Your security tools shipped the payload this week

On March 19, someone put an encrypted C2 channel and a self-spreading npm worm inside Aqua Security's Trivy. Not a package Trivy scans. Trivy itself — the vulnerability scanner sitting in your CI runner with access to every secret those runners can see. Two days later Oracle shipped a rare out-of-band patch for an unauthenticated RCE in Identity Manager (CVE-2026-21992) and declined to comment on exploitation. The day after that, Langflow's fresh CVE went from patch-published to actively exploited in 20 hours.

Three independent supply-chain incidents on the tools you bought to prevent supply-chain incidents. Same week.

If Trivy ran in any of your pipelines after March 19, the correct assumption is that every secret those runners could reach is already elsewhere. Standard egress grep won't find it — the exfil is encrypted. Rotate with deny-before-reissue, not simple rotation; a naive rotate can still be replayed through cached tokens. Pin GitHub Actions to commit SHAs, not tags. And if you run any Cargo registry that isn't crates.io, freeze Rust builds until 1.94.1 lands March 26 — CVE-2026-33056 lets a malicious crate chmod arbitrary filesystem paths during extraction, and crates.io is the only registry that's already blocked it.

Yes, but — Trivy and Langflow are two data points, and "security tools get compromised" isn't new. The steelman: fold this into your existing supply-chain hygiene and move on. I don't think the volume supports that read. When encrypted C2 shows up inside a scanner, when a defender publishes an out-of-band RCE patch the same week, and when patch-to-exploit compresses to 20 hours, the operational assumption has to be that the mean-time-to-weaponize is now shorter than the mean-time-to-deploy at most orgs. That's the number worth defending against.

The AI ecosystem you're integrating with is measurably hostile

While your CI was being scanned by its scanner, the tools your AI features depend on got audited too. AgentSeal scanned 5,125 MCP servers and found 555 — 10.8% — with toxic tool-pair chains where individually benign tools combine into exfiltration paths. 84.7% of those findings were rated critical or high. Raxe reviewed 238,180 skills on ClawHub and flagged 41.93% as malicious. The MCPTox benchmark added the punchline: o1-mini follows prompt-injected instructions from tool outputs 72.8% of the time, and more capable models are more susceptible, not less.

Inverse scaling on the exact axis you're upgrading. The model swap you were planning to improve agent quality also expands the attack surface — quadratically with tool count, per MCPTox. If your agents have 50+ tools registered in a single context, you don't have a permission model, you have a combinatorics problem.

McKinsey's chatbot was fully compromised in two hours in a documented AI-on-AI scenario. Meta's Sev 1 data exposure this month came from an engineer applying an AI agent's suggested fix without independent verification. Neither incident is a training gap. Both are structural: when you deploy agents to every engineer and tell them to trust the tool, human vigilance is not the control layer.

The fix isn't "be more careful." Cap tools per agent context — 20 is a defensible ceiling. Enforce read/write server separation so no single session holds both data access and exfiltration primitives. Add prompt-injection tests to your agent eval suite using MCPTox adapted to your actual toolset. And treat any AI-suggested change as a distinct PR class with its own gate — different bug signatures need different review, which the 470-codebase CodeRabbit/Stack Overflow study just confirmed empirically.

The market context makes this harder to defer

Anthropic just took 40% of enterprise AI spend. OpenAI collapsed from roughly half to 27%. Claude Code is at $2.5B ARR and passed Cursor, whose Composer 2 turned out to be built on Moonshot's Kimi 2.5 — a supply-chain provenance question your procurement team wasn't asking last quarter. Meta's internal executive tools run on Claude, not LLaMA. When one of the world's most sophisticated AI orgs picks a competitor's model for its own critical workflows, that's the strongest available signal about where enterprise defaults are heading.

Meanwhile, a16z's David George published the two-path ultimatum: +10pp AI-driven revenue growth or 40-50% true operating margins including SBC. Everything else is a value trap. Private credit funds with heavy SaaS-loan exposure are already gating redemptions. And MiniMax M2.7 is delivering ~90% of Opus quality at roughly 7% of input price — a 14-21x gap that makes single-vendor model routing an unforced error.

The collision matters because the vendor churn and the security debt point at the same operator move: you no longer have the luxury of a single-provider AI stack you don't have to inspect. Model routing is now a security control as much as a cost control, because it forces you to build the abstraction layer where per-request permission, tool scoping, and injection testing actually live.

What to ship this week

One action, specific: build a cost-per-completed-task dashboard and put a security-scoped policy engine in front of your agent tool calls before your next planning cycle. The dashboard forces you to route across providers instead of hardcoding Opus or GPT-5. The policy engine — even a thin one that enforces tool-count caps, read/write separation, and per-session credential scope — is where you catch the toxic tool-pair chains that 10.8% of MCP servers ship with by default.

If you can only do one thing this week, do the Trivy audit. If you can do two, add the tool-count cap. Everything else — the vendor reassessment, the a16z path declaration, the seat-to-consumption pricing pivot — can survive until the next board meeting. The encrypted C2 in your CI cannot.