The Watch

Why nothing in the estate recorded it

The malicious logic executed in the visitor's browser. The origin server returned exactly the HTML it was built to return, and the poisoned code arrived afterward, inside an asset the page was configured to fetch from the vendor. Nothing on the origin changed, so no access log, WAF decision, or file-integrity check on the web root shows a deviation. One class of telemetry can place a malicious script version in front of a real user: the CDN or edge log recording which asset was served. Those are typically the shortest-retained logs in the estate.

The wallet theft is not the operational problem. A vendor's detection date marks the end of an incident, never the beginning. If the poisoned build was live for longer than edge retention, the honest answer to "were our customers affected" is unknown. Unknown is the answer that goes to counsel, to the payments partner, and to any regulator who asks.

The applicable controls are integrity controls, not detections

There is no alert to tune here. What holds is Content Security Policy in enforce mode with a strict script-src allowlist, Subresource Integrity on every static third-party asset, and origin isolation for adtech tags that require dynamic loading and therefore break SRI. A sandboxed iframe or a separate origin, so the tag cannot read or mutate the main document.

One control matters more than all of those and almost nobody runs it. A synthetic check that loads the page the way a customer does and asserts that the rendered wallet address, IBAN, or payment destination matches the value the backend intended. Substitution attacks throw no exception and fail no transaction. They run until someone complains about money.

An address-substitution attack produces no failed transaction. The first evidence is a customer who paid someone else.

The CVSS 10.0 in the same batch, and why it sits outside the SLA

Adobe Campaign Classic is the patch that should move out of band. A perfect score with no user interaction implies a network-reachable, unauthenticated code execution path. Campaign Classic holds customer contact and behavioral data and owns a trusted outbound mail channel, so one compromise yields both a PII store and a way to send mail customers will open. Marketing operations owns the platform in most companies, which is exactly why it is absent from the patch calendar. Take the inventory from marketing directly rather than the CMDB, and pull the CVE and affected build range from Adobe's advisory. The reporting names neither.

Where the sources converge

Techpresso reported AI vendors discovering their own agent escapes months later through retrospective log review. Set that beside this incident and one property repeats across otherwise unrelated stories: the vendor finds the failure, the vendor dates it, and your evidence window is shorter than their dwell time. CSO Update frames that class as a shared-responsibility problem. The Hacker News frames it as third-party script risk. Neither addresses the variable actually under defender control, which is retention. Extending edge and CDN log retention is unglamorous work. It decides whether the next vendor disclosure produces an investigation or a shrug.

Patching is the smaller half

Pre-auth means no credential was required. CSO Update describes a crafted HTTP request against self-hosted JetBrains TeamCity producing arbitrary command execution and credential exposure. Self-hosted CI is trivially fingerprinted from the internet. Earlier TeamCity pre-auth bugs went from disclosure to mass exploitation in days. The working assumption for any server reached before the patch is that the attacker holds every secret it ever stored: VCS tokens, cloud credentials, artifact registry keys, code-signing material, and agent authentication tokens.

Rotation is the incident response. The patch only closes the entry path. Rotation alone has a gap worth naming, because a build configuration is itself a persistence mechanism. A modified build step re-harvests whatever gets rotated on the next pipeline run, and it reads as ordinary CI activity in every log available. So the rotation ships alongside an audit of roughly 30 days of build-config changes and agent registrations, looking for entries nobody can attribute to a named person.

The cloud half has no patch column

Wiz's Azure Cosmos DB finding is the cleaner version of the same lesson. A provider-side logic bug exposed customer database access keys across tenants. The fix took eight months. During that window no customer setting, no scanner, and no patch cycle changed the outcome. Rotating primary and secondary keys is the floor. The durable move is to stop holding the credential class that leaks: set disableLocalAuth, move applications to Entra ID RBAC with managed identities, and put private endpoints or IP firewalling in front of the account.

Then instrument it. Streaming DataPlaneRequests diagnostics into the SIEM with an alert on anomalous read volume turns the next provider-side key bug from a silent cross-tenant read into a failed authentication event that shows up in a queue.

Patching a pre-auth flaw on a build server closes the entry path and does nothing whatsoever about the secrets that already left.

Three exposures, one credential class

Techpresso's guidance to rotate every Hugging Face token and enforce org-wide 2FA is the same instruction aimed at the ML supply chain instead of the build chain. The a16z discussion adds a reason to keep the receipts: with developer liability a live US policy argument, signed build attestations stop being engineering hygiene and start being evidence. Neither report names a CVE, CVSS score, or fixed build for TeamCity. The JetBrains bulletin is the authority before anyone writes the change ticket.

The control you thought you had

Every mainstream control for AI meeting assistants assumes a bot-in-the-meeting architecture: tenant settings that block third-party participants, participant-list review, and training that says look for the banner. All three are inert against capture that happens locally. There is no participant to block, no banner to notice, and the meeting platform never writes an audit event. The admin console reports a clean quarter while the transcripts accumulate somewhere else.

The corroboration is what makes this a category rather than a vendor story. Granola's differentiator is documented as consent-UI evasion, and per the reporting, no one in a Google Meet would know it is being used. A separate tool, Jamie, sells on the same line: you join the meeting, the bot does not. Two independently marketed products, one shared property, and it is the property the policy depends on detecting.

Where the evidence actually lives now

The wrist app is the friction change that matters. Activation effort was the last informal control keeping shadow recording rare, and Granola's own usage data has the watch app beating the iPhone app because, per its co-founder, out of sight means out of mind. The same app handles in-person meetings, which puts the board room, the HR investigation, and the incident-response bridge inside scope as capture surfaces.

The archive is the target, not the app

Model the threat on the artifact. An employee's notetaker account is a structured, searchable corpus of internal meetings: deal terms, roadmap decisions, named individuals, secrets read aloud on calls, and raw audio suitable for voice cloning. That is richer reconnaissance and social-engineering material than the same employee's mailbox, and it sits with a vendor procurement never onboarded. An account-compromise playbook scoped to email and chat closes the case with the highest-yield data store untouched.

The second source sharpens the downstream half. Synthetic voice is now described as practically indistinguishable, and marketplaces are paying people to license their likeness at scale. Meeting audio of executives is training data. The service-desk heuristic of recognizing a familiar voice, and any voiceprint factor still in production, are deprecated controls rather than fallbacks.

Vendor reach has outrun vendor maturity

Granola was founded in 2023 and raised at a $1.5B valuation in March 2026 from Index Ventures and Kleiner Perkins, with headcount roughly quintupled to about 100 people and no security posture disclosed anywhere in the coverage. The user base skews to VCs, founders, and executives, which makes one vendor compromise an aggregation of deal flow and an attractive collection platform for an espionage-motivated actor. The diligence asks are specific: SOC 2 Type II, a DPA, subprocessor disclosure naming which model provider processes the audio and whether it trains on it, retention and deletion controls, residency, and a breach notification SLA.

Prohibition without a sanctioned alternative produces more shadow recording, not less — one governed notetaker with the banner on by default is the floor.