wp2shell PoC Turns WordPress Core into Same-Day Unauth RCE

Moonshot open-sourced Kimi K3, a 2.8-trillion-parameter frontier model, on July 27. Once weights are downloadable, the API chokepoint disappears. That chokepoint is what gave security teams proxy logs, DLP inspection, and a vendor of record. Inference now runs on a dev workstation or an internal GPU box with zero egress record.

The pricing numbers are $0.94 per task against $1.80 for Opus, with strong coding and agentic benchmarks attached. Both figures, and the 2.8-trillion-parameter size, trace to a single newsletter. Verify against Moonshot's release notes when the weights land; the governance exposure holds regardless of the exact figures. The people who would normally enforce restraint are already using the tools without approval: roughly two-thirds of senior decision-makers admit to unsanctioned AI use. Policy aimed downward misses the violators at the top.

Downstream, the agents already hold privileged access. A survey of 406 infrastructure leaders found 93% have hit an AI-caused infrastructure incident while only 30% have any governing policy. Treat the exact figures as directional; the direction is not in dispute. Coding agents write session logs full of tokens and internal context to unmanaged laptops, and some tools now sync those logs across nine agents. MCP servers and A2A Agent Cards add tool-execution and peer-discovery surfaces the SOC has no telemetry on.

The fix is treating AI as an identity and asset class you govern, not banning it. The prompt stream is a new, uninspected egress channel. MCP tool calls turn prompt injection into SSRF. Open weights arrive with no DPA and no SOC 2 report. The controls needed already exist: inventory, least privilege, DLP, logging. They are just pointed at surfaces that haven't been catalogued yet.

NadMesh is the concrete end of this story. It's a Go-based botnet active since early July, running a Shodan harvester to fingerprint exposed ComfyUI, Ollama, and n8n instances, then exfiltrating cloud keys and Kubernetes tokens. Its operator dashboard already claims 3,811 AWS keys, a single-newsletter figure that can't be independently corroborated. Exposed self-hosted tooling is now a target class NadMesh is built to loot.

The mirror image is model endpoints, not dashboards. Anthropic's disclosure that Moonshot ran a 3.4-million-exchange distillation campaign against Claude, through hundreds of fraudulent accounts across multiple access pathways plus reasoning-trace reconstruction, is a documented API-abuse playbook that maps to any LLM an operator runs or resells. The technique: account farming to stay under per-account thresholds, multi-pathway access to evade single-surface rate limits, output harvesting at dataset scale.

The two cases share a mechanism. Inference endpoints get robbed the same way dashboards do, one exfiltration at a time. An unauthenticated dashboard is a credential vault. An exposed inference API is a training set, harvested query by query.

Anthropic's detection method: analysts correlated request metadata to public profiles of senior Moonshot staff. That identity-to-behavior correlation is repeatable elsewhere. A volumetric anomaly flags that something is wrong; tying registration identity to request behavior is what attributes it.