The Engineer

Why pickle over a socket is always RCE

Pickle has no safe mode for untrusted input. __reduce__ lets a payload name any callable. So pickle.loads() on bytes from an unauthenticated socket is remote code execution for anyone with L4 access. SGLang's multimodal runtime binds a ZeroMQ ROUTER socket and does exactly that (CVE-2026-93088, CVSS 9.8). The advisory does not list the default bind address. Check each deployment and treat it as exposed until the bind is confirmed. A GPU inference node holds model weights, prompt and response traffic, and often broad cloud credentials in the same process.

MCP Atlassian is the identity version

The HTTP MCP endpoint runs with operator permissions. Any request without per-user identity inherits the operator's reach into Atlassian (CVE-2026-77244, 10.0; CVE-2026-77254, 9.1). This failure was predictable once MCP servers moved from single-user local processes to shared network services: the server's credential becomes everyone's credential. Upgrading to 0.22.0 closes this endpoint; the authorization model is unchanged. The class fix is mechanical. Every HTTP-transport MCP server now holding production tokens has to authenticate the caller and act with that caller's scoped token.

Unsloth: a UI click crossed a trust boundary

CSO reports that in Unsloth Studio, selecting a model in the picker could run that repo's Python. A picker is for browsing. Wiring the click to repo code turns looking into running. The mechanism isn't disclosed. The shape matches the familiar trust_remote_code and pickle-checkpoint paths. A model repository is a code dependency, and the loader inherits its risk. Fine-tuning workstations are usually the most over-privileged machines in an ML org. Per CSO, the exposure covered credentials, data and model artifacts.

Strip the vendor names and all three treat reachability or a UI event as authorization. These are boring trust boundaries that teams already know how to build.

What the pattern means for the triage queue

SANS makes a quieter point that changes triage: 11 of the 16 KEV-listed flaws in its ledger are scored CVSS 0 (unscored, not low), including the Apple zero-day and both Citrix NetScaler entries. A dashboard sorted by score puts confirmed exploitation below theoretical 9.8s. Sort on KEV membership first, then reachability, and use score as the tiebreaker. The AI-tier CVEs here are high-scored and loud. The entries that get skipped are the quiet, exploited ones, and in this ledger that is 11 of the 16.

The arithmetic that defeats a per-account rate limiter

OpenAI didn't do the division, so here it is. 16,000 requests across 4,000+ accounts over two days is under four requests each. That is roughly two per day. Nobody ships a threshold that low to paying users. The campaign grew to 15,000+ accounts and ran for about three weeks before the aggregate signal fired. Disruption took another three to four days. A per-account quota would never trip on that profile. Neither would an anomaly threshold or a heavy-user allowance. The campaign was visible only as a cross-account shape.

Encrypted reasoning behaved as a bearer token

The attribution to Moonshot AI matters less than the technique. Attackers copied encrypted reasoning out of conversation A, pasted it into conversation B, and asked the model to decrypt and transcribe it. If ciphertext produced in one context decrypts in another, the encrypted blob is a portable bearer token. The serving layer holds the key. Any context that presents the ciphertext gets it decrypted into the model's working context. That is a confused deputy. CyberScoop frames it correctly as a logic flaw, not a crypto break. The attacker decrypted nothing. No database was touched.

Hidden is not secret: anything the model can see in context, a motivated user can eventually coax out.

Where this lands in application code

The structural fix is to bind every client-held ciphertext to its originating context with AEAD associated data. Put tenant, conversation and session IDs in the associated data. Use per-tenant keys and short TTLs. A replayed blob then fails decryption, and the model's refusal stops being the control. The second exposure depends on how a backend calls provider APIs. Some backends forward client-supplied conversation history, reasoning items included, straight to a reasoning API. In that setup any end user can inject a foreign reasoning blob and make the org key the distillation proxy. The account that gets flagged is the one that owns the key. Store conversation state server-side. Reject reasoning items that didn't originate in the same conversation. Attach a per-end-user identifier to every request so provider-side enforcement targets the abuser, not the whole org.

Detection has to move to the cluster

The only layer that worked here was cross-account behavioral clustering. The signals are prompt-template similarity, signup velocity, payment and device linkage, and ASN concentration. Build it. Then replay a synthetic campaign of 1,000 accounts at four requests each and confirm it fires. Budget for false positives, because legitimate users following the same tutorial look like a coordinated cluster. Assume the next campaign runs at two requests per account, not four.

Curl tripwires are already dead

A single run of curl, tcpdump or a throwaway Python script used to justify a look. Coding agents now run them all day. In the Hugging Face incident the sensors saw the activity and never paged anyone. Each individual action matched a normal workload. The aggregate did not. Credentials were used from several environments, workloads minted tokens they had never touched, and there were 180+ VPN enrollments. Any detection rule keyed on binary or tool rarity is either muted already or will be soon. The change I would make is to rewrite the top ones as principal-keyed sequence rules: a secrets-manager read followed by a curl upload, where each event alone is legitimate.

The validator is the product

Google's PageBreak fires a real payload at a running app for each hypothesis. For XSS it injects JS and watches it execute. For path traversal it writes a world-readable file. For RCE it triggers an outbound DNS request. Findings it cannot confirm deterministically are not ticketed. They become seeds for later scans. The oracle pins precision, and recall grows as the validator library grows. This is good engineering, and it is why Gemini 3.5 Flash can carry real weight: when verification is cheap and deterministic, per-call model quality can be traded for sampling volume. For LLM-based SAST or pentest tooling, built or bought, the oracle is the spec to check. Two numbers settle it: the percentage of findings a deterministic validator confirmed, and where the unconfirmed ones go. If they go into Jira, the buyer is paying for false positives.

Correlation needs a join key. Detection only works if every agent has an identity to correlate on.

Attribution has to exist first

Perplexity's open-source Numbat makes the dependency concrete. It is a Go binary that hooks into Claude Code, Codex and others. It ships 52 CEL rules, including multi-event sequences, and runs fleet-wide via MDM. None of that helps if agents run as the human with the same credentials and session. In that setup the agent's curl and an attacker's curl cannot be separated. TLDR IT frames the same problem for always-on agents like Dots. The agent gets a durable workload identity with an owner, sponsor and expiry. Every privileged credential is minted on demand, with policy evaluated at mint time. Agent workloads are denied egress to the cloud metadata service at 169.254.169.254, so SDK default chains cannot silently fall back to IMDS.

What I would run first

I would pilot Numbat in observe-only mode on 10-20 endpoints for two weeks and export OTLP into the existing pipeline. Sequence detection, offboarding and kill switches all depend on attribution first. The gate for enabling any blocking hook is the per-rule false-positive rate measured over those two weeks.