The Watch

What the disclosed key buys

Rails derives cookie signing and encryption from secret_key_base. An attacker who reads it does not need the vulnerability again. They can mint session cookies the application accepts as authentic, privileged accounts included, and unwrap whatever the app kept in its encrypted credential store. Risky Business's framing is the one to brief upward: the attacker gets what a shell would have given them without creating a process, a child shell or a beacon that endpoint tooling is tuned to catch.

Patched and exposed are separate facts. Triage queues record the first. A host that took the early-August fix but had its keys read in mid-August looks, from the attacker's side, identical to one still running vulnerable code. The access arrives as ordinary authenticated traffic through the application's own front door. No payload lands on disk for a later scan to find.

Sequence the rotation

One secret regenerates all the others, so order decides whether the work holds.

1. Inventory every Rails application using Active Storage, including internal apps that quietly terminate public traffic behind a load balancer, and confirm the early-August fix on each one.
2. Rotate secret_key_base and the signed and encrypted cookie keys first, then invalidate sessions fleet-wide. Rotating downstream credentials while cookie forgery still works hands an intruder the replacements from an authenticated session.
3. Rotate database credentials, cloud IAM keys and third-party API tokens held by anything internet-facing since 1 August. Cloud IAM keys are the ones most likely to have unknown consumers. Teams that skip the broken-jobs check find out at 3am.
4. Hunt authentication logs for sessions and tokens issued before rotation and still in use, and for the same credential appearing from an unfamiliar network.

Step 3 depends on a complete list of what holds a credential. Few organisations have one.

The pattern across these items

McKesson shows the same shape. The company confirmed an intrusion sourced from a third-party application, with the extortion crew claiming hundreds of millions of customer and patient records. That breach happened inside a vendor integration's token scope. Bring-your-own-key agent tooling leaves long-lived Anthropic, OpenAI and Google API keys sitting in local secret stores, the artifact class commodity infostealers already enumerate. Every MCP endpoint an agent calls is an authenticated path into a production system whose credential use is typically unlogged.

The sources pull against each other, which is instructive. Risky Business treats rotation as the control that closes a secrets-disclosure bug, and operationally that holds. The agent and AI-tooling reporting shows the rotation inventory is incomplete by construction: credentials have migrated into config stores, delegated grants and desktop secret vaults that no register covers. The Rails work is the urgent task and a rehearsal at once. The list built to answer which secrets did this app hold is the list needed the next time a disclosure hands someone a key.

Rotation and session invalidation close a secrets-disclosure bug. A version number records the patch date.

Ollama v0.33 registers as a gateway provider inside Claude Desktop

Ollama v0.33 ships a Claude Desktop integration that registers as a third-party gateway provider. One switch in the Ollama menu bar puts a user's entire local model library into Claude Desktop's model picker, Qwen, DeepSeek, Kimi and GLM included, with inference running on user hardware or through Ollama Cloud. A CASB logs an approved application, and an egress proxy logs expected traffic or nothing at all. DLP has no inspection point, because the prompt never leaves the host. The switch is also fully reversible, which is what makes a quarterly attestation worthless against it.

Where the four paths diverge from what controls log

The VM boundary did not hold

Trail of Bits demonstrated cyber-capable agents routinely escaping QEMU, KVM, libslirp and CUPS. Any agent design that shows an auditor a virtual machine boundary as the control has lost that argument. What remains is egress filtering around an execution host treated as an untrusted network segment. The publishing side failed independently in the same month: a compromised OpenAI-related npm package reached users through an unsecured publish workflow rather than a stolen laptop.

Both the benchmarks and the deployment numbers hold

Uber's disclosure describes agents as production infrastructure: 30,000-plus executions a day, a context graph of 24M nodes and 80M edges spanning 30-plus internal systems, agentic requests up 9.4x in six months. Two independent benchmarks put whole-repository migrations at a 5.4% clean pass rate and document a discovery-reliability gap across 507 stateful business workflows. Both readings are true, and read together they name the exposure: agents generate change at production volume while completing long-horizon work unreliably, and shared service accounts mean nobody can reconstruct which agent made which write.

Identity issuance is an enrolment record, and nothing in that record constrains what a delegated token does at 2am. Okta's argument that agents now touch every system is architecturally right. SSO, SCIM and RBAC were built for humans: SCIM disables the user and leaves the agent's grants and memory intact, and RBAC hands the agent the human's full scope by default.

Agents absent from the identity register hold live grants that no revocation workflow touches.

The ledger is the security consequence

Z.ai's own report calls GLM-5.3's exploitation skill emergent: as post-training scaled, the capability grew faster than the lab expected. They hardened it and released the weights anyway. The consequence is the artifact left behind, a public disclosure ledger of 2,436 findings across 269 projects. Disclosure almost never coincides with universal patch availability. For that interval the ledger serves as a remediation roadmap for defenders and a pre-built N-day target list for everyone else, with patch-diffing automatable on both sides.

Where 1981-era code actually lives

The oldest affected code predates most asset inventories, and that matters mechanically. Ancient C utilities, parsers and daemons survive in three places software composition analysis reads poorly or not at all: container base image layers, vendored or statically linked source copied into a repo years ago, and appliance and OT firmware that cannot be opened. A clean SCA report means the tool found no manifest entry. Absence of the code is a separate claim requiring separate evidence. So the diff runs against four inventories, not one. The matches with no upstream maintainer end the exercise with nothing to apply.

The economics moved under the third-party patch SLA

Miessler dates the collapse of the skill floor to end of 2026 into early 2027, when unrestricted open-weight models put frontier-quality offensive capability into hands with no offensive experience. Separately, near-frontier Chinese open weights are landing at what the reporting on Tencent's Hy4 and Z.ai calls superlow hosted cost. Cost collapse is the strongest predictor of adoption, on both sides of the fence.

The practical read is narrow and defensible. Finding a memory-safety bug in an unmaintained parser costs GPU hours, with no API rate limit in the path and no vendor abuse telemetry watching it. Patch SLAs for third-party components were baselined against a longer time-to-exploit for exactly that class of dependency. The change is confined to the unmaintained tail; first-party, well-maintained software is unaffected.

The distribution channel is the concentration risk

These weights ship through Hugging Face. Publicly: nothing. Reported: CNBC's sources say NVIDIA has agreed to buy the hub for $12.9B, unconfirmed by either company, so treat it as a reported deal rather than a settled fact. Ownership matters less than what the reporting makes visible. The hub is an unauthenticated distribution point for artifacts that execute code on load, with no signing infrastructure and no SBOM analogue, and it appears on almost no critical-vendor list. The controls are identical whether or not the deal closes: an internal mirror, allowlisted repositories, digest pinning, safetensors-only, and trust_remote_code off by default.

A published ledger of 2,436 findings is a remediation plan and a target list, released on the same day.