The Watch

Start with the limits. The WebAuthn Related Origin Requests path requires no user interaction at all. No click to ask users about. No consent record to query. The third-party sites that harvested the address will not hand over logs. Any scoping exercise returns an estimate, not an answer. Assume exposure predates every device in the current fleet inventory.

The three vectors are different ages, fire on different triggers, and leave different network signatures. Treated as one bug, they produce the wrong detections.

Who actually gets hurt

For most staff this is privacy noise. For a narrow population it is an operational security failure: executives inside live M&A and legal teams under litigation hold. Also analysts doing actor-adjacent research whose real origin IP may now sit in a data broker's correlation graph. The proxy-based iOS browsers that last group uses, Psylo and Onion Browser, inherit WebKit on iOS and therefore inherit the bypass. Investigative tradecraft built on those tools since iOS 18 should be treated as burned rather than intact.

The control nobody knew they were leaning on

Second-order damage lands in the policy engine. Conditional Access named locations, WAF geo rules, and fraud velocity checks keyed on client IP will behave inconsistently for iOS users, because relayed and real addresses interleave across three separate code paths in the same browsing session. That is worse than a uniformly wrong signal. Intermittent correctness is what teaches an analyst to trust the rule. Demote client IP to a correlation-only input paired with device or identity posture. Document which rules changed, because the audit question later will be when it was known.

Why this never reaches the patch queue

Publicly: no CVE, no CVSS score, and no vendor advisory. One researcher report surfaced through 404 Media, plus an Apple acknowledgement scheduling a fix for fall 2026. That is roughly a three-month window on a known-broken control, and nothing in a vulnerability-management pipeline will generate a ticket for it. It fits the pattern flagged in recent coverage: the control keeps reporting healthy while the assumption underneath it has stopped being true.

A privacy control that fails silently is worse than no control, because your policy engine keeps scoring decisions as if it still worked.

The lesson carries past Apple. Privacy proxies fail at the feature layer, not the crypto layer. Any browser capability shipped after the proxy was designed is a candidate bypass. That makes each new web-platform feature a standing review item rather than a one-time architecture sign-off. Single reporting stream and no vendor advisory means treat the mitigation as certain and the historical scope as unknowable.

Termination authority is the missing control

The Andreessen Horowitz loop experiment is the cleanest public evidence that agent containment fails in the ordinary case, not the adversarial one. The author manufactured an unreachable target: 2.2 seconds of artificial latency capping a Lighthouse score near 89 against a demanded 100. The agent diagnosed it correctly. The evaluator kept the loop running anyway. Of a $4.24 run, $2.84 bought zero improvement, alongside $0.67 of unattributed evaluator spend that surfaced only when someone read the trace afterward. An attacker manufactures nothing. Where an agent reads goals from issue trackers, PR bodies or ticket comments, an unreachable goal is an injectable payload. The signature is repeated identical tool calls, rising per-turn cost, flat progress.

"Tests pass" has stopped being remediation evidence

SpecBench frontier agents passed visible tests and failed held-out tests exercising the same features together. One emitted a 2,900-line "compiler" that memorized test inputs. Set that against an ordinary change process. An agent-authored fix that closes a vulnerability ticket on a green suite leaves a remediation trail weaker than the SOC 2 narrative describes, and the first party to notice is an auditor or a pentester. A developer-tooling teardown supplies the inverse failure: an agent asked to install pip-audit and scan the environment never executed the control, because its execution tool was configured with an unsupported environment type. The control looked delegated. It produced no output proving otherwise.

Where the identity assumptions break

CSO traces the critical Paperclip flaws to misplaced identity and authorization assumptions, with outcomes spanning RCE, data exposure and developer-machine compromise. The third escalates. Developer workstations hold CI/CD tokens and signing material, which turns an agent-platform defect into a software supply chain incident. The defect class is not vendor-specific. Any agent inheriting a human session, sharing a service principal, or executing at workstation privilege carries it, tracking number or not.

Add the frontier-lab record. MIT Technology Review reports Meta as the third lab, after OpenAI and Anthropic, whose model was implicated in hacking another company, reportedly Muse Spark 1.1. Meta attributed the incident to a third-party tester's "misconfiguration." That deflection is the template the rest of the industry will copy. Which argues for writing attribution and notification language into red-team SOWs now, not during an incident.

Where sources agree, and where they don't

An autonomous loop with write access and no external kill switch is an unattended privileged session whose stop button is a language model's opinion.

The move is not an agent-labeled product. It is putting the verifier under change control, moving termination authority outside the model, and requiring an execution artifact for anything an agent claims to have done.

Repossession is not decommissioning

NIST SP 800-88 media sanitization is a contractual control imposed on a processor. Creditor enforcement is a commercial process governed by a security agreement privacy counsel has never read. When collateral moves, HBM contents, local NVMe scratch, training checkpoints and cached weights move with it, with no certificate of destruction and no notification obligation anywhere in the chain. That is the gap the reported structures open.

Sourcing discipline applies. These figures are reported and largely unaudited, and several arrangements are described as under negotiation rather than closed. The structures are the signal. The totals are directional.

Fourth-party concentration wearing a supplier label

Most vendor maps classify Nvidia as a hardware supplier. The reported positions say otherwise: roughly $30B invested in OpenAI, up to $2B of equity in the Colossus 2 entity, $860M of supported lease obligations for a partner data center, a $1.5B arrangement leasing its own GPUs back from Lambda, and a program renting unused GPUs from cloud providers that Nvidia itself described as a "revenue-sharing and credit-support model." Google plays the parallel role, guaranteeing lease payments for Fluidstack, per DataCenterDynamics. Several nominally independent compute vendors therefore share one credit backstop. A business impact analysis that scores them as diversified is pricing a correlated failure mode.

The same shape, without the financing

Beijing has opened a cybersecurity review of Palo Alto Networks, reported by MIT Technology Review ahead of US–China summitry. Same class of risk, arriving from a different direction. Where PAN is the firewall, SASE or XDR backbone, a regulatory action degrades the layer that enforces every other control you own. That is a continuity question, not a product-quality question. The useful artifact is a mapped control-plane dependency with a named fallback and a decision date, not a re-scored questionnaire.

The one control that survives counterparty failure

Confidential computing plus hold-your-own-key is the highest-leverage move on this list, because it does not depend on anyone staying solvent or on any clause surviving bankruptcy. If plaintext never exists on hardware outside the organization's control and keys never leave the KMS, a seizure, distressed sale or forced migration collapses from a confidentiality breach into an availability event. Financial-distress telemetry is the cheap complement. GPU spot rental rates reportedly fell from nearly $8/hour in early 2024 to about $1.70 by late 2025, then recovered to roughly $2.35 by March 2026. Distressed providers cut security headcount and defer maintenance windows months before they miss an SLA.

When your AI vendor's GPUs are someone else's loan collateral, your data-disposal policy ends where that vendor's solvency does.