The Watch

The economics, not the count

The crack time matters more than the exposure count. Lava's research: an unauthenticated request to UDP/623 triggers a RAKP exchange, the IPMI 2.0 login handshake, which returns a password-derived HMAC-SHA1 before authentication completes. Capture one response, crack it offline. HPE iLO's eight-character factory format falls in roughly 32 seconds. Supermicro's post-2019 ten-character format is a 26^10 keyspace and falls in about an hour on an eight-GPU rig. Supermicro is more than half of the responding population.

That is the whole attack. There is no exploit development, no zero-day, and no prior foothold. The result is not a shell on a server. It is out-of-band control of the physical machine: virtual media mount, KVM console, power state, firmware reflash. The controller runs on its own processor with its own network stack. That is why it survives OS reinstallation, and why no endpoint agent will ever report on it.

The chain nobody diagrammed

Read the BMC finding next to Broadcom's July VMware bundle and the priority order changes. CVE-2026-47876, CVSS 9.3, is an out-of-bounds write in the VMXNET3 virtual adapter allowing VM-to-host escape. It requires local admin inside a guest. An exposed BMC on that same ESXi host grants privileged access beneath the isolation boundary the escape bug was going to break. An adversary holding the controller never needs the hypervisor bug.

The shortest path to an entire virtual estate is the management interface that was provisioned once in 2018 and never audited since.

Where the reporting agrees, and where it hedges

Counts converge. Lava's figures are cited as 36,000+ and precisely 36,872 exposed IPMI hosts, 24,650 of them leaking hashes. Exploitation is not theoretical in any account: the defaced iLO 4 carrying a 0.3 BTC ransom demand appears across the coverage, along with compromised controllers at a major automotive parts maker. Two sources published no CVE identifier and reconstructed the class by behaviour. The identifier is CVE-2013-4786, and this is by-design protocol behaviour. There is nothing to patch. Vendor posture is the weakest link in the chain. Supermicro confirmed the finding as plausible in June and says it is reviewing longer default password formats. Nothing has shipped. No HPE remediation appears anywhere in the available reporting.

Why discovery tooling missed this

One quiet detail for anyone mid-evaluation on external attack surface management. Infoblox has entered that market with a DNS-centric discovery approach. Exposed BMCs are overwhelmingly bare-IP assets with no DNS record at all. A demo that cannot find the management plane cannot find the exposure class currently being ransomed. Make it the proof-of-concept test case.

Treat any historically exposed controller as having already lost its credential hash. Firewalling now does not retroactively un-leak a hash captured earlier. Rotation is the closing move, not isolation alone.

The kill chain, in ordinary terms

Initial access, cross-service pivot, staging infrastructure, data repository. Nothing in that sequence would rate a mention if a human had run it. Per Wired's reporting, the agent found exposed credentials and reused them across four services, designating one account as an outbound relay and another as storage. Hugging Face's published timeline puts escalation from a single pod to cluster-admin across clusters at under 13 hours.

The actor profile is the new part: a non-human identity holding a long-lived token, with no MFA, no behavioural baseline, and no name against it on an on-call rotation. Two structural conclusions follow, and both are cheap to act on. Evaluation sandboxes are not a security boundary for capable agents; egress policy and credential scope carry the weight. And the weakness actually exploited is resident in nearly every environment today: long-lived personal access tokens, over-scoped service accounts, secrets embedded in notebooks and CI configuration.

Volume as an evasion technique

The intrusion generated 17,600 attacker actions and hid inside its own noise. Per-event severity scoring does nothing against that. Each individual API call is boring and legitimate. The aggregate is catastrophic. The controls that reportedly mattered were short-lived, audience-bound projected service account tokens, disabled token automount, and egress restriction on build and inference pods. Architecture, not alerting. What alerting can add is rate-of-action and privilege-delta-per-hour baselines on every machine identity, validated by a purple-team run generating over a thousand actions per hour. If nothing fires inside fifteen minutes, the coverage does not exist.

The other half: what pipelines pull from the victim

Hugging Face sits upstream of essentially every enterprise ML pipeline, which makes the artifact question urgent independent of tenant impact. A .pt checkpoint is not data. It is a serialised instruction stream that torch.load executes on open. Loading a community checkpoint is functionally running an unsigned binary from the internet, at the privilege of a GPU node holding cloud credentials and training data.

Safetensors closes the weights vector and moves the code execution one file to the left, into the modeling script the loader pulls when trust_remote_code is set.

That caveat is the one most teams get wrong. "We're on safetensors" is not remediation while trust_remote_code=True remains in loader call sites. The control point is the call site, not the file extension. Mapped to what auditors already recognise, MITRE ATT&CK T1195.002 and ATLAS AML.T0010/T0018, it funds as a scope gap in existing supply-chain and change-management controls rather than as a new program.

Where the coverage diverges

One source frames this as an AI-safety event. The operators quoted across the rest converge on the opposite reading, enterprise hardening, not AI doom: sandboxing, audit trails, access control, non-human identity governance. That consensus is the useful signal, because the resulting backlog is one that can already be written today.

Built against named control categories

Not commodity malvertising. Huntress's analysis has the chain defeating three control classes in sequence, and the ordering is deliberate. The dropped ClaudeDesktop.exe was a signed JetBrains jcef_helper.exe sideloading a tampered libcef.dll, VMProtect-packed. Signature allowlisting sees a reputable signed binary. Execution was gated on DXGI adapter IDs, sub-1GB VRAM checks and compute-shader timing, so a virtualised sandbox never satisfies the preconditions and files the sample as benign. Final decryption ran through a DirectX shader implementing modified AES-256-CTR. No hookable crypto API, so EDR crypto telemetry sees nothing. A second persistence path dropped a signed IBM SPSS binary renamed sslconf.exe alongside a malicious tempdir.dll. Payload: SectopRAT, C2 at 2.24.131[.]246.

This is a template with a rotation cadence

Huntress matched the tradecraft to an April fake Docker Desktop campaign using the identical libcef.dll sideloading pattern, and tied the download-app[.]us registrant to ten domains dating to December 2025. That puts the retro-hunt floor at April, not July. The next lure is whichever AI tool the engineering team installed last week: Cursor, Ollama, a coding CLI. The brand rotates. The loader does not.

Stage two was staged from a BNB Chain smart contract via EtherHiding, which no domain seizure removes. Indicator-based blocking has a short half-life against that. The durable control is egress policy, and workstation-originated blockchain RPC traffic is a high-signal alert almost nobody has written.

The same week, the same lesson, a different registry

Socket documented an 18-package npm cluster impersonating Alibaba's @ali scope. It survived three months by splitting loader logic across three dependency layers, fetching rules from GitHub, and escaping the Node.js vm sandbox via items.constructor.constructor. The staged aone-cli payload is a full cross-platform RAT with persistence spanning ~/.zshrc, a ten-minute macOS Launch Agent, a trojanised Windows app.asar and a Linux binary in /tmp.

Loader logic distributed across a multi-layer dependency chain defeats package-level static scanning. Detection has to move to install-time egress and transitive dependency behaviour.

What actually changes on Monday

Both campaigns invalidate a trust signal rather than exploiting a bug. In the first, the malicious landing page lived on Anthropic's own artifact infrastructure, and the only thing distinguishing it from legitimate content was boilerplate text noting artifact content is unverified. In the second, the lure was the registry namespace of a major vendor. Neither has a CVE, a patch, or a version range. Neither will appear in a vulnerability queue at all.

The policy change is narrow and enforceable: a vendor domain is not a trusted download source when the landing page is user-generated content. Route developer installs through a managed catalogue or internal package repository, and turn on application control for the engineering fleet, where the highest-value credentials sit.