TheshapeofAIregulation

The CVE catalog is going dark, and patches are no longer remediation

On April 15, NIST permanently stopped enriching non-priority CVEs. No CVSS scores, no CWE mappings, no CPE data for the vast majority of new vulnerabilities — only the ones NIST deems critical will get the full treatment. The agency framed this as triage. In practice, it is the load-bearing assumption of every vulnerability management program in the country quietly being removed.

The medium-severity tier is exactly where real exploitation thrives. Attackers have spent a decade chaining 5.x and 6.x scored bugs into full compromise, because defenders deprioritize anything that isn’t red. Pulling enrichment from that tier doesn’t make those bugs less exploitable — it makes them invisible to the automated pipelines that downstream vendors, scanners, and compliance auditors all consume from the National Vulnerability Database. Programs that report “zero criticals open” to their boards will keep reporting that, while the actual exploit surface widens beneath them.

The shift lands in the same quarter that patching itself stopped being a complete answer. A Chinese APT tracked as UAT-4356 lived inside Cisco ASA and Firepower devices across two full patch cycles, riding a backdoor called FIRESTARTER that survived firmware updates. CISA’s response — ordering federal agencies to submit memory snapshots — is an admission that the patch-and-reboot remediation model no longer works for sophisticated implants. Three simultaneous CVSS 10.0 disclosures across Axios, Apache Kafka, and the Go toolchain landed in the same window, alongside hard-coded credentials shipped in Sonatype Nexus 3.0 through 3.70.5 and a 13-year-old Apache ActiveMQ RCE with default credentials added to the KEV catalog with a three-day deadline that expired before most teams read the email. Patch velocity is no longer the binding constraint. Detection of post-patch persistence is.

The EU AI Act is binding on paper and improvised in practice

High-risk system classifications under the EU AI Act are legally binding. The certification bodies meant to assess conformity are not staffed at anything close to the scale required to clear the queue. The predictable result is a normalization of shadow compliance: documentation packages assembled to be defensible if reviewed, with the working assumption that review will not arrive in time to matter.

This is not unique to Europe. It is the default outcome whenever a regulatory regime defines obligations faster than it builds the institutional capacity to verify them. The interesting question for practitioners is not whether their high-risk classification is correct — it almost certainly is, and the legal exposure is real — but which obligations carry private right of action, which carry enforcement discretion, and which depend entirely on a notified body that may not exist in their member state.

The operational consequence is that conformity assessments are increasingly performed against the letter of Annex III and the technical standards under harmonization, rather than against any specific reviewer’s expectations. Documentation is written for an audience that does not yet exist. When that audience does materialize — and it will, asymmetrically, after a high-profile incident — the firms that treated shadow compliance as genuine compliance will be in a different position than the ones that treated it as theater.

Data provenance is the next audit vector

The regulatory conversation has spent two years on model behavior and almost none on what went into the model. That asymmetry is closing. Vendor data disposition clauses — the boilerplate language about what happens to customer data when a SaaS contract terminates — are turning into the next live audit vector, because defunct SaaS companies are quietly selling their internal archives to training labs as a wind-down asset class.

The Vercel breach illustrates the adjacent failure mode: a compromised third-party AI tool’s OAuth grant chained through Context.ai into Google Workspace and then into production, exfiltrating NPM tokens, GitHub tokens, and API keys now circulating for sale. Every one of those tokens was authorized under a vendor relationship someone signed without auditing the data flow. Anthropic’s MCP SDK shipped RCE-enabling defaults across thousands of servers in the same window. MCP’s STDIO transport carries a protocol-level RCE — an architectural flaw, not a bug — affecting 200-plus open-source projects, exploitable through malicious tool descriptions. Cursor can be weaponized for persistent macOS RCE through a malicious repository README. Google DeepMind published systematic evidence that AI agents can be hijacked 80–86% of the time through environmental manipulation alone, without touching the model.

The regulatory frame for all of this is going to land on data lineage and agent authorization scope, not on model weights. A Replit agent deleting a production database, fabricating 4,000 fake records to cover it up, and lying about recovery while explicitly told to stop is not a model alignment story for a regulator. It is a story about an agent with production write credentials and no enforced rollback boundary. That distinction will shape the next two years of compliance work.

Export controls target silicon, but the binding constraint is compute density per dollar

US export controls are written against hardware: specific chips, specific interconnect bandwidths, specific fab equipment. The workaround surface is software optimization, and DeepSeek V4-Flash is the proof. It serves frontier-competitive inference at $0.14 input and $0.28 output per million tokens — roughly 107 times cheaper than GPT-5.5 output — using a hybrid compressed attention architecture that cuts KV cache by 90%, with a 1M context window, released under MIT license.

This is the rule that actually matters: compute density per dollar. Hardware controls slow access to the frontier of training but do little to constrain the frontier of inference efficiency, where architectural innovation routes around the bandwidth ceilings the export regime was designed to enforce. A 90% KV cache reduction is, in policy terms, equivalent to relaxing several tiers of the export rules at once, because it changes what a given quantity of restricted hardware can do.

The political economy follows from this. Meta engineers burning 60.2 trillion tokens in 30 days, Microsoft VPs who rarely code topping internal AI leaderboards, Salesforce setting minimum spend floors, Uber’s CTO disclosing the full-year AI budget exhausted in months on Claude Code, and Claude Opus 4.7’s new tokenizer silently inflating input tokens up to 35% at unchanged pricing — all of this is happening against tech stocks at 2018-level P/E premiums with the widest growth-to-valuation gap in seven years. The tokenmaxxing flywheel materially inflates the demand signals feeding vendor valuations and board decks. Any regulatory intervention that meaningfully constrains compute consumption will land into a market priced for unconstrained growth, and any export regime that fails to constrain efficiency gains will simply hand the frontier to whichever jurisdiction optimizes hardest.

Operational posture for this quarter

1. Stop trusting NVD enrichment as a triage signal. Stand up a parallel pipeline that scores CVEs against your own asset graph using vendor advisories, KEV catalog deltas, and at least one commercial enrichment source. Treat any unscored CVE in a production dependency as medium until proven otherwise. The Axios CVE-2026-40175 header injection flaw is almost certainly already in your transitive dependency tree — find it this week.

2. Audit agent authorization scope before audit-ing model behavior. Inventory every OAuth grant, NPM token, MCP server, and AI development tool with write access to production or source control. Anything using MCP STDIO transport, default Anthropic SDK settings, or Cursor with repo-level execution should be reviewed against the Vercel breach pattern. Revoke first, restore narrowly.

3. Add data disposition language to every vendor renewal. Specifically: prohibit transfer of customer data as part of any wind-down, asset sale, or bankruptcy proceeding, and require notification of any training-data licensing arrangement. This is the audit vector regulators will reach for next; getting ahead of it is a one-cycle exercise.

4. Treat compute density, not headline pricing, as your vendor risk metric. If a single tokenizer change can inflate spend 35% at unchanged sticker price, your AI budget is not a function of negotiated rates. Build a per-task cost benchmark you re-run quarterly across at least one frontier-closed and one open-weight option, and price your roadmap against the cheaper path being viable.