Commodity AI agents just broke your patch window — and your AI stack is the attack surface

A Sequoia-backed startup called Buzz chained public Anthropic, OpenAI, and Google APIs into an agent and pointed it at CISA's Known Exploited Vulnerabilities catalog. The agent exploited 103 of 122 KEVs autonomously. React2Shell fell in 22 minutes. Most exploits completed inside an hour, no human in the loop, no custom model, no restricted access. The team fed the agent the same list defenders use to prioritize patching, and it read that list as a target queue.

This is the number that should reset your Q2 planning: 84.4%, from commodity infrastructure, at the speed of an API call.

On the same week, the AI tools your engineers deployed to stay competitive shipped a dozen critical CVEs. FastGPT at CVSS 10.0 — unauthenticated HTTP proxy, full SSRF. llama.cpp at 9.8 — RCE via tensor deserialization, meaning a poisoned GGUF file from Hugging Face owns your inference host. Claude Code CLI at 9.8 — OS command injection in the auth helper, which is to say every environment variable on the developer's machine. LiteLLM at 9.1 — auth bypass that inherits legitimate user identity. Kestra and Windmill at 9.9. Six PraisonAI CVEs. Most require zero authentication. Roughly 12,000 Flowise instances remain exposed to the internet.

The two stories are the same story. Offense got cheaper faster than defense got patched.

The patch-first model is dead, and the CISO from Chevron said so out loud

Jon Raper's line — "finding vulnerabilities isn't the problem, it's remediating them in time" — is the polite version. The impolite version: if your remediation SLA is measured in days and your adversary's exploit generation is measured in minutes, your SLA is decorative. The Internet Bug Bounty program paused new submissions this week and cited AI-lowered discovery costs by name. Mythos generated 181 working Firefox exploits, up from 2 in the prior generation. That's a 90x jump in one cycle.

The honest response is architectural, not procedural. You stop pretending patching speed will catch up and start designing for contained breach. Microsegmentation on identity infrastructure, databases, and CI/CD. Automated host isolation triggered by KEV exploitation signatures, tuned to accept a higher false-positive rate than your SOC is comfortable with — because the alternative is machine-speed compromise. Blast-radius diagrams for every agent deployment, not prompts.

Yes, but — the counter-reading is that Buzz's 84.4% ran against a curated public list under lab conditions, and real environments have defenses, WAFs, EDR, network controls that the KEV benchmark doesn't simulate. Fair. The take still holds because the direction of travel is unambiguous and the tools are commodity. Six months from now the number will be higher, the exploit chains will be longer, and the defenses that mattered in the lab test will be the ones you don't have.

The AI toolchain is not enterprise software yet

The CVE list this week is a maturity indictment. These tools were built for experimentation, adopted at startup speed, and shipped to production without the hardening cycle that took traditional infrastructure decades. The Claude Code CLI vulnerability is instructive — the injection is in the authentication helper, the part handling credentials, on a tool marketed for autonomous coding. As agent autonomy expands, the auth surface expands with it, and nobody's auditing.

The governance layer is worse. Meta's leaked Claudeonomics dashboard showed 60 trillion tokens consumed in 30 days, with one user at 281 billion. The company shut it down after the data leaked externally, which tells you they had a leaderboard for AI consumption and no controls around what left the building. Meanwhile 46% of enterprise identity activity happens outside centralized IAM visibility, and 40% of accounts are orphaned. The tools you can't see are the tools running with CVSS 10.0 exposure.

Anthropic priced the middle layer to zero

Into that mess, Anthropic shipped Managed Agents at $0.08 per hour — sandboxed execution, checkpointing, scoped permissions, sub-agent spawning in research preview. Notion, Asana, Sentry, and Rakuten are already in production. Rakuten deployed across five departments in about a week each. A continuously running managed agent costs roughly $700 a year. The loaded engineering cost to build equivalent orchestration is orders of magnitude higher, and Anthropic just made it undifferentiated.

The implication is not that everyone should rip out custom agent infrastructure this week. The implication is that agent orchestration middleware is now a commodity layer, and the value has moved up the stack — to workflow-native applications with proprietary domain data — and down the stack — to whoever controls model economics. Perplexity's jump to roughly $500M ARR came from its Computer agent product, not search. Cursor sits at $2B, single vertical, workflow-integrated. That's where the moats are.

If your roadmap has a line item for building agent orchestration, kill it this sprint and redirect the engineers to whatever your product does that Anthropic can't. If your security posture assumes you'll patch faster than autonomous agents can exploit, redesign for containment before Q3. And this week specifically: run pip list and npm list against the CVE list from the specialist takes, count the unpatched KEVs in your production environment, and put that number in front of your board on Monday. If the number is greater than zero, the meeting is about what you stop doing to fix it — not what you add.