The Watch

The mechanic matters more than the payload. A GitHub identity sat quiet for nineteen months, long enough to age past reputation heuristics and dependency-trust checks, then published a one-click mass-exploitation kit for a Progress/Kemp LoadMaster RCE. Read that as deliberate trust-banking. The account looks legitimate to maintainers, scanners, and hurried reviewers. Once the tooling is public, the disclosure-to-scanning window collapses to hours.

The target is the point. LoadMaster is a load balancer, and Ubiquiti's freshly-patched seven critical UniFi flaws (RCE, privilege escalation, unauthorized device changes) sit in the same tier. Edge gear lives below endpoint telemetry. Own a balancer or gateway and you get traffic manipulation and credential interception. Your EDR sees none of it. That is the blind spot behind slow, quiet intrusions.

The third-party-edge trap

Owned inventory is the easy part. The harder exposure is LoadMaster instances in vendor and partner edge stacks fronting services being consumed downstream. A mass-exploitation kit does not distinguish one ASN from a supplier's. A compromised upstream balancer routing that traffic is an incident regardless of who owns the box.

A dormant account is a loaded position. It waits until the exploit is worth firing.

Caveat: confirm exact CVE identifiers and fixed versions against Progress and Ubiquiti bulletins before closing tickets — curated intel is a pointer, not the primary advisory.

Past the model-release noise, one architectural pattern: AI tooling is inserting high-privilege, credential-rich infrastructure through channels that skip security review. Three data points, one shape.

First, inline LLM routing proxies like Plano (Katanemo). Sold as cost optimization — prompt caching cuts repeat-input cost ~90%, session pinning claims a 2x usage drop — it is architecturally a sanctioned man-in-the-middle: it terminates and re-issues every agent→model call, holds credentials for all downstream providers, and sees full prompt/response content in cleartext. Its guardrail filter shares the same YAML config as cost routing; whoever edits that file can silently disable prompt-injection filtering or reroute traffic to a hostile endpoint with zero application-layer signal.

Second, the agent-skill supply chain. Skills install with one `npx skills add` off the open agentskills.io spec. NVIDIA signs its 110+ skills against a trust anchor and scans for hidden instructions and prompt injection — when the vendor bakes injection-scanning into the distribution channel, that channel is a confirmed attack vector (T1195, T1059). Unsigned third-party skills ride the identical path with no guardrails.

Third, Ollama in 85% of the Fortune 500 — 8.9M monthly developers behind a 14-person vendor: unmanaged local inference on endpoints and servers, not in CMDB, no patch cadence, no egress monitoring.

The compounding chain

Not three separate problems. An injected skill, inside an autonomous computer-use agent, reaching a free external API, is a complete exfiltration chain with no CVE, no patch, and no vendor to notify — every link working as designed. Sources agree: enterprise-scale governance for long-running agents does not exist yet.

You are being asked to install a component that holds every model API key and reads every prompt — treat it like an API gateway, not a dev convenience.

The escalation this cycle: shadow AI stopped being a hypothetical egress worry and produced a concrete, irreversible exposure. xAI reportedly trained Grok 4.5 on the 'entire data from Cursor' — trillions of tokens of developer interaction. If your engineers use Cursor, the blunt question is whether your proprietary source, secrets patterns, and architecture are now encoded in a competitor's model weights. Unlike a rotatable credential, data absorbed into weights cannot be recalled — you are scoping damage, not preventing it.

The adoption mechanism is the other half. Tesla mandated internal Grok usage by staff memo — AI now arrives as executive mandate, not procurement request, skipping the security and privacy review that gates any new data processor. Compounding it: 12+ no-credit-card free LLM APIs (Groq, Cerebras, OpenRouter, Hugging Face, Cloudflare, Gemini, Mistral, Cohere, Zhipu), $2/$6 subsidized Grok pricing, and Meta's $20 credits. Subsidized pricing is customer acquisition; the data-handling terms are what you're actually accepting.

Where the sources converge

Three signals, one direction: subsidized models flooding dev pipelines, executive mandates bypassing review, free endpoints removing the procurement gate. The MCP Atlas score of 88.1 shows vendors optimizing models to invoke external tools autonomously — the leading indicator for injection-to-execution through agent interfaces, a threat class most SOCs cannot detect.

No patch un-trains a model — if your code went into Cursor, governance today is damage control, not prevention.

Contrast worth holding: JPMorgan is deploying SambaNova for on-prem inference — the regulated-industry counter-move keeps inference inside the perimeter.

Disciplined TPRM treats governance instability and supply-chain concentration as leading indicators of control-environment weakness — the kind that degrades a vendor's SOC 2 and PCI-DSS reliability long before an audit finding surfaces. Two vendors likely in your stack just tripped those indicators.

Fiserv — a $26.9B payments/fintech backbone under thousands of banks and enterprises — lost its President (Suryadevara, resigned after 7 months) and CEO (gone after ~1 year) inside one month. A leadership vacuum at a payment processor disrupts security-investment continuity and attestation ownership precisely where you need it most; exposure extends to any downstream processor on Fiserv rails.

Bloom Energy — on-site power for data-center and critical-facility deployments — faces allegations of concealed Chinese scandium reliance, uninvoiced revenue, and 74% related-party revenue, on its 4th CFO in two years. If Bloom fuel cells sit in any facility resilience plan, the scandium dependency is a geopolitical single point of failure against physical power.

The pattern behind the specifics

Both sit inside an abnormal one-week cluster of CFO and Chief Accounting Officer exits (Adient, Angi's CAO gone after 3 months, Quaker Chemical, Natera, Eos, Veraxa, Trump Media). Short-tenure accounting-officer departures are a well-worn precursor to audit findings.

When a payments backbone loses its CEO and President in a month, that's not stock gossip — it's a control-environment warning your TPRM should act on before the next audit does.

Caveat: short-seller allegations and disclosed resignations, not confirmed incidents — risk-scoring inputs, not proof.