The Watch

The finding with no identifier at all

A public proof-of-concept exists for the Log4j2 serialized-event receiver. Per Matt Johansen's reporting there is no CVE, no fixed release, and Apache treats it as hardening rather than a vulnerability. Exploitation requires four conditions at once: a specific listener running, an untrusted reachable peer, a gadget library present, and no JVM-level deserialization filter. Ordinary logging never touches that path. The result cuts both ways, because finding log4j-core in an SBOM proves nothing about exposure and every CVE-keyed tool in the stack scores this finding at exactly zero.

The Next.js disclosure is the same failure at the other end of the funnel. A real pre-auth remote code execution class, remediated, that reached engineering as version numbers instead of advisory data. Prior art exists for what that layer costs when it goes wrong. CVE-2025-29927, the Next.js middleware authorization bypass via the x-middleware-subrequest header, carried CVSS 9.1. One trusted internal header defeated middleware-based auth. Middleware is where authorization lives, and ambiguity there is a security problem, not a developer-experience complaint.

Where the evidence agrees, and where it cuts against itself

Root Evidence's dataset counts 3,769 exploited CVEs against 253,912 published since 2018. Adversaries never touched 98.5% of them. That figure is sponsored content and depends on "confirmed" exploitation reporting, which structurally undercounts, so treat it as directional. The argument that volume is noise and reachability is signal holds. It also argues against the trigger most teams actually use, because confirmation of exploitation lags exploitation itself.

Executive Offense supplies the other half. Aikido Security, working with researcher Philippe Dourassov, burned 11.7 billion tokens putting ten models against 32 freshly disclosed CVEs, three runs each. DeepSeek V4 Pro, open weights and downloadable, rediscovered 28 of 32, ahead of Opus 5, Grok 4.6 and Claude Sol. Read the two datasets together and the operating rule changes: absence of a public exploit is now a statement about the public internet, not about adversary capability.

A vulnerability without a CVE ID scores zero in every tool you own, and "no public PoC yet" is now a measurement of disclosure practice rather than of risk.

The number that dates your containment SLA

CyberScoop's coverage of Unit 42 research documents an attacker running an agentic framework against 50 applications in under 10 hours. The same work took roughly ten days pre-AI. That is a ~24x compression, which puts a full-portfolio exploitation sweep inside a single shift handoff. The translation is narrow and testable: any asset tier where measured mean time to contain exceeds ten hours is a documented, board-reportable gap. The Batch's data supplies the counterweight, since exploit weaponization scores still trail discovery scores badly, so the immediate pressure lands on remediation throughput rather than novel-exploit defense.

The retro-hunt shape for pre-auth RCE

Assume a window between disclosure and patch. Pre-auth means there is no failed-login trail to correlate on, so process and egress telemetry from server-rendering hosts is the only signal: unexpected child processes, anomalous outbound connections, new files in writable application directories.

The systemic fix is one line of scanning scope. If coverage stops at OS packages and container base images and never reads package.json or a lockfile, the highest-value pre-auth attack surface is invisible to the program that exists to find it.

The chain is four steps and needs no malware

A local inference server binds to loopback and accepts API calls with no authentication, on the industry-wide assumption that localhost is unreachable. An attacker-controlled page, visited rather than installed, serves a hostname with a short DNS TTL, then rebinds it to 127.0.0.1. The browser now treats requests to the local API as same-origin with the attacker's domain, and CORS allowlists hold no line because the Host header still reads as the attacker's site. From there the attacker writes into the agent's memory store. Computerworld's account describes instructions that persist across future conversations.

For the detection backlog: T1189 for initial access, unauthenticated local API abuse for execution, poisoned agent memory for persistence. What the chain leaves behind is an ordinary HTTP request to a listening service and a write to a data store. Sourcing caveat worth stating: the vendor-specific reporting carries a headline and dek only, with no CVE, no CVSS and no advisory. The flaw class, unauthenticated loopback service plus rebinding, is generic and reproducible regardless.

Same host, same missing boundary

• Delegated live sessions. Nous Research's Hermes Agent browses using a managed copy of the user's real Chrome profile and logins, per AINews. Credential-theft controls assume the attacker has to steal something. Here the user volunteers the profile. Conditional access sees a valid, unexpired, MFA-satisfied token (T1539, T1550.004), and there is no app registration in your tenant to revoke.
• Pooled credentials. Unwind AI describes Munder Difflin, an open-source harness wrapping Claude Code, Codex, Gemini CLI, Kimi, Grok and OpenCode with shared memory, explicitly running on the subscriptions and API keys the user already holds, with state kept locally. One unaudited process becomes the aggregation point for six vendor credentials and six shell-capable agents.
• Entitlements nobody granted deliberately. In ben's bites' field log, an agent driving a logged-in Chrome session added a domain and rewrote DNS records at the registrar from a single natural-language instruction. Blast radius: wildcard TLS via ACME DNS-01, MX rewrite into mail interception into SaaS account-recovery takeover, and SPF/DKIM/DMARC collapse (T1584.001).

Daily Dose of Data Science adds the install curve: an agent runtime advertising one command on macOS or Linux, no Docker required, whose core function is writing and executing generated code against local files. The absence of isolation is the marketed feature, and engineers will read it as permission.

The one detection that is already free

The Claude Code cache fix, tool definitions re-rendering after OAuth token refreshes roughly hourly, was reported as a cost story. Read as architecture disclosure, it confirms that long-running agent sessions hold refreshable OAuth material locally on a predictable cadence. Predictable cadence is what detection engineering wants. It baselines in identity-provider sign-in logs, and an agent-associated refresh from an unexpected ASN, geography or hour becomes the alert.

Localhost stopped being a security boundary the moment agents started listening on it. The write survives the tab close and surfaces in later conversations, which is exactly where session-scoped incident response stops looking.

Where the sources pull in different directions: Oren Ellenbogen's decomposition of the agent harness into system prompt, planning tool, file system and subagents argues the real control point is architectural and needs a named owner and a written threat model. Computerworld's chain argues one resolver setting breaks the attack today. The resolver setting closes the attack today; the threat model is the slower spend. The model-invoked skill setting is the cheapest hard line available, because forcing every skill to be user-invokable removes the case where the model decides to execute third-party code based on text it just read.

Where the safety envelope actually comes from

The Model Hardware Standard encodes tacit physical knowledge into machine-readable natural language: a robot arm's weight, once known only to a paper manual or an engineer. Read it as a security engineer and the picture inverts. If an agent reads a text tag to decide a lift is safe, whoever writes, mirrors, caches or intercepts that tag controls the agent's safety envelope. Third-party driver contributions are where every successful standard ends up, and device manifests then become supply-chain artifacts requiring signing and provenance, exactly as MCP tool descriptions did.

Techpresso's framing belongs in an architecture review: every unsolved MCP problem now has a kinetic outcome. Indirect prompt injection via poisoned tool descriptions, over-scoped connector credentials and confused-deputy escalation are documented weaknesses in the software-only pattern. On a robotic arm or a liquid handler, the worst case moves from data exfiltration to equipment damage, destroyed samples and physical safety events. Sensor readings and hardware telemetry become untrusted input to the model's context window.

The floor underneath it is already authentication-free

TLDR Hardware makes the point most OT programs miss. The robotics stack under this standard has no authentication by default. Modbus has no authentication, no integrity and no encryption, and Robotiq's new first-party ROS 2 driver reaches 200 Hz control through Modbus-cycle grouping. ROS 2's DDS layer ships open unless SROS2 is deliberately enabled. Robot cells frequently sit on IT VLANs, not segmented OT zones.

The detection mapping is already written. MITRE ATLAS AML.T0051 (indirect prompt injection) lands on ICS techniques T0831 Manipulation of Control and T0880 Loss of Safety. Unauthenticated exposed servers are T0883.

Two accelerants the coverage treats separately

TheSequence reports robot learning consolidating onto one Hugging Face-governed substrate: LeRobot with an ICLR 2026 paper behind it, NVIDIA contributing its GR00T foundation model and Isaac Teleop tooling. Two consequences. The from_pretrained convenience pattern is being ported to robot policy deployment, which makes a remote artifact fetch an input to a physical control loop. Teleoperation becomes a standardized remote-access path, an ICS-grade channel owned by the ML team rather than the OT team. Fragmentation was accidental defense-in-depth, and removing it is the project's stated goal.

Not Boring supplies the part already in production. A named US manufacturer states publicly that its MES, ERP, inline and end-of-line test stations are "stuffed with microcontrollers and tablets that were vibe coded by the hardware engineers" using Claude and Codex. Production code at Purdue Levels 2–3, written outside any software development lifecycle, no repository, no review. Assume the pattern exists in other plants and has never been reported upward, because nobody files it as software.

One ratified sentence is the cheapest control here: no unsigned or unpinned model artifact loads onto any system with a physical actuation path.

Calibration: research preview, no exploitation, no CVE. The absent authentication and interlock layer is what the coverage describes, not a tested finding. That is also the argument for writing policy now. Design-time controls are the cheapest they will ever be, and the named early-access list spans pharma, robotics vendors, academia and a hyperscaler, so bottom-up adoption is the expected path.