Dormant GitHub Account Ships One-Click LoadMaster RCE Kit

Past the model-release noise, one architectural pattern: AI tooling is inserting high-privilege, credential-rich infrastructure through channels that skip security review. Three data points, one shape.

First, inline LLM routing proxies like Plano (Katanemo). Sold as cost optimization — prompt caching cuts repeat-input cost ~90%, session pinning claims a 2x usage drop — it is architecturally a sanctioned man-in-the-middle: it terminates and re-issues every agent→model call, holds credentials for all downstream providers, and sees full prompt/response content in cleartext. Its guardrail filter shares the same YAML config as cost routing; whoever edits that file can silently disable prompt-injection filtering or reroute traffic to a hostile endpoint with zero application-layer signal.

Second, the agent-skill supply chain. Skills install with one `npx skills add` off the open agentskills.io spec. NVIDIA signs its 110+ skills against a trust anchor and scans for hidden instructions and prompt injection — when the vendor bakes injection-scanning into the distribution channel, that channel is a confirmed attack vector (T1195, T1059). Unsigned third-party skills ride the identical path with no guardrails.

Third, Ollama in 85% of the Fortune 500 — 8.9M monthly developers behind a 14-person vendor: unmanaged local inference on endpoints and servers, not in CMDB, no patch cadence, no egress monitoring.

The compounding chain

Not three separate problems. An injected skill, inside an autonomous computer-use agent, reaching a free external API, is a complete exfiltration chain with no CVE, no patch, and no vendor to notify — every link working as designed. Sources agree: enterprise-scale governance for long-running agents does not exist yet.

You are being asked to install a component that holds every model API key and reads every prompt — treat it like an API gateway, not a dev convenience.

The escalation this cycle: shadow AI stopped being a hypothetical egress worry and produced a concrete, irreversible exposure. xAI reportedly trained Grok 4.5 on the 'entire data from Cursor' — trillions of tokens of developer interaction. If your engineers use Cursor, the blunt question is whether your proprietary source, secrets patterns, and architecture are now encoded in a competitor's model weights. Unlike a rotatable credential, data absorbed into weights cannot be recalled — you are scoping damage, not preventing it.

The adoption mechanism is the other half. Tesla mandated internal Grok usage by staff memo — AI now arrives as executive mandate, not procurement request, skipping the security and privacy review that gates any new data processor. Compounding it: 12+ no-credit-card free LLM APIs (Groq, Cerebras, OpenRouter, Hugging Face, Cloudflare, Gemini, Mistral, Cohere, Zhipu), $2/$6 subsidized Grok pricing, and Meta's $20 credits. Subsidized pricing is customer acquisition; the data-handling terms are what you're actually accepting.

Where the sources converge

Three signals, one direction: subsidized models flooding dev pipelines, executive mandates bypassing review, free endpoints removing the procurement gate. The MCP Atlas score of 88.1 shows vendors optimizing models to invoke external tools autonomously — the leading indicator for injection-to-execution through agent interfaces, a threat class most SOCs cannot detect.

No patch un-trains a model — if your code went into Cursor, governance today is damage control, not prevention.

Contrast worth holding: JPMorgan is deploying SambaNova for on-prem inference — the regulated-industry counter-move keeps inference inside the perimeter.