The Watch

The Situation

Two unrelated but equally critical remote code execution vulnerabilities need emergency action today. CVE-2026-45659 (SharePoint Server) was added to CISA's Known Exploited Vulnerabilities catalog with confirmed active exploitation — this carries a federal mandate for patching. Simultaneously, CVE-2026-50548 and CVE-2026-50549 (Cursor IDE, CVSS 9.8) give attackers zero-click code execution on every developer machine running versions before 3.0.

These aren't theoretical advisories — SharePoint is being exploited in the wild right now, and Cursor's zero-click pair means any attacker-controlled content an AI agent reads becomes an exploit trigger.

SharePoint: CVE-2026-45659

CISA KEV listing means confirmed exploitation and a federal remediation deadline. Internet-facing SharePoint instances are the immediate priority — inventory them, patch them, or isolate them. Hunt for compromise on anything that was exposed while unpatched. The exploitation path is RCE, meaning full host compromise of a system that typically holds sensitive collaboration data.

Cursor: CVE-2026-50548/50549

Discovered by Cato AI Labs, these flaws let attacker-controlled content escape Cursor's sandbox, write arbitrary files, and execute code with no user interaction. In an agentic IDE, the attack surface is everything the agent ingests: repository files, MCP tool responses, web search results. A poisoned repo or crafted MCP payload becomes a silent entry point to developer workstations holding cloud credentials, CI/CD tokens, and source code.

Cross-Source Pattern

These two items share a structural lesson: both target infrastructure where the reading of content constitutes the attack. SharePoint renders content that triggers exploitation; Cursor's agent reads content that triggers exploitation. The traditional model of exploitation-requires-interaction is dead for both classes.

Argo CD: The No-Patch Problem

Adding complexity: Argo CD's repo-server carries an unpatched pre-auth RCE reachable from the cluster's internal network. Synacktiv demonstrated the full chain: unauthenticated gRPC → Kustomize command execution → Redis credential theft → malicious manifest injection → full Kubernetes cluster takeover. No fix exists yet — compensating controls are your only defense.

Prioritization Matrix

The Shift

AI/ML infrastructure crossed from 'emerging risk' to confirmed target this week. Three distinct, active campaigns demonstrate that adversaries are attacking, weaponizing, and poisoning AI tooling at operational scale — not theoretically, not in lab conditions, but in production environments against real organizations.

Your LLM orchestration frameworks, inference endpoints, and security researchers' workflows are all now confirmed attack surfaces — treat them with the same rigor as your web applications.

Campaign 1: JADEPUFFER — First Autonomous AI-Agent Ransomware

Documented by Sysdig, JADEPUFFER is the first end-to-end ransomware attack driven by an AI agent. The agent exploited a Langflow RCE vulnerability and automated the full kill chain through database encryption. This isn't a concept — it's observed in the wild. The immediate lesson: LLM orchestration frameworks (Langflow, LangChain, and peers) are first-class attack surface and belong in your asset inventory alongside any exposed web application.

Campaign 2: Hijacked Inference Endpoints

Three observed operators are actively hijacking misconfigured Ollama and LiteLLM inference endpoints — often completely unauthenticated or protected only by placeholder API keys. Once compromised, attackers conscript these endpoints to power autonomous pentest frameworks and a Codex-based agent for weaponization and reverse-engineering. Your AI compute is being used against you and others. Pair this with open-weight GLM-5.2 (first open model to lead an APEX-SWE category at 55.3% Pass@1) that can be trivially fine-tuned to strip safeguards, and adversary tooling economics improved materially.

Campaign 3: ChocoPoC RAT Targeting Researchers

Threat actors are distributing a RAT disguised as Python proof-of-concept code on GitHub, specifically targeting vulnerability researchers and security teams. This inverts the usual model — your defenders are the targets. A researcher who clones and runs an unvetted PoC on a credentialed machine hands over internal tooling, credentials, and sensitive vulnerability data.

The Force Multiplier: Agentic Vuln Discovery

Cognition's Devin Security Swarm used 'Agentic MapReduce' to autonomously find and validate 1,000+ exploitable vulnerabilities in a single Fortune 500's production repos. This capability is now operational and available to adversaries at equivalent scale. If your public repositories or leaked source have similar vulnerability density, automated exploitation is a matter of when, not if.

What Sources Agree On

All five contributing sources converge on one conclusion: AI infrastructure has moved from theoretical risk to active attack surface. The controls gap is that most SOCs have zero monitoring on inference endpoints, orchestration frameworks, or agent-consumed content.

The Architecture Problem

A new middleware layer has quietly inserted itself between your developers and their AI models — and it's entirely outside your security governance. Model routers (Not Diamond, OpenRouter, Factory AI, Weave) intercept every prompt and forward it to whichever model is cheapest. MCP servers (2,300+ and growing) wire AI agents directly into your Gmail, Slack, GitHub, and databases. Agent skills inject unvetted third-party instructions into coding assistants. And behind it all, inference providers like FriendliAI sit in the data path of Claude Code, Cursor, and Kilo Code without ever appearing in your procurement records.

The routing decision is made on cost and difficulty, never data sensitivity. That's a new, uninspected egress path landing in regulated environments before governance has caught up.

MCP: The 2026-07-28 Spec

The upcoming MCP specification mandates OAuth 2.1 + PKCE and kills old protocol-level session hijacking — but it introduces five fresh attack vectors that fall to you as the application builder: cross-agent workflow hijacking via predictable tracking IDs, unsigned _meta metadata manipulation, header desync attacks, stored XSS in interactive MCP Apps, and DoS via long-running async tasks. The ecosystem already spans 2,300+ servers plus 9,000+ apps via Zapier, with Claude Desktop and Gemini Spark offering no-code connectors to Gmail, Drive, Slack, Calendar, and databases.

Hidden Supply-Chain Concentration

The supply-chain wrinkle cuts deepest. Multiple sources reveal hidden dependencies:

• Not Diamond powers OpenRouter's auto-router under the hood — any team that vetted OpenRouter alone has an undisclosed fourth-party handling prompt content
• FriendliAI powers Claude Code, Cursor, Kilo Code, and Ollama as an inference backend — invisible to procurement
• IDE-embedded routers (Weave inside Codex/Claude Code/Cursor) fan out to multiple model backends from a single endpoint — perimeter DLP sees one destination, not the multi-backend fan-out

Agent Skills: The New Dependency

Open-source 'skills' packages (like Impeccable) inject instructions into coding agents across Claude Code, Cursor, Copilot, and Codex. These platforms handle permissions and subagents inconsistently — the same skill runs with different privilege boundaries depending on the harness. Skills include mixture-of-experts-style internal routing that dynamically selects which instructions fire — opaque and hard to audit. This is functionally a supply-chain implant that operates through a trusted developer's agent.

Where Sources Diverge

Sources disagree on urgency. Infrastructure-focused analysis frames this as an act-now governance gap. Product-focused sources present it as market innovation worth enabling. The resolution: enable with controls — the economic pressure (10-20x cost delta, 20-30% savings) means blocking is futile; governing the data path is the achievable outcome.