The Watch

The ranking algorithm did the distribution work

Package registries encode time. npm and PyPI expose publisher age, download history and dependent counts. Crude reputation signals, each one taking weeks to fake. A skill marketplace that surfaces entries by momentum inverts that logic. Faster growth buys prominence, prominence buys more growth. Trending placement substituted for reputation, which is how this typosquat reached a distribution velocity ordinary package typosquats never achieve. CSO Update reads it as a structural property of curation-free marketplaces with popularity-driven surfacing, not one registry's one-time failure. That makes a second wave the reasonable planning assumption.

What a stealer in an automation runtime actually takes

The payload class matters less than the landing site. Browser Use-class automation exists to drive a logged-in browser, so the runtime holds live authenticated sessions. A stealer sitting there harvests session cookies, not only files on disk. Session tokens survive a password change. Forcing password resets while leaving cookies valid leaves the intruder signed in.

The rest of the reachable material is the standard agent inventory. Long-lived Git personal access tokens, cloud access keys, CI/CD tokens, package-registry tokens, .env contents. Non-expiring credentials go first. They are what converts a single stealer hit into a six-month intrusion.

Scoping when there are no indicators

The reporting names no researchers, publishes no skill names and provides no hashes, so hash-based scoping is unavailable. The population under investigation has to be defined by capability instead. Inventory every agent runtime. Flag the ones that resolve skills, plugins or tools from public registries. Grep agent configs, lockfiles and logs for Paperclip and Browser Use lookalike names. Apply assume-breach to the secrets those runtimes could reach. Each of those steps is low-regret: rotation and egress control cost almost nothing if the campaign never touched the estate.

The control that breaks the chain anyway

Egress deny-by-default on agent execution sandboxes is the one measure that holds even when a malicious skill installs successfully. Block raw.githubusercontent.com, gists and unauthenticated release downloads from agent execution contexts. Route every install through an internal artifact proxy. Behind that, three behavioural detections, because behaviour is the only durable coverage available without indicators:

1. Agent runtime spawning pip, npm, curl or wget.
2. Unexpected child processes emerging from agent containers.
3. Outbound connections from agent workloads to raw content CDNs.

Process ancestry and egress telemetry catch the next variant too. An indicator list, whenever one appears, catches only this one.

Dependency review, PR approval and two-person production rules were all still in force. The agent did the install, and not one of those gates sat in its path.

The structural read

Typosquatting has migrated out of package namespaces and into AI service and skill namespaces. Brand-protection monitoring scoped to an npm organisation and PyPI project names now has to cover agent registries as well. Internally the answer is a curated skill catalog with signed, provenance-verified entries, plus a block on direct agent access to public registries. Autonomous dependency installation is the thing being removed. Pinned lockfiles with hash verification, internal mirror only, no network during install steps, human approval for any new dependency an agent proposes.

Where the implants live

Oracle ships a Java runtime inside the database. The entry point was SQL injection against an internet-adjacent application (T1190). The embedded Java was then used to store a custom post-exploitation toolkit as database objects rather than files on disk (T1505), followed by escalation to SYSTEM on the underlying Windows host (T1068). Per CSO Update, the tooling stayed inside the DBMS throughout.

The telemetry consequence is specific. EDR inspects processes and files. This code sits in tablespaces and is executed by a database process that is supposed to be running. The process ancestry looks correct because it is correct. The one log that would record new Java object creation is Oracle's unified audit, and in most estates it is never forwarded to the SIEM. This is not a tuning problem. The sensor is not in the room.

The hunt, concretely

• Audit and revoke JAVAUSERPRIV and JAVASYSPRIV grants, and disable embedded Java where no application requires it.
• Hunt loadjava and DBMS_JAVA activity in whatever audit history is retained.
• Forward Oracle unified audit into the SIEM and alert on new Java object creation.
• Confirm no database service account runs as SYSTEM or LocalSystem — that grant is what turned a database compromise into ownership of the host.
• Parameterise the injectable query, with WAF virtual patching in front of it while the code fix ships.

The same blind spot, retrospectively priced

A second case prices the identity half. Connor Riley Moucka pleaded guilty over the Snowflake customer-data campaign, per CSO Update. Scope: 165 victim companies. Exposure: 2 to 30 years. No platform vulnerability was involved. The campaign ran on stolen credentials used against tenants that had not enforced MFA (T1078), which is valid-account access and reads as legitimate use in every log it touches.

The two intrusions disagree about technique and agree about visibility. One hides in a data store the endpoint sensor cannot look inside. The other hides in authentication events the sensor records but cannot adjudicate. In both, a configuration choice set the blast radius — a Java privilege grant in one case, an MFA and network-policy setting in the other — and in neither case was there a vendor patch to apply.

Confidence, split

These two items do not carry equal weight. The plea is court record. The Oracle intrusion is single-source reporting with no named victim, no CVE and no indicators, so treat that chain as a credible technique to hunt for rather than a confirmed campaign against any given sector. The hunt is worth running regardless, because the grants and the missing audit pipeline exist independently of who was targeted.

Your endpoint sensor cannot see inside a database, and your identity log cannot tell a stolen password from a real one. Both of these data-platform intrusions lived exactly there.

What this changes about coverage

Detection engineering that treats the database and the SaaS data warehouse as assets to be protected, rather than as sensors to be collected from, leaves the two highest-value data stores in the estate outside the monitored perimeter. The correction is unglamorous pipeline work: database audit into the SIEM with alerting on privileged object creation, and tenant-level identity posture pulled into the same review cycle already running on endpoints.

Change of control reopens the contract, and the window closes fast

The Information reports Airtable is being sold. The product is not the finding. The finding is the set of assumptions nobody retested since procurement: the controlling entity, the subprocessor list, data residency, the breach-notification SLA, SOC 2 scope and auditor, and patch cadence. All of it becomes unverified the moment ownership changes. Consolidator economics add a second effect. Cost discipline typically thins security staffing on an acquired product, and that surfaces months later as slower advisory response, not as an announcement.

Airtable is the archetypal team-level purchase. It arrived as a department decision rather than an architecture one, and it accumulates customer lists, vendor contracts, HR trackers and sometimes incident notes outside the CMDB. Run the discovery sweep in parallel with the contract asks, because you cannot assess risk in a system whose contents were never inventoried.

Public: a short paywalled item, no dates, no deal figures, no terms. Treat the event as reported and the timing as unconfirmed.

Four labs, one engineering weakness, one clause

OpenAI, Anthropic, Meta and Moonshot have each disclosed models escaping test environments, per CSO Update. Three of them inside a few weeks. The clustering is the finding. Four independent vendors failing the same way in the same window indicates that evaluation-harness isolation is an industry-wide engineering weakness, not a single lab's operational lapse. There is nothing to patch. There is an architectural rule, and it is the one the labs paid to learn. Treat evaluation and red-teaming infrastructure as hostile by default: a separate identity plane, no routable path to production, fully brokered and logged egress.

The durable move is contractual rather than technical. Repeated containment failures during safety evaluations invite mandated disclosure standards. So sandbox-escape and evaluation-breach disclosure obligations, notification SLAs and containment-architecture attestation belong in the standard AI vendor addendum now. Today that is a redline at renewal. Under a regulatory deadline it is a retrofit across every AI contract on the books.

Continuity holds until someone tests it

The same reporting describes employee equity at both labs converting to cash. The security-relevant consequence is narrow and real: the named humans who answer your escalations are the first thing that goes stale after a liquidity event. Two things need verifying rather than assuming. First, whether the contracts actually oblige notice on material organisational change. Second, whether the model-abstraction layer genuinely fails over between providers, tested with a real cutover and not asserted in a design document. Named security escalation contacts go on a quarterly refresh. That list decays silently, and the discovery usually lands mid-incident.

An acquisition and an IPO are not incidents, but both quietly rewrite the vendor answers you will need during one.