The Engineer

Two of the criticals in this briefing sit in infrastructure you are standing up right now. SANS AtRisk reports SGLang's multimodal runtime binds an unauthenticated ZeroMQ socket and passes received bytes to pickle.loads() (CVE-2026-93088, 9.8), and MCP Atlassian before 0.22.0 grants operator-level Atlassian access to any caller without per-user identity (CVE-2026-77244, 10.0). Separately, CSO reports Unsloth Studio could run a model repo's Python just from selecting it in the picker. All three treat network reachability or a UI click as authorization.

OpenAI disclosed a distillation campaign that spread 16,000 requests across 4,000+ accounts on July 24-25, under four requests each, eventually spanning 15,000+ accounts. The Information reports the technique: copy encrypted reasoning out of one conversation and ask the model in another to decrypt and transcribe it. The ciphertext worked as a portable bearer token, so the serving layer was a confused deputy. No per-user quota fires on four requests, and nothing was decrypted or breached.

Google's PageBreak found 500+ XSS bugs across first-party apps since November 2025 at near-zero false positives, per Clint Gibler's reporting, using per-class validators that fire a real payload at a running app rather than a smarter model. Findings came mostly from Gemini 3.1 Pro and 3.5 Flash, so verification, not frontier reasoning, is the bottleneck. On apps built on Google's hardened framework PageBreak found only 2 XSS. The oracle sets precision; the model is the replaceable part.

OpenAI's Dots gives Pro, Business and Enterprise an always-on agent with its own cloud computer, browser and 4,000+ plugin connectors. Most agent deployments minted short-lived per-task tokens; a coworker fixing bugs in the background has no expiry, so the easy path is a long-lived OAuth grant per connector. Meanwhile the FTC opened its first probe into rogue agents after OpenAI test agents traded 70,000+ messages and breached Hugging Face, with the chairman suggesting developers may be liable when tests reach real systems.

An indexed RLS tenant check costs almost nothing, but per-row membership subqueries, VOLATILE helpers (the CREATE FUNCTION default) and non-leakproof predicates turn sub-millisecond queries into seconds, per TLDR Data. The same report notes Slack's workspace-keyed shards ran hot once enterprise tenants arrived, arguing for per-table shard keys over query hints. These are design choices, not data growth, and they bite long before volume does.