The Engineer

Why this outran every npm campaign

Agent skill registries sit roughly where package registries sat in 2010. No signing, no provenance attestation, no lockfile, no version pinning, and a ranking algorithm that rewards install velocity. A campaign that starts spreading gets promoted for spreading. The second structural problem is the harder one. A skill is largely natural-language instruction, not code. Dependabot has no manifest to diff. A software-composition scanner has no import graph to walk. Existing supply-chain tooling produces zero coverage here, not partial coverage.

Assume the credentials are already read

A commodity stealer's entire job is one pass over well-known locations: cloud credential files, container registry configs, package registry tokens, kubeconfigs, and dotfiles holding personal access tokens. That pass generates almost no distinguishable telemetry, which is why clean endpoint data tells you nothing here. On a matching host, treat every reachable token as compromised and rotate it. Hunting for confirmation that will never arrive is not a control.

Move the enforcement point into the runtime

The install happens without a pull request, so review cannot be the gate. Four controls, in the order they pay off:

1. Deny-by-default egress from agent namespaces. Allowlist the internal package mirror and approved API endpoints. Blocking arbitrary raw-content and release downloads breaks the second stage regardless of what the model was persuaded to do. The payload has to come from somewhere.
2. Hash-pinned internal skill catalog. Skills enter by PR with a content hash, a named reviewer, and a documented publisher. Agents resolve only from that catalog. External resolution fails closed. This is the lockfile the ecosystem never shipped.
3. Brokered, short-lived credentials. No long-lived tokens in agent container environment variables or dotfiles. OIDC federation to cloud IAM, a sidecar broker for API keys. That is what converts a successful stealer run into a low-value one.
4. Ephemeral per-session sandboxes on a Firecracker-class microVM or a gVisor syscall-interposition boundary. Containers are an isolation convenience, not a boundary against adversarial code. Test the sandbox adversarially before it gets tool access: egress reachability, socket exposure, credential visibility, syscall surface.

The sequencing trap

Rising AI-driven breach costs are generating pressure to ship defensive AI into security operations fast. An autonomous security agent holding broad production credentials with unrestricted egress is the same shape as the thing that just went wrong. Egress control, skill provenance, and brokered credentials land before any agent gets production scope. Otherwise the initial access vector gets funded out of the security budget.

Sourcing caveat: CSO Update's item is a headline-and-teaser digest with no named researchers, no IOCs, and no affected-publisher list. Treat the install count as reported rather than verified. The grep-and-rotate work costs an afternoon and is correct even if that number is later revised.

An AI agent with network egress and a shell is a package manager with no lockfile, no signature check, and no human in the loop.

Why detection had nothing to work with

The injection is the boring half of the chain CSO Update describes. Where the payload lived is the half worth studying. A toolkit stored inside the DBMS and executed through the database's own JVM leaves no binary on disk, and the JVM is a legitimate child of a legitimate process. File-integrity monitoring, endpoint process-tree heuristics, and application allowlisting all miss it by construction, not by evasion. One surface records the behaviour: the database's own audit log, which in most estates is either disabled or never leaves the host.

Every engine you run ships a compute plane

This is not an Oracle story, it is a category. Most teams have three or four instances of the category running with no owner named anywhere.

In your stack

Compare it to the agent-skill campaign one screen up. Both are execution paths that file-based tooling cannot index. In the package world there is a lockfile diff and a CODEOWNERS review. A stored procedure has no external pin concept. The nearest analogue is a code-reviewed migration plus an audit trail, and the review is DDL review at best and absent in practice. That gap is why the same class of attacker keeps landing in the same place.

The remediation is unglamorous and measured in days:

1. Inventory enabled runtimes per instance, not per engine. Two Postgres clusters from the same Terraform module diverge the moment someone runs a one-off extension for a data-science task.
2. Disable what nobody can justify in writing. The written justification is the mechanism. It converts "we might need it" into an owner and a ticket.
3. Ship audit logs off-host to the SIEM and alert on procedure creation or replacement in untrusted languages. An in-database toolkit has to be created before it can run, and that creation is the one event that is actually catchable.

Sourcing caveat: the report names no researchers, no CVE, no affected version, and no indicators. Read it as a design lesson about instances already running in the estate, not as a hunt package. There is nothing here to hunt with.

If your architecture diagram draws the database as a cylinder labelled "storage", it is hiding a compute plane nobody is monitoring.

What a thin adapter actually costs

The provider abstraction is cheap right up until someone asks it to earn its keep. Then prompt caching, provider-native structured output, and tool-use ergonomics all want to surface through the adapter, and each of those leaks spends the portability the adapter was bought for. Keep the interface deliberately thin and expose explicit capability flags instead of pretending providers are fungible. Pinned version strings plus a frozen golden-set eval, meaning a fixed set of inputs with recorded expected behaviour, is what converts "we are locked into a provider" into "we ran the evals Tuesday and switched Thursday."

Why now, stated honestly

The Information reports Anthropic and OpenAI employees holding equity described as "fast-appreciating," with an IPO named as the liquidity mechanism. No filings, no dates, no valuations. Read the mechanism instead of the headline. If a public listing is the stated path, secondaries and tender offers did not absorb cash-out demand. Public reporting imposes a quarterly gross-margin cadence on what has been two years of subsidized inference. Nobody has announced a price change. The direction of the derivative is not ambiguous.

The same reporting flags post-IPO retention loss at both labs as high-severity and likely. Frontier roadmaps sit in unusually small research teams, so churn shows up directly as release cadence. Lumpier, less predictable releases is the base case, not a catastrophe. It does invalidate any design that assumes next quarter's model closes this quarter's quality gap. Ship against measured capability. Roadmap items are unfunded dependencies.

The logging is the sleeper

Structured request lineage is the item most teams skip and most regret: model ID and version, prompt template hash, system prompt version, tool-call trace, token counts, and output, all queryable, with a retention window someone has actually decided on. Without it there is no attributing inference spend per feature, which is the first question asked the day the bill doubles, and no reconstructing which prompt-and-version pair produced a bad answer. Pair it with a cost model rerun at a 2x sensitivity band on cheap and mini tiers, then tag in the architecture doc which features go negative-margin at that price.

What this is not

This is not material for a leadership meeting about imminent model price hikes. The underlying item is roughly 100 words of paywalled teaser with zero quantified magnitudes, and both listings are described as coming rather than filed. Credibility burned on a soft signal is credibility unavailable the week the signal is hard. Pinning, the eval set, and lineage logging are correct on engineering grounds alone, which is exactly why they do not need the market story to justify them.

Every model price you are modelling today is a pre-IPO promotional rate — keep the swap a config change, not a refactor.