The Engineer

Why the tradecraft moved into the live process

Chrome's app-bound encryption made lifting the SQLite cookie store off disk materially harder. So the technique moved to where the plaintext already sits: the running browser. The DevTools Protocol is a WebSocket control plane over the whole browser instance. Target.getTargets enumerates tabs. Network.getAllCookies returns cookies including HttpOnly, and Runtime.evaluate executes JavaScript in the security context of an origin the user already authenticated to. Nothing decrypts, so nothing prompts.

That makes this a session-management failure, not an endpoint one. Single sign-on and MFA gate the transition from anonymous to authenticated. They hold no opinion about a session that is already open, or about a second local process that speaks the browser's own control protocol.

Detection is behavioral, because the protocol is legitimate

Puppeteer, Playwright, and Selenium's CDP bridge do exactly this, routinely, inside the test pipeline. No protocol-level field distinguishes a scraper from an operator, per The Hacker News. There is nothing in the wire format to filter on, so the signal has to come from context: which process launched the browser, with which flags, into which profile directory, and whether anything is listening on a debug port that is not bound to loopback.

• Alert on any non-loopback listener on 9222/9229-style ports.
• Alert on DevToolsActivePort appearing in an unexpected profile directory.
• Push the enterprise policy RemoteDebuggingAllowed=false to managed endpoints.
• In CI and scraping services, prefer --remote-debugging-pipe to a TCP port; where a port is unavoidable, bind 127.0.0.1 explicitly.

The Mac fleet is the same shape

macOS Screen Sharing is screensharingd behind ARD/VNC on TCP 5900 and TCP/UDP 3283. It ships off by default. It gets switched on, then port-forwarded, by the people who run Macs headless: colo minis, EC2 mac instances, MacStadium boxes, self-hosted runners doing iOS builds. The Netherlands NCSC reports active exploitation of a patched flaw on internet-exposed Macs, with a Monero miner as the payload. The CVE is not named in the available reporting, so read Apple's security release notes before writing the ticket description.

Cryptojacking is the rational monetization of a machine somebody else pays the CPU bill on, and that sets the detection order. Sustained CPU above 80% during idle windows, week-over-week build-duration regression, and Mac instance-hour spend anomalies all land before any malware verdict does. Block stratum ports and known pool DNS at egress while in there.

Where the two threads agree

Four of the six active items in the threat reporting reviewed here are abuse of legitimate functionality rather than memory corruption: a debug protocol, a remote-desktop daemon, the domain expiry lifecycle, and code-signing trust. None has a patch as its primary fix. The harness research summarized by CSO arrives at the same place from the agent side. The privileges sit in the ordinary code and configuration wrapped around the interesting component, and nobody monitors that layer because it reads as plumbing.

MFA protects the login. Nothing in your stack protects the session, and the tooling that steals it is the same CDP your test pipeline already speaks.

The durable fix is bounded session lifetime, not another blocked port. Scope which admin consoles, cloud-provider logins, and internal SaaS sessions currently survive a raw cookie export, then investigate device-bound session credentials and short-TTL-with-rebind for the ones that do. Port closure buys time. Session binding is what makes the next variant of this technique boring.

React's cheap re-render has no prompt equivalent

React re-executes a component cheaply because reconciliation diffs a virtual DOM before anything touches the browser's render tree. Prompts get no equivalent free step. Tool and skill definitions normally sit in the stable prefix of the context window, and the stable prefix is exactly what provider-side prompt caching keys on. The canonical use case described at launch is a support agent that attaches an account-management tool after the user is verified. That mutates the prefix mid-conversation. Every cached prefix downstream of the mutation is invalidated.

This is inference, not a published benchmark. Latent.Space's launch coverage contains no performance data at all. The direction is still mechanical. The ergonomic win of dynamic attachment gets paid for in input tokens and time-to-first-token on long sessions, which is the exact workload profile of the support and triage bots cited as the motivating case.

Conditional hooks are the crux nobody has answered

React forbids conditional hook calls because stable call order is what gives a hook its identity across renders. Flue's headline capability is the inverse: useTool() appears only once the user is verified. So identity is keyed rather than positional, or a per-turn reconciliation is doing something callers do not control directly. That mechanism decides whether hook state survives a turn where the hook is absent, whether re-attaching a tool resets its state, and how a misbehaving agent gets debugged under load. Encoding business rules in hook conditionals before those answers exist buys an undebuggable state machine.

The tool list looks like an authorization boundary. It is not.

This is where the two independent threads meet. The harness research summarized by CSO locates agent compromise in the surrounding code rather than in the model: output parsing, tool dispatch, credential handling, network egress. Read alongside verify-then-attach, the conclusion holds. Tool visibility is prompt shaping, influenced by state the model can reach, and it is being used to express a privilege-escalation flow in framework code. Every privileged tool needs a server-side authorization check against an identity claim the model cannot manufacture. The hook gate is defense in depth and nothing more.

The topology finding is the most portable insight here

Flue v1 imported web-framework conventions, file-based routing included, one agent per file. v2 threw that out in under three months. Schott's stated reason is that the larger customers run one agent for the whole company and do not care about routing. Teams that decomposed agents along request-shaped boundaries did so because that is how their web services are organized. The biggest production users of this pattern just reported that is the wrong seam. Decomposition belongs on context ownership, with subagents used for isolation. Same argument as modular monolith versus microservices, same answer at most scales.

Where the lock-in actually lives

Vercel's eve is named as the most directly competitive built-in-harness bet. The AI SDK, Cloudflare's own Agents SDK, and Mastra are retrofitting harnesses now. Flue 2 is one week old at first stable and reversed its core abstraction three months in. Prototype it, wrap it, pin it. Then write skill and tool definitions behind an adapter interface you own, because that seam is cheap this month and expensive after 40% of the agent logic is written against one framework's subagent semantics.

Two disclosures, one machine

A researcher using the handle Nightmare Eclipse published a proof of concept that bypasses a Microsoft Defender patch and escalates from any access level to SYSTEM, per CSO's reporting. It shipped with no coordinated fix window, in the middle of a months-long feud between researchers, so there is no vendor timeline to schedule against. Separately, Mustang Panda — also tracked as HoneyMyte — is shipping a signed Windows kernel-mode rootkit alongside an updated CoolClient backdoor, per The Hacker News. Work backward from the mechanism: a signed driver loading on an otherwise healthy host means a valid code-signing certificate is in adversary hands. The kernel did its job. The trust anchor was already wrong.

On a laptop with no standing privilege, neither item changes the week. On the one class of Windows host whose job is executing code it did not write, they compose into something worse than an endpoint incident.

This is a supply-chain compromise in an endpoint-incident costume

Runners outrank laptops here on blast radius per compromise. A developer machine yields one identity. A runner yields the artifact everyone downstream trusts, and it does so without touching any of the review gates built for source code. That is the invisible constraint: the gates inspect commits, not build hosts. Ephemeral runners plus federated short-lived credentials mitigate this class independently of whether Microsoft's patch holds, which is the property that matters when the disclosure arrived with no coordinated fix window.

A patch bypass on the endpoint agent is only a severity-medium story until you notice which of your hosts runs strangers' code for a living.

Confirm rather than assume

The proof of concept defeats a patch rather than an unpatched build. So a dashboard reading "remediated" may be describing the earlier fix and still be technically honest. Read the installed build directly on the hosts that matter. Treat "we applied that one already" as a hypothesis until a version string says otherwise. No CVE identifier appears in the available reporting, which is itself a reason to verify against Microsoft's advisory rather than a summary.

The systemic exposure in the rootkit story is not this particular actor. It is that code-signing trust has no fast revocation path. Revocation is the missing primitive, which is why signing keys belong in a KMS with short-lived credentials rather than on any machine that also runs a build.