The compute scarcity trade ended the same day your IDE became RCE

Two things happened on the same trading day. Meta formalized plans to resell excess AI compute from its $183B infrastructure buildout — CoreWeave dropped 14%, Nebius 17%, Meta popped 8.8%. And CVE-2026-45659 (SharePoint) hit CISA KEV with active exploitation while Cato Labs disclosed two 9.8-severity zero-click RCEs in every Cursor version before 3.0.

The cover story is compute. Nvidia is now guaranteeing to rent back unsold GPUs from younger neoclouds in exchange for revenue share. SpaceX rents its Memphis facility to Anthropic and Google. Together AI raised $800M. UBS says 60% of enterprises are curbing AI spend. Tesla capped employee AI at $200/week after costs spiraled. Meta imposed hard token caps internally after consumption drifted toward billions.

When the dominant chip vendor has to underwrite its customers' demand, and the largest AI spender on earth has surplus capacity to resell, the scarcity premium priced into every GPU-cloud valuation is over. This is a mark-to-market event, not a thesis.

Yes, but — the buildout is still real and demand keeps compounding; a single quarter of oversupply doesn't unwind $500B+ of committed capex. Fair. The take still holds because pricing power moves faster than capacity does. Contracts renew every 12 months. Marginal-cost sellers set the clearing price. That's the number that hits your invoice.

Do one thing this week: pull competitive quotes from two neoclouds and use them as leverage on any GPU or inference contract renewing before Q2. Do not sign anything longer than 12 months. If you can't get a price protection clause, insert one.

The other end of the stack is on fire

SharePoint CVE-2026-45659 is in KEV, which carries a federal patching mandate and — more usefully — tells you exploitation is confirmed in the wild. Patch internet-facing instances today. Hunt for compromise on anything that was exposed while unpatched.

Cursor's two CVEs are worse in a different way. They're zero-click. Any content the agent reads — a repository file, an MCP tool response, a web search result — can escape the sandbox and execute code on a developer workstation. That workstation holds cloud credentials, CI/CD tokens, and the source it's editing. Force-update to 3.0 through fleet management. Block pre-3.0 binaries at the EDR layer.

Both bugs share a shape: a privileged component that trusts its input. SharePoint renders content that triggers exploitation. Cursor reads content that triggers exploitation. The pattern generalizes to every agentic IDE with filesystem write access, and there are more of them than you're tracking.

While you're patching, put a NetworkPolicy in front of Argo CD's repo-server. Synacktiv published the chain: unauthenticated gRPC → Kustomize command execution → Redis credential theft → malicious manifest → full cluster takeover. There is no patch. Segmentation is the only control.

The AI infrastructure you didn't inventory is now target infrastructure

Sysdig documented JADEPUFFER — the first end-to-end AI-agent-driven ransomware, pivoting on a Langflow RCE. Three separate operators are actively hijacking unauthenticated Ollama and LiteLLM endpoints to power autonomous pentest frameworks. Anthropic told US lawmakers that Alibaba ran 25,000 fraudulent accounts generating 28.8M exchanges over 44 days to distill Claude — an industrial distillation operation with a signature (~26 exchanges per account per day) regular enough to spot if you're watching.

Most SOCs are not watching. Inference endpoints, orchestration frameworks, and MCP servers don't sit in the asset inventory. They sit in developer sprawl. The upcoming 2026-07-28 MCP spec mandates OAuth 2.1 + PKCE but introduces five new attack surfaces — predictable tracking IDs, unsigned _meta, header desync, stored XSS in MCP Apps, async task DoS — that fall on the application builder, not the protocol.

And an ICML 2026 paper closed the theoretical door. LLMs classify roles by writing style, not by XML or JSON tags. CoT Forgery — injecting fake reasoning that mimics the model's own thinking style — lifts jailbreak success from near-zero to about 60% across frontier models. Role tags are cosmetic. Prompt structure is not a trust boundary. Any security control that reads "the system prompt says only return data the user has access to" fails 60% of the time against someone who's trying.

The operator move: enumerate every Ollama, LiteLLM, and Langflow instance this week. Put them behind authenticated gateways or private subnets. Add them to the same asset inventory as internet-facing web apps, because that is what they are. Then instrument tool-level authorization at the application layer, independent of anything the model says.

The through-line worth landing on

The compute-side story and the security-side story are the same story: AI infrastructure moved from privileged to commodity in the same cycle that adversaries figured out how to weaponize the parts nobody was watching. Value is migrating up the stack — to orchestration, to vertical fine-tuning (Bridgewater's specialist hit 84.7% accuracy at 13.8x lower cost than the best frontier model), to the workflow integration layers where switching costs and data gravity actually live.

One calendar move this week. Block two hours on Thursday. Patch SharePoint and Cursor before lunch. Spend the afternoon on the AI asset inventory — every inference endpoint, every MCP server, every orchestration framework, every model router your developers wired up without telling you. That list is your new attack surface and your new procurement leverage. Both work off the same document.