Consistent with multi-tenant isolation failure in the inference path. Unconfirmed. Same bug class demonstrated against Copilot and Gemini earlier this year.
2. IBM: a former cyber executive, now whistleblower, alleges the company covered up multiple data breaches. Vendor-declined-to-surface is a different category from disclosed-late. If the framing holds, regulator questions follow.
3. OpenAI: shipped Lockdown Mode globally and mass-suspended accounts in an operational incident. Lockdown Mode is a positive defensive signal. The suspension event is identity-ops immaturity at a Tier-1 vendor.

Every major AI platform vendor has logged at least one credible cross-tenant or prompt-injection incident in the last twelve months. AI vendor trust is an operational assumption requiring continuous verification. It is not a procurement checkbox.

Reliability Is the Silent Risk

Princeton's ICML 2026 evaluation concludes that GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7 are not meaningfully more reliable than their predecessors. Vendors imply each generation is more trustworthy. Independent measurement disagrees. Any governance policy that approved use cases on "we'll use the latest model" treated a marketing claim as a control.

This intersects with the Meta account-takeover incident. Models are not getting better at distinguishing legitimate requests from social engineering. Reliability ceilings have to be enforced outside the LLM: deterministic validators, human-in-the-loop gates, idempotency on irreversible actions.

The NVD Backstop Is Gone

The Commerce Inspector General formally indicted NIST's NVD backlog as a strategic-planning failure. The canonical source of vulnerability metadata that scanners depend on is running behind the disclosure curve. VM programs that rely on NVD for CVSS, CPE matching, or CWE classification are accumulating silent coverage gaps on recent CVEs. Most teams will find out in a post-incident review.

Feeds to promote to primary: CISA KEV for exploitation-driven prioritization, EPSS for probabilistic scoring, GitHub Security Advisories, which often beat NVD on OSS, and direct vendor PSIRT feeds.

Sources Diverge on Severity

One source treats the Anthropic leak as confirmed and actionable. Another treats it as rumor-level, noting the chatter mill has been wrong about Anthropic before, and early before that. Both are honest positions. The defensive posture does not change. Preserve Claude API call logs for the suspected window. Classify by data sensitivity. Pre-position legal counsel on notification timers before the picture confirms. Acting on ambiguity is cheaper than acting after breach-notification deadlines pass.

IBM: Vendor-Risk Event Triggers

The IBM allegation implicates breach-notification clauses, GDPR Art. 33/34 processor duties, SOC 2 vendor management controls, and SEC Item 1.05 disclosure for public customers downstream. The allegation may not hold. A written attestation request costs nothing and documents due diligence if it does.