Miasma Worm Hits npm Graphs and SD-WAN Control Planes

Three AI Platforms, Three Different Failure Modes, One Pattern

This week produced the first clean public demonstration of LLM-mediated privilege escalation against a named platform. Actor: unattributed. Target: high-profile Instagram accounts. Mechanism: social-engineer Meta's AI chatbot into changing the account email. Scope: bypassed human review, rate-limit logic, and the traditional account-recovery threat model. The chatbot performed a privileged identity action a human agent would have flagged.

In parallel, Hugging Face Transformers disclosed an RCE exploitable via crafted model configuration files. Most pipelines treat that file as inert metadata. The package has 2.2 billion installs. Successful exploitation lands silently on GPU-accelerated inference hosts, historically the worst-instrumented boxes in the enterprise.

Claude Code's MCP integration layer has known weaknesses in the connector that ties model clients to tools and data. A vulnerability in the MCP client is a vulnerability in everything the client was trusted to touch: source code, secrets, local filesystem, cloud credentials.

Anthropic Cross-Tenant Exposure

Publicly: nothing. Not publicly: a suspected cross-tenant output exposure at Anthropic is under investigation, which would mean prompts, RAG context, and tool outputs on shared inference infrastructure leaked between customers. No CVE, no advisory, no named victim yet. Treat as a live vendor-incident review and preserve all Claude API call logs from the suspected window.

OpenAI Lockdown Mode: Amputation, Not a Cure

OpenAI shipped Lockdown Mode globally. It is the first vendor-shipped, user-toggleable mitigation against prompt injection, and it works by removing capabilities. Disabled: Deep Research, Agent Mode, internet image fetch, file downloads. Read it as an admission that prompt injection has no clean technical fix. Available on personal accounts. Enterprise/Team tenants not explicitly covered in rollout.

Every LLM connected to a tool that mutates identity, money, or data is now a Tier-1 attack surface. The Meta/Instagram hijack is the proof of concept the board will hear about next.

The Convergence

Four sources flag the same structural pattern: trust boundaries that used to be implicit are now exploitable. The model config was not supposed to be executable. The MCP server was not supposed to read ~/.aws/credentials. The AI support chatbot was not supposed to bypass identity-proofing. Each violates a developer mental-model assumption. That is why they work.

The Discovery-to-Patch Gap Has Become a Market Structure

An AI agent at a security startup autonomously surfaced 21 zero-day vulnerabilities in FFmpeg in one research cycle. Anthropic's Project Glasswing now covers 150 critical-infrastructure companies. Weaponized AI tooling has moved off research blogs and onto ransomware forums as a commodity SKU with vendor-style support. The assumption underneath every patch SLA — that a fix exists when the bug becomes public — is no longer reliable.

Scale of the FFmpeg Problem

FFmpeg is not niche. It ships inside every video processing pipeline in practical use: Slack, browser-side wasm builds, ML preprocessing, container base images, desktop clients. Most asset inventories cannot tell you where it runs. Twenty-one zero-days is twenty-one head starts for exploit development before any patch lands.

The Offensive Ceiling Moved

Publicly: Anthropic is paying $1.25B/month for compute at Colossus 1. Reported by multiple sources, not officially confirmed: roughly 6 Anthropic engineers embedded at the NSA, deploying the Mythos model for offensive operations. The same model family in Claude production integrations is being pointed at nation-state targets. Trickle-down to financially motivated actors historically takes 12 to 24 months.

Patch SLAs are no longer the right defensive metric. AI-driven discovery has structurally outpaced vendor remediation, and security architecture needs to assume the patch may never arrive on time.

What the Commerce IG Adds

The Commerce Inspector General has formally labeled NIST's NVD backlog a strategic-planning failure. The canonical source of vulnerability metadata is running behind the disclosure curve at the moment discovery is accelerating. Scanners that depend on NVD for CVSS, CPE matching, or CWE classification have silent coverage gaps on recent CVEs. Not a future risk. A current one.

The Defensive Pivot

This is not another CVE to chase. The control hierarchy has to move. Virtual patching — WAF, RASP, IPS, runtime exploit prevention — graduates from compensating control to primary control. Run the tabletop now: "Critical RCE disclosed in a tier-1 vendor. No patch for 30 days. PoC public within 48 hours." Isolation, customer comms, regulator notification — decide those before the clock starts, not during.