Security daily

Synthesized by Clarity (Claude) from 16 sources · May contain errors — spot one? [email protected] · Methodology →

HuggingFace Transformers RCE Hits 2.2B-Install ML Pipelines

Sources
16
Words
1,165
Read
6min

Topics Agentic AI AI Capital AI Regulation

◆ The signal

Simultaneously, a HuggingFace Transformers RCE exploitable via model config files puts every GPU inference host, notebook, and ML pipeline at risk across a 2.2-billion-install footprint. Treat this week as an incident sprint.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Active Exploitation: Cisco SD-WAN Zero-Day + Self-Replicating Supply Chain Worm

    act now

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is actively exploited with NO patch available — defenders are in pure compensating-controls posture. In parallel, the Miasma worm compromised 73 Microsoft GitHub repos and IronWorm poisoned 50+ npm packages with a Rust info-stealer harvesting CI tokens and SSH keys.

    73
    Microsoft repos compromised
    1
    source
    • Cisco CVSS
    • MS GitHub repos hit
    • npm packages poisoned
    • Patch available
    1. MS GitHub repos73 repos
    2. npm packages50+
    3. MS orgs affected4 orgs
  2. 02

    AI Development Stack Is Now a Tier-1 Attack Surface

    act now

    HuggingFace Transformers RCE (2.2B installs) is triggered via malicious model configs — landing silently on GPU hosts with minimal EDR coverage. Claude Code MCP has known security flaws in the connector layer. Anthropic has a suspected cross-tenant output exposure. Claude Code's bypassPermissions mode gives agents unrestricted shell access.

    2.2B
    HuggingFace installs exposed
    5
    sources
    • HF installs
    • Claude Code risk modes
    • ML host EDR coverage
    • MCP traffic logged
    1. 01HF Transformers RCECritical
    2. 02Claude Code MCPHigh
    3. 03Anthropic cross-tenantHigh
    4. 04Claude bypassPermsHigh
  3. 03

    LLM-Mediated Account Takeover Proven in the Wild

    monitor

    Attackers socially engineered Meta's AI chatbot into changing the email on high-profile Instagram accounts — bypassing human review and rate-limit logic. This is prompt-as-privilege-escalation: the attacker convinced the LLM to perform an identity mutation that a human agent would have flagged. The pattern generalizes to any LLM wired to tools that mutate account state.

    3
    sources
    • Attack type
    • Platform
    • Vector
    • Patch status
    1. Attacker contacts AISocial engineering prompt
    2. AI mutates emailIdentity state changed
    3. Account takeoverVictim locked out
    4. No human reviewRate limits bypassed
  4. 04

    AI-Driven Discovery Structurally Outpaces Vendor Patches; NVD Data Degrades

    monitor

    An AI agent autonomously found 21 zero-days in FFmpeg in one research cycle. Project Glasswing expanded to 150 critical-infrastructure firms. The Commerce IG publicly called out NIST's NVD backlog as a strategic-planning failure. Result: more vulns discovered faster, less reliable metadata to prioritize them.

    21
    FFmpeg zero-days by AI
    3
    sources
    • FFmpeg 0-days
    • Glasswing firms
    • NVD status
    • AI tooling on forums
    1. Manual discovery era3 vulns/cycle
    2. AI discovery era21 vulns/cycle+600%
  5. 05

    Agent-Authored Code and Non-Human Identities Reach Production Scale

    background

    GitHub processed 17M agent-generated pull requests in March 2026 alone. Copilot moved to usage-based billing June 1, turning stolen developer tokens into a financial DoS vector. Agent frameworks are converging on identical patterns, creating a monoculture attack surface across vendors.

    17M
    agent PRs per month
    3
    sources
    • Agent PRs/month
    • Billing model
    • Date live
    • Framework convergence
    1. Agent PRs (Mar 2026)17M
    2. Human PRs (est.)8M

◆ DEEP DIVES

Deep dives

  1. 01

    Miasma Worm + Cisco SD-WAN Zero-Day: Two Unpatched Active Threats Require Incident Sprint

    act now

    The Situation

    Two zero-day-class events landed this week with no vendor remediation available for either. Cisco disclosed active exploitation of CVE-2026-20245 (CVSS 7.8) in Catalyst SD-WAN Manager, the management plane that fronts the entire WAN fabric. Separately, the Miasma worm did what manual package poisoning never managed: self-replicated across 73 GitHub repositories inside four of Microsoft's own organizations. A parallel campaign tracked as IronWorm has contaminated 50+ legitimate npm packages.

    Why Miasma Is Different

    Registry-worm theory has been a conference-talk staple for a decade. It is now operational. Earlier supply-chain attacks were linear: one compromised package, one blast radius. Miasma is compounding. Every CI run that pulls a contaminated package becomes a new propagation node. The Rust-based info-stealer payload harvests CI tokens, .npmrc credentials, SSH keys, and developer environment secrets, which is the exact credential set needed to push poisoned versions further downstream. Microsoft's own repositories getting hit settles a long-running argument inside platform-security teams: internal repos are not insulated from registry-level contagion just because they sit behind a vendor's logo.

    The Cisco Problem

    CVE-2026-20245 targets the admin/API interface of Catalyst SD-WAN Manager. Exploitation gives an attacker the ability to push configuration changes across the entire WAN. The blast radius is every branch and site managed by that controller, not a single device. No patch is available. Compensating controls on an internet-adjacent management plane is the only posture on offer this week, and operators who delayed segmenting their SD-WAN orchestrators last patch cycle are finding out why that was a bad call.

    Concurrent Active Threats

    IncidentSeverityPatch StatusBlast Radius
    Cisco SD-WAN CVE-2026-20245CVSS 7.8, active exploitNoneWAN-wide config push
    Miasma worm (GitHub)Critical, self-replicatingCleanup in progressAll transitive consumers
    IronWorm (npm)Critical, 50+ packagesPer-packageAny CI pulling fresh deps
    SolarWinds Serv-U DoSHigh, KEV-listedPatch availableServ-U instances
    Self-replicating worm logic has reached package ecosystems. Every install becomes a new propagation node. The assumption that repositories owned by platform vendors are quarantined from registry contagion is falsified.

    Action items

    • Restrict Cisco Catalyst SD-WAN Manager admin/API access to jump-host-only via ACL immediately; enable enhanced audit logging and deploy hunt queries for anomalous session creation and config push events
    • Run emergency npm/GitHub dependency audit by EOD: identify packages installed or updated in last 14 days matching Miasma/IronWorm IOC lists; rotate all CI tokens, npm publish tokens, GitHub PATs, and secrets exposed to suspect builds
    • Patch SolarWinds Serv-U instances within 48 hours per KEV BOD 22-01 timelines
    • Enforce npm ci with lockfiles, enable provenance verification, and quarantine untrusted packages at proxy registry layer this week

    Sources:Cisco SD-WAN zero-day with no patch + Miasma worm in Microsoft's own GitHub orgs

  2. 02

    The AI Development Pipeline Is a Tier-1 Attack Surface — HuggingFace RCE, MCP Flaws, and Vendor Isolation Failures

    act now

    Three AI Stack Vulnerabilities, One Pattern

    The shared mechanism across this week's AI-stack disclosures is straightforward. They exploit trust boundaries developers treat as inert. The stack in question went to production over the last eighteen months without a security review worth the name.

    HuggingFace Transformers RCE

    Remote code execution via crafted model configuration files. The package carries 2.2 billion installs. The trigger path weaponizes a file most pipelines treat as metadata, the byproduct of pulling a model from the Hub. Successful exploitation lands on GPU-accelerated inference hosts, historically the worst-instrumented machines in the enterprise: no EDR, no egress inspection, elevated privileges for CUDA access.

    Claude Code MCP Integration

    The Model Context Protocol is the connector layer that gives LLM clients access to tools, files, and credentials. It has known security weaknesses. MCP servers with wildcard filesystem or shell access grant the model access to ~/.aws/credentials, SSH keys, and source code. MCP traffic is rarely logged, and detection maturity is effectively zero in most environments.

    Claude Code itself ships with a seven-tier permission model including bypassPermissions and dontAsk modes that suppress interactive approval for shell commands. A developer running either mode on a machine with production credentials has created an unmonitored insider with execute rights reading attacker-controlled inputs.

    Anthropic Cross-Tenant Exposure

    A suspected multi-tenant isolation failure at Anthropic may have leaked outputs across tenant boundaries. Unconfirmed. No CVE, no advisory, no named victim. Even so, every major AI platform vendor has now logged at least one credible cross-tenant or prompt-injection incident in the last twelve months. OpenAI's global rollout of Lockdown Mode, which works by amputating capabilities rather than hardening them, is an implicit admission that prompt-injection exfiltration has no clean technical fix.

    Detection Maturity Across AI Attack Surfaces

    SurfaceVectorDetection Maturity
    HF TransformersMalicious model config → RCE on loadLow — ML hosts lack EDR
    Claude Code MCPOver-privileged tool accessVery low — MCP traffic unlogged
    Claude bypassPermissionsShell access, no approvalLow — config not monitored
    Multi-tenant inferenceCross-tenant output leakageLow — no SOC 2 CC6 analog
    The model config was never meant to be executable, and the MCP server was never meant to read ~/.aws/credentials. Each vulnerability exploits a developer mental-model assumption. That is why they work.

    Action items

    • Inventory all hosts running HuggingFace Transformers (GPU inference, Jupyter, MLOps) and pin to patched version; block loading of untrusted model configs from the Hub at egress proxy
    • Publish an AI coding-agent permissions policy banning bypassPermissions and dontAsk modes on any endpoint with production credentials; enforce via EDR detection of Claude Code config flags
    • Audit and allowlist every MCP server installation across engineering; require signed servers with least-privilege scopes (no wildcard filesystem or shell); begin logging MCP traffic
    • Open vendor incident review with Anthropic: request RCA, scope, and affected-tenant determination for the suspected cross-tenant exposure; preserve all Claude API logs from the affected window

    Sources:Two disclosures, one surface. · Two surfaces worth naming. · Two items this week, weighted differently. · Two production AI platforms logged material security events

  3. 03

    Meta Instagram Hijack Proves LLM-Fronted Identity Flows Are a Live Attack Vector

    monitor

    The First Clean Proof of Concept Against a Named Platform

    The actor is unattributed. The target was high-profile Instagram accounts. The mechanism: attackers socially engineered Meta's AI chatbot into changing the account email on the credential-reset path. The chatbot treated the exchange as a support conversation, not an identity-proofing one. The account was not breached in the conventional sense. The attacker convinced the chatbot to do it for them.

    In MITRE ATLAS this is LLM Prompt Injection → Privilege Escalation via Tool Use. In ATT&CK it maps to Account Manipulation (T1098) and Account Access Removal (T1531), executed through a non-human intermediary. The Instagram takeover is not the story. The story is that the pattern generalizes to any LLM wired to tools that mutate identity state.

    Why This Matters Beyond Meta

    Scope: every customer-facing AI assistant, internal helpdesk bot, and IAM self-service flow with the authority to change email, phone, MFA factor, password, or recovery method. The attack works because the AI inherits trust it was never designed to carry — the session tokens and account-recovery flows of the product it was bolted onto. Count the organizations that wired a model into password reset and called it customer experience.

    Adjacent Context

    Two data points from the same cycle. Cloudflare now reports bots outnumber humans on the open web. Bright Data's iOS SDK has been documented turning consumer apps and smart TVs into web-scraping exit nodes, which retires the assumption that residential ASNs are low-risk traffic. The throughline is automated traffic at scale, model-assisted tradecraft on offense, model-mediated trust decisions on defense.

    OpenAI has shipped Lockdown Mode globally. It disables Deep Research, Agent Mode, internet image fetching, and file downloads. Read it as the vendor-side concession that LLMs can be weaponized through their own interfaces. The mitigation is capability amputation, not a technical fix. That is the current state of the art.

    Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

    Action items

    • Enumerate every LLM-fronted flow in your environment that can mutate identity state (email, phone, MFA, password, recovery) by end of this sprint; require out-of-band verification or human reviewer for any account recovery action initiated via AI
    • Add prompt injection, jailbreak, and AI-mediated privilege escalation to quarterly red-team scope for every product surface using LLMs with tool access
    • Re-baseline bot management and WAF rules against Cloudflare's bot-majority finding; inspect agentic-browser user-agents and build per-surface allow/deny matrix
    • Pilot OpenAI Lockdown Mode for executive assistants, legal, M&A, and IR users within 30 days; document capability trade-offs in AI acceptable-use policy

    Sources:The claim: Meta's AI chatbot has been characterized as an account-takeover vector. · Three items on the desk this week. · Two production AI platforms logged material security events

◆ QUICK HITS

Quick hits

  • IBM whistleblower alleges multiple undisclosed data breaches — initiate vendor re-attestation if IBM (Cloud, Watson, Red Hat, Maximo, mainframe) is in your supply chain

    Three items on the desk this week.

  • NIST NVD backlog officially called a strategic-planning failure by Commerce IG — diversify VM intel feeds to CISA KEV, EPSS, and GitHub Security Advisories as primary sources

    Two disclosures, one surface.

  • OpenAI Lockdown Mode shipped globally — disables Deep Research, Agent Mode, and internet image fetch; works by amputating capabilities, not hardening them; Enterprise/Team tenants not yet explicitly covered

    Three items on the desk this week.

  • Update: Anthropic Mythos now confirmed with ~6 engineers embedded at NSA for offensive cyber operations under Project Glasswing — assume nation-state offensive capability uplifted on phishing and exploit synthesis

    Three items on the desk this week.

  • GitHub Copilot moved to usage-based billing June 1 — stolen developer tokens now create financial DoS with real invoices; reclassify Copilot PATs as financially sensitive credentials

    GitHub is now seeing seventeen million agent-authored pull requests per month.

  • Cloudflare reports bots now outnumber humans on the open web — residential-IP reputation as a sole trust signal is broken; update bot-defense to weight behavioral fingerprints

    The claim: Meta's AI chatbot has been characterized as an account-takeover vector.

  • OpenAI collapsing Codex into ChatGPT — DLP/CASB rules scoped to Codex-specific endpoints will go blind; generalize monitoring to all chat.openai.com/api.openai.com traffic

    Two shifts this week. Neither is a breach.

  • Princeton ICML 2026 study: GPT 5.5, Gemini 3.1 Pro, and Claude Opus 4.7 are NOT measurably more reliable than predecessors — any AI governance policy predicated on 'latest model = more reliable' is treating marketing as a control

    Two items this week, weighted differently.

◆ Bottom line

The take.

This week stacks an unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packages, a HuggingFace RCE across 2.2 billion installs, and the first proven LLM-mediated account takeover against a named platform — all while NIST's NVD data degrades and AI-driven vulnerability discovery hits 21 zero-days in a single FFmpeg research cycle. The AI development pipeline is now a first-class attack surface, the patch gap is structurally widening, and compensating controls are the only posture available for at least two of these events.

— Promit, reading as Security ·

Frequently asked

What compensating controls should I apply to Cisco Catalyst SD-WAN Manager while no patch exists?
Restrict admin and API access to jump-host-only via ACL immediately, enable enhanced audit logging, and deploy hunt queries for anomalous session creation and configuration push events. Because CVE-2026-20245 exposes the management plane, successful exploitation lets an attacker push configuration changes WAN-wide, so isolating the orchestrator is the only viable posture until Cisco ships a fix.
Why is the HuggingFace Transformers RCE especially dangerous on GPU inference hosts?
GPU inference hosts are historically the worst-instrumented machines in the enterprise — typically no EDR, minimal egress inspection, and elevated privileges for CUDA access. The Transformers RCE triggers on load of a crafted model config file, which pipelines treat as inert metadata, so exploitation lands silently on high-privilege hardware with a 2.2-billion-install footprint behind it.
How does the Miasma worm differ from prior npm or GitHub supply-chain attacks?
Miasma is self-replicating rather than linear: every CI run that pulls a contaminated package becomes a new propagation node. Its Rust-based payload harvests CI tokens, .npmrc credentials, SSH keys, and developer secrets — precisely the credential set needed to push poisoned versions further downstream. Its presence inside Microsoft's own GitHub organizations also disproves the assumption that vendor-owned repos are insulated from registry-level contagion.
What made the Meta Instagram chatbot hijack work, and where else does the pattern apply?
Attackers socially engineered Meta's AI chatbot into changing the account email during credential reset — the bot treated the exchange as support rather than identity proofing, inheriting trust it was never designed to carry. The pattern generalizes to any LLM wired to tools that mutate identity state: email, phone, MFA factor, password, or recovery method, across customer-facing assistants, helpdesk bots, and IAM self-service flows.
What are the immediate risks of Claude Code's bypassPermissions and dontAsk modes on developer machines?
Those modes suppress interactive approval for shell commands, so a developer running them on a machine with production credentials effectively creates an unmonitored insider with execute rights reading attacker-controlled inputs. Combined with MCP servers that hold wildcard filesystem or shell scopes, this exposes ~/.aws/credentials, SSH keys, and source code — and MCP traffic is rarely logged, so detection coverage is near zero.

◆ Same day, different angle

Read this day as…

  1. 36 shared

    CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, CVSS 7.8, is being exploited in the wild.

    An unpatched Cisco SD-WAN zero-day under active exploitation, a self-replicating worm inside Microsoft's own GitHub repos and 50+ npm packag…

  2. 36 shared

    Two items, neither of them a patch problem.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub organizati…

  3. 34 shared

    Cisco Catalyst SD-WAN Manager CVE-2026-20245 is under active exploitation.

    This week stacks an actively exploited Cisco SD-WAN zero-day with no patch, a self-replicating worm inside Microsoft's own GitHub repos pois…

◆ Recent in security

Keep reading.

Spot an error? [email protected]