ClarityBeta

Security & Threat Intelligence

The Watch

7 min read · 1,409 words · 3 moves to watch
The Signal

Anthropic says AI vulnerability discovery shifted the bottleneck to the patch pipeline.

Vuln-management SLAs set against 2025 volumes are already breached, so if you're still running those baselines, your unpatched backlog is effectively your exposure window. Reassess your patch pipeline capacity rather than discovery.

In Play

  1. AI Broke the CVE Rate Limit — Your Patch Pipeline Is Now the Bottleneck

    Agentic vuln discovery (Anthropic Glasswing, OpenAI Daybreak, Claude Mythos) hit ~1,500 H/C CVEs in June 2026 — 3.5x prior record. Linux Foundation confirms negative-day exploitation is the norm. Anthropic says verification and deployment are now the limiting factors, not discovery.

    Ask Clarity

  2. Shadow AI's Concrete New Attack Surface: GLM-5.2, LongCat-2.0, PageAgent, Jamie

    Four new shadow-AI threats materialized this week: Z.ai's GLM-5.2 (744B, MIT, Huawei silicon, 'no kill switch'), Meituan's LongCat-2.0 ran undetected as 'Owl Alpha' for 2 months on OpenRouter, Alibaba's PageAgent injects a browser agent via one script tag, and Jamie captures meetings with no visible bot. All produce zero vendor telemetry.

    Ask Clarity

  3. AI Security Governance Formalization: CVSS for Jailbreaks + Credential Isolation

    Anthropic, Amazon, Microsoft, and Google are drafting a CVSS-equivalent for prompt/jailbreak vulnerabilities — formalizing AI exploits into standard vuln-management. Separately, the industry is converging on a principle: credentials must stay in the deterministic app layer, never in model context. Both signal that AI vuln management is about to become mandatory.

    Ask Clarity

  4. IR Stack Vendor Viability: PagerDuty Customer Bleed + Five9 Leadership Exodus

    PagerDuty lost Uber after 12+ years as Datadog/Sentry absorb incident-management functions. Five9 lost its CTO, VP Product Engineering, and CRO within weeks. Both are continuity risks hiding in your IR and voice/PII stack that won't appear as CVEs but will bite during an incident.

    Ask Clarity

  5. AI Infrastructure Concentration: Single-Vendor Chokepoints Under the Stack

    One unnamed company controls the optical transceivers underpinning every major AI data center. China mines 80% of tungsten. AI capability concentrates in 4 providers with hidden cross-ownership (Alphabet owns ~14% of Anthropic). These are vendor-risk register items, not urgent threats — but represent cascading SPOFs below your third-party reviews.

    Ask Clarity

Deep Dives

The AI-Driven CVE Tsunami: 3.5x Spike Meets Negative-Day Exploitation

The Discovery Rate Limit Is Gone

Three independent sources converge on the same structural shift: AI has broken the historical rate limit on vulnerability disclosure, and simultaneously, the Linux Foundation's Jim Zemlin states that mean time to exploit is now measured in 'negative days' — exploits circulate before patches exist. These aren't separate stories. They're the same crisis from opposite ends of the pipeline.

Epoch AI tracked approximately 1,500 high/critical CVEs published by just 21 organizations in June 2026 — 3.5x the previous monthly record — timed to Anthropic's Claude Mythos Preview release. Anthropic's Project Glasswing (with ~50 partners) has surfaced 10,000+ high/critical vulnerabilities. OpenAI's parallel Daybreak initiative runs a competing agentic discovery program. Both treat vulnerability discovery as a platform capability, not a research project.

Anthropic's own admission: the limiting factor has shifted from discovery to verification, disclosure, patch development, and deployment. The bottleneck is now on the defender's side.

Why This Is Worse Than It Looks

The dual-use problem is immediate. The same agentic tooling flooding the defensive disclosure pipeline is available to adversaries running it against your internet-facing applications and open-source dependencies. The Claude Fable 5 jailbreak proved this concretely: Amazon researchers coaxed the model into surfacing exploitable software vulnerabilities, effectively turning a frontier LLM into an on-demand vuln-discovery engine. That capability doesn't disappear because one classifier was deployed.

Meanwhile, the Linux Foundation launched Akrites as a central coordination point for pre-exploit vulnerability response — an implicit admission that the traditional patch-then-exploit timeline has inverted. When your high-severity remediation target is 15 or 30 days, and exploits are public before fixes land, you are conceding a window that has already been closed by the attacker.

Cross-Source Pattern

Sources agree on the diagnosis but reveal different facets. The ML-engineering source provides hard numbers (3.5x, 1,500, 10k+). The DevOps source provides the governance response (Akrites, negative days). The AI-safety source provides the mechanism (jailbreak → vuln surfacing, >99% classifier still leaves ~1% residual). Together they paint a complete picture: the volume is real, the exploitation timeline is compressed, and the defense tooling is catching up but not there yet.

What Changes in Your Program

Your vulnerability management SLAs were calibrated to historical discovery rates. Those rates just tripled. The defensive investment must shift from triage headcount to automated patch deployment and risk-based prioritization (EPSS + asset criticality). Manual triage cannot scale 3x without SLA collapse.

DimensionPre-AI (2025)Post-Mythos (June 2026)
Monthly H/C CVE volume~430 baseline~1,500 (3.5x)
Rate limiterResearcher discovery effortVerification + patch + deploy
Exploit lead timeDays to weeks post-disclosureNegative days (pre-patch)
Attacker toolingManual research/fuzzingSame agentic discovery at scale

What to do

  1. Stress-test your patch pipeline against sustained 3x volume this sprint — identify where SLAs break and which compensating controls (WAF virtual patching, segmentation, runtime detection) can cover the gap

  2. Subscribe to Linux Foundation Akrites advisories and wire into vuln-triage workflow by end of July

  3. Shift vuln-management investment from triage headcount to automated deployment and EPSS-based prioritization this quarter

  4. Red-team external surface against LLM-assisted vulnerability enumeration — validate detection catches automated recon patterns

Shadow AI's Concrete New Wave: Four Threats That Arrived This Week

The Threat Is No Longer Theoretical

Previous briefings flagged Chinese models and shadow AI as emerging risks. This week delivered four named, concrete threats — each with specific properties that defeat existing detection. This isn't trend analysis; these are tools your engineers may already be using.

1. GLM-5.2 (Z.ai): The 'No Kill Switch' Frontier Model

744B parameters (40B active MoE), 1M-token context, MIT-licensed, trained entirely on Huawei silicon with no US chips, wrapped in ZCode — a free agentic dev environment explicitly marketed as regulation-proof. Self-hosted, no vendor telemetry, no API logs. Your DLP tuned for hosted APIs will not see it. The Huawei provenance triggers third-party risk review requirements under most frameworks.

2. LongCat-2.0 (Meituan): Already Running Undetected

A 1.6T-parameter Chinese coding model that topped OpenRouter's developer charts for two months as stealth model 'Owl Alpha' before anyone identified its origin. It beats GPT-5.5 on SWE-bench Pro. This isn't a hypothetical supply-chain risk — it's a demonstrated one. Developers already ran production code through an unidentified Chinese model without knowing.

3. PageAgent (Alibaba): Browser Control via Script Tag

Embeds a browser-controlling AI agent into any webpage with one CDN script tag. Reads live DOM, connects to any OpenAI-compatible endpoint or offline Ollama, and ships a built-in MCP server letting Claude Code/Cursor drive the browser. Every property is a security concern: prompt injection target, CDN supply-chain dependency, privileged bridge to local tooling.

4. Jamie: The Invisible Meeting Recorder

Marketed as 'You join the meeting. The Bot doesn't.' — an AI note-taker that captures meetings without a visible participant, defeating standard recorder-detection. Ships confidential audio to a third-party processor with no visible indicator to other participants.

The common thread: all four produce zero vendor telemetry visible to your SOC. Your detection model assumes API calls, visible participants, or network egress to known endpoints. These tools route around all three.

The Governance Signal

Notably, Alibaba itself banned Anthropic's Claude Code and ordered all Claude models purged from employee machines — a peer enterprise treating a foreign AI coding assistant as an unacceptable data/IP risk. This is the same company shipping PageAgent. The implication: even the vendors building these tools recognize the data-governance risk of someone else's AI in your codebase. Apply the same logic to your own environment.

Stanford's finding that 71.3% of ChatGPT-class queries now run on local models (up from 23.2% in 2023) with 5.3x better intelligence-per-watt confirms this isn't a fringe scenario — capable inference running on-device without cloud API calls is now the majority use case.

Detection Gaps

ToolWhy Your Current Stack Misses ItDetection Approach
GLM-5.2 / ZCodeLocal process, no egress to monitored endpointsEndpoint detection for model-weight files, GPU utilization anomalies
LongCat-2.0Routed through legitimate inference platformsModel-provenance policy, approved-model registry
PageAgentStandard CDN script, no malware signatureCSP allowlists, MCP endpoint inventory
JamieNo visible meeting bot, client-side onlyOAuth grant audit, endpoint process inventory

What to do

  1. Hunt for GLM-5.2, ZCode, LongCat-2.0, and Owl Alpha across endpoints, proxy logs, and package managers by end of this week

  2. Publish an approved-model registry and route all AI inference through a controlled gateway with logging by end of July

  3. Audit OAuth grants in M365/Google Workspace for Jamie, Wispr Flow, Manus, Chat Hub, Claude Cowork, and PageAgent this week

  4. Deploy CSP script allowlists on production web properties to block unauthorized PageAgent-style injections

  5. Issue a shadow-AI directive requiring third-party/supply-chain risk review for any Huawei-silicon-trained or China-origin model before use

The Coming CVSS for Jailbreaks — And Why Your VM Program Needs AI in Scope Now

Prompts Are Becoming CVEs

Anthropic, Amazon, Microsoft, and Google are jointly drafting a CVSS-equivalent scoring system for AI jailbreaks — severity scoring for prompts that compromise model safety or capability boundaries. This formalizes what the Fable 5 incident proved: prompt-based attacks are vulnerabilities with exploitability, impact, and remediation characteristics identical to software CVEs.

The trigger event was specific and well-documented. Amazon researchers discovered a jailbreak against Claude Fable 5 that didn't just produce disallowed text — it coaxed the model into surfacing exploitable software vulnerabilities, effectively weaponizing a frontier model as a vuln-discovery engine. Anthropic's response: pull the model for 19 days under export-control authority, then return it with a classifier catching >99% of attempts plus graceful degradation to Opus 4.8.

A jailbreak against your AI dependency isn't a curiosity — it's a 19-day outage. Model availability is now a BC/DR problem.

What This Means for Your Program

Two immediate implications emerge:

  1. AI models belong in your vulnerability-management inventory. When jailbreak advisories start shipping with severity scores, programs without an intake process will face the same scramble as those caught without a software CVE workflow in the early 2000s. Stand up the intake process now while volume is manageable.
  2. Model dependencies are availability SPOFs. The 19-day Fable 5 outage was caused by a government export-control action, not an attacker. If a critical workflow depends on a single model, you need a tested failover tier. This is DR planning, not security engineering — but it's your risk to own.

The Credential Isolation Principle

A parallel governance norm is crystallizing across multiple sources: keep authentication in the deterministic application layer, never in the probabilistic model layer. AI agents with direct credential access are one prompt-injection away from leaking them via tool-schema exposure or context window extraction. This is the industry catching up to a reality your SOC already understands — but may not have codified for AI deployments.

The architectural rule is simple: the model proposes actions, the application layer authenticates and executes, and never the twain shall meet. Any existing agent/MCP deployment with credentials in prompts, context, or tool schemas is a live exposure.

Preparatory Steps

The CVSS-for-jailbreaks standard doesn't exist yet — but the four organizations drafting it represent every major AI provider and cloud platform. When it ships, it will likely become a compliance expectation within 6-12 months. Programs that build the intake workflow now will absorb it smoothly; those that don't will scramble.

What to do

  1. Add all AI models (vendor-hosted and self-hosted) to your vulnerability-management inventory and assign owners by end of this quarter

  2. Audit existing agent/MCP deployments for credentials in prompts, context, or tool schemas this sprint

  3. Map critical workflows to model dependencies and define failover tiers (secondary model/provider) in BC/DR plans

  4. Watch for the joint Anthropic/Amazon/Microsoft/Google jailbreak-scoring standard publication and plan intake process

The bottom line

AI-powered vulnerability discovery just 3.5x'd the CVE firehose to 1,500 high/critical in a single month while the Linux Foundation admits exploits now ship before patches — your patch pipeline is the bottleneck, not the attacker's research effort — and simultaneously a free 744B Chinese model with 'no kill switch' and a stealth Chinese coding model that ran undetected for two months on a major platform are entering your codebase through paths your DLP cannot see. Re-baseline your vuln-management SLAs for 3x volume this week, hunt for shadow AI models across endpoints today, and accept that AI is now both your biggest vulnerability class and your biggest governance gap.