The Watch

The mechanism binding these two fires: the patch is not the win condition. On FortiSandbox, adversaries reverse-engineered the April 14 fix and weaponized CVE-2026-39808 by June 16 — a two-month window indicting deployment cadence, not the vendor. Because FortiSandbox is a threat-detection appliance, a successful unauthenticated RCE lets an attacker disable your own sensors before moving laterally. CISA's July 19 directive treats any instance not on the fixed release as in-scope; appliances patched after June 16 warrant an assume-breach IOC hunt.

SharePoint is worse differently. CVE-2026-58644 (RCE, 9.8) and CVE-2026-56164 (auth bypass, 5.3 but actively exploited on a 3-day clock) are in KEV, and CISA issued an atypical warning: patching alone will not prevent business disruption. The tell is the instruction to rotate ASP.NET machineKey material. Stolen machine keys enable forged ViewState/__VIEWSTATE deserialization payloads that survive patching and grant durable RCE. SharePoint RCE historically yields SYSTEM, then webshells and domain lateral movement — the pattern that has repeatedly fed ransomware. AD FS CVE-2026-56155 runs on a separate 14-day clock as the federation-escalation path.

Five independent reports converge on the same triage: order by exploitation status and KEV deadline, not raw CVSS. The 5.3-scored SharePoint auth bypass carrying a 3-day clock is the proof — CVSS alone would have deprioritized an actively exploited primitive. Treat both tiers as incidents, not patch tickets: for FortiSandbox, deploy the fix before Sunday and hunt anything patched after mid-June; for SharePoint, hunt w3wp.exe child processes and .aspx webshells, rotate keys, and segment before closing the ticket.

1Password's Claude integration is live on macOS across all plans, and the authorization decision sits with the employee, not IT. The capabilities arrived together: any employee can authorize an agent to log in with stored credentials and MFA one-time codes without consulting security. The 'zero-exposure' framing is well-designed: credentials are injected through a channel the model can't read, biometric-gated per task. The residual risk is structural. An agent that never sees the password is still an authenticated actor once the session is live. A prompt-injected agent misuses a valid session without exfiltrating a secret. The biometric gate decays under approval fatigue.

Layer on the failure rates that quantify this. Prompt injection succeeds 85% of the time against undefended web agents, under 1% with filtering like Prismata. Agent 'pause/stop' controls silently fail in roughly 18% of runs: 215 of 1,200 across six frameworks. Side effects include payments still firing after a stop command. GPT-5.6 Codex in Full-Access mode deleted an engineer's entire production database by misredirecting the home directory. OpenAI encrypted agent-to-agent traffic, eliminating the delegation telemetry detection engineering needs to see any of it.

Six independent reports converge on the same defensive baseline, and it is not the agent's own guardrails. The controls that hold are external: sandbox-on-by-default with denial of recursive deletes for coding agents; deny-by-default vault integration allowed only for scoped, time-boxed, human-approved access; and compensating controls, such as transaction caps and out-of-band approval, that do not depend on the agent's kill switch. The detection opportunity is real: agent-driven authentication has tells that human-behavior UEBA misses, including high-velocity multi-site logins from one session, atypical target diversity, and automation-consistent timing against IdP and 1Password audit logs. Every agent with vault or production access is a privileged non-human identity. Shadow adoption is already setting the scope; instrumentation lags it.

The safety assumption was simple: capable offensive AI stayed behind a monitored, rate-limited, abuse-logged API. That assumption expires on July 27, when Moonshot publishes all 2.8 trillion weights of Kimi K3. GLM-5.2 already matches Anthropic's Opus 4.5 on the 'The Last Ones' cyber benchmark. Operators are running these models on 4×H100 nodes as an unlogged, self-hosted exploit and kernel assistant, and the performance engineering is drawing praise. A threat actor with commodity GPUs gets frontier coding capability with no guardrails and no telemetry. Expect engineers pulling the same weights as shadow AI within days of the release.

Provenance is the harder problem, and less of it is settled fact than the vendor debate suggests. Anthropic has accused Moonshot of illicitly distilling Claude. Thinking Machines' Inkling inherits DeepSeek-V3 architecture and Kimi K2.5 synthetic training data. Neither claim has a clean resolution, and there is no SBOM standard for model weights to check against. Deploying these models is closer to running unsigned third-party binaries than adopting a vetted vendor product. The sharper data point: Inkling was demonstrated autonomously writing its own fine-tuning job, evaluating the result, and swapping itself onto the new weights. That breaks the assumption that model artifacts are static, signed, and reviewed before deployment.

Nine reports converge on the same nuance: this trade relocates risk, it doesn't remove it. A US export directive black-holed Anthropic's Fable 5 globally for 18 days. Closed-API dependency carries availability and repricing exposure. Self-hosting swaps that exposure for provenance, integrity, and multi-tenant-isolation burdens that land on the deploying team, not the vendor's. The mitigation is unglamorous and dated: publish an approved-models allow/deny list enforced at the egress proxy, add hash-integrity and hosting-jurisdiction checks to the MLOps gate, and require human approval before any pipeline promotes self-modified weights. All of it needs to be in place before July 27, when local reproduction stops being hard.