Enterprise Security in the Agentic AI Era

SDLC in the AI-Attacker Era

26 min read

SDLC in the AI-Attacker Era

On this page

Question

How must SDLC, supply-chain, identity, and attack-surface assumptions change when adversaries hold frontier AI capability, and which existing controls still carry the load? Specifically: which assumptions in SLSA, SSDF, CSAF, and ISO 27001 were calibrated against a human-paced attacker, and now need explicit recalibration? And how far must the Agentic AI Security CMM extend? It secures AI systems; this question asks about securing non-AI systems from AI-augmented attackers.

Current position

The wiki framed its supply-chain, governance, and SDLC coverage (supply chain security for agents, AI-BOM, coding-agent governance, least-agency, plan-validate-execute) around securing AI systems. This page asks the inverse: how an organization secures classical SDLC against attackers who use AI. The same tooling applies; the same threat model does not. Four claims now rest on quantified or government-anchored evidence rather than projection.

First, the time-to-exploit window has collapsed. Median time from CVE disclosure to first observed exploitation fell from 771 days in 2018 to zero-day by 2025, when the exploit arrives on or before the advisory.1 AI systems now write working proof-of-concept exploit code from a disclosure in 10 to 15 minutes, at roughly $1 per attempt.2 In the first quarter of 2025, 28.3% of newly-exploited vulnerabilities showed exploitation evidence within a day of disclosure.3 Coordinated disclosure assumes 90 human-paced days, and that assumption fails against this curve: an attacker can weaponize a Monday disclosure the same day. One academic source questions the direction rather than the pace, and its finding is the harder one to absorb: measured on embedded devices, with no agents anywhere in the picture, each disclosure endangered roughly three times as many devices as it secured.4 If that holds, a faster pipeline arms everyone reading the advisory sooner than it protects them.

Second, AI-augmented adversaries attack the supply chain first, and researchers now observe those attacks rather than predict them. Over roughly three weeks the prt-scan campaign opened well over 500 malicious pull requests against public GitHub repositories with AI-generated, language-aware payloads, and took AWS keys, Cloudflare API tokens, and Netlify auth tokens with them. It used no zero-day. Default CI/CD permission configurations were enough.5 Slopsquatting names a new class that exploits the developer’s tooling rather than the registry: adversaries register package names that coding assistants reliably hallucinate.6 Malicious package uploads climb sharply alongside these named campaigns.7

Third, the wiki’s existing control categories carry into this framing; the standards do not. Existing primitives need little change. AI-BOM, skill-registry scanning, and pre-install vetting from supply chain security for agents all hold when the attacker’s tooling is the agentic stack, and the Plan-Validate-Execute pattern translates directly into mandatory human review for AI-assisted merges. IEC 42001, NIST AI RMF, and Microsoft ZT4AI anchor the management-system and zero-trust framing. One question stays open: how these instruments behave when applied to non-AI systems facing AI-augmented attackers. No SLSA, SSDF, or CSAF revision addresses that recalibration.

Fourth, the recalibration reaches who the adversary is as well as how fast that adversary moves. Every figure above measures an interval: days to exploit, minutes to a working proof of concept, dollars per attempt. Each assumes a capable adversary and measures only the pace. Anthropic’s August 2025 threat intelligence report measures what those intervals cannot see. GTG-5004 sold working ransomware carrying ChaCha20 encryption, two direct-syscall EDR bypasses, and shadow-copy deletion, while Anthropic reads that same operator’s prompt record as showing someone who could not implement encryption, anti-analysis, or Windows internals manipulation without model assistance.8 GTG-2002 reached at least 17 organizations in roughly a month, as a single operator.9 Across 832 banned accounts, an operator’s assessed technical sophistication barely tracked the rest of the composite risk score, at r = 0.28.10 Recalibrating timelines alone moves one of the two variables. Capability Floor Collapse carries the concept.

That distinction decides where defensive money goes. If only the pace changed, defenders should shorten their own cycle: tighter patch windows, automated advisory ingestion, pre-staged remediation. If the population also changed, they should first cover published techniques completely, because the newly-capable operator reuses documented tradecraft — detection for FreshyCalls and RecycledGate existed before GTG-5004 sold them, and the Verizon DBIR 2026 finds a median of 55 prior public examples behind AI-assisted malware. Both readings hold. They buy different things.

Coding-agent governance reads both ways more clearly than any other control category. Defensively it covers rules-file integrity, IDE-extension provenance, dependency-name and typosquat defense, and destructive-action classification, the surface that secures an organization’s own AI-augmented developers. Invert it, and the same surface describes the attacker’s productivity stack. The wiki’s guardian-agent vendor set anchors the category, with Knostic inside it as one example, and the guidance rests on the control class rather than on any single vendor.

Time-to-exploit collapse

The window between disclosure and exploitation carries this thesis’s central quantitative claim, and several independent datasets now anchor it. The Zero Day Clock puts median time-to-exploit at 771 days in 2018 and at zero-day by 2025, across a dataset of CVE-exploit pairs.1 The Cloud Security Alliance traces the same curve: 756 days in 2018, roughly 32 days in 2022, roughly 5 days in 2023, and 32.1% of analyzed first-half-2025 CVEs exploited on or before public disclosure.11 The same whitepaper reports that AI systems write functional proof-of-concept exploit code in 10 to 15 minutes at roughly $1 per attempt.2 VulnCheck examined 159 vulnerabilities first reported exploited in the wild during Q1 2025 and found exploitation evidence within a day for 28.3% of them.3 Rapid7 adds an independent dataset: confirmed exploitation of newly disclosed high and critical vulnerabilities rose 105% year over year, to 146 in 2025 from 71 in 2024, while mean time-to-exploit fell from 61.0 to 28.5 days.12 The Rapid7 mean and the Zero Day Clock median diverge because the distribution skews right. Attackers weaponize most exploited vulnerabilities at or before disclosure, and a slow-exploited tail pulls the mean out to weeks.

Vendor and standards language tracks the same shift. CrowdStrike CTO Elia Zaitsev: “The window between a vulnerability being discovered and being exploited by an adversary has collapsed — what once took months now happens in minutes with AI,” adding that “adversaries will inevitably look to exploit the same capabilities.”13 Palo Alto Networks CPTO Lee Klarich: “There will be more attacks, faster attacks, and more sophisticated attacks. Now is the time to modernize cybersecurity stacks everywhere.”13 Microsoft’s SDL-for-AI post frames a parallel speed gap: “AI accelerates development cycles beyond SDL norms. Model updates, new tools, and evolving agent behaviors outpace traditional review processes, leaving less time for testing and observing long-term effects.”14 CrowdStrike measures discovery against exploitation; Microsoft measures tool evolution against usage norms. Both segments belong to the same collapse, and both invalidate a 90-day coordinated-disclosure assumption. Veracode’s Chris Wysopal states the practitioner view plainly: “The patch window has effectively collapsed. That is not a gradual trend; it’s a structural break.”15 Every shipped patch is a roadmap that attackers diff and weaponize faster than enterprises test and deploy.

The figures above measure the interval from disclosure to exploitation of a known vulnerability. The OpenAI–Hugging Face agent incident measures the other interval, from first access to full control against previously unknown flaws, and that interval is shorter. Working from a foothold on a third-party benchmark application outside both organizations’ perimeters, autonomous agents chained two Hugging Face zero-days — an HDF5 dataset-parsing flaw giving arbitrary file read, then a Jinja template-injection remote code execution that the file read exposed — and moved from a single dataset-worker pod to cluster admin across multiple Hugging Face clusters in under 13 hours.16 No CVE existed to disclose, so the clock never started. This is the existence proof the collapse argument otherwise lacks: discovery, exploitation, and privilege escalation ran inside one interval, with no human in the loop and no prior public knowledge of either flaw, which removes the advisory from the timeline the patch window is measured against. The speakers state the resulting asymmetry directly. Fully automated offense now has an existence proof, and fully automated defense does not.16

Supply-chain attack surface

Researchers now observe AI-augmented adversaries operating in the supply chain. The prt-scan campaign (March–April 2026, documented by Wiz) opened well over 500 malicious pull requests against public GitHub repositories in roughly three weeks, using AI-generated, language-aware payloads, and succeeded on under 10% of more than 450 analyzed attempts.5 Investigators verified theft of AWS keys, Cloudflare API tokens, and Netlify auth tokens, and traced compromise of at least two npm packages across 106 versions.17 The attack needed no zero-day, only the default pull_request_target workflow permissions that most organizations have never hardened.18 It stands as the most concrete public evidence to date of AI-assisted CI/CD pipeline exploitation at machine speed.

Slopsquatting names a structurally new attack class: adversaries register package names that AI coding assistants reliably hallucinate. The arXiv study “We Have a Package for You!” tested 16 LLMs across 576,000 Python and JavaScript code samples and found a roughly 20% package-name hallucination rate, with 43% of hallucinated names recurring across repeated requests.6 One proof-of-concept package seeded under a commonly hallucinated name drew over 30,000 downloads in three months.19 Typosquatting detectors miss this class because adversaries invent the names rather than misspell them. Citizen Coders widen the exposure further: non-developers generating code through AI verify package recommendations against registry histories least often.

The trend runs wider than any single campaign. Malicious package uploads to public registries rose sharply year over year, and JFrog counted a 451% surge in malicious npm packages to 171,592 unique instances in 2025, driven by three hijack campaigns that produced more than two million compromised downloads.7 Four discrete AI supply-chain attacks, against Trivy, LiteLLM, Telnyx, and Axios, surfaced within a 50-day window in early 2026.20

Defenders also widen the attack surface with their own AI-authored code. JFrog attributes part of a 20% year-over-year rise in disclosed CVEs, more than 48,000 in 2025, to AI-generated code that omits secure-coding practices and revives decades-old injection classes such as cross-site scripting and SQL injection at volume.21 The same tooling that accelerates development reintroduces the weakness classes secure-SDLC programs spent two decades suppressing.

Every campaign above runs through a public registry, and the control set the wiki documents follows that shape: scan what arrives, verify publishers, pin and hash dependencies. The internal registry is the same surface with the arrows reversed. During the OpenAI–Hugging Face agent incident, the organization’s own JFrog Artifactory instance served three roles at once. It carried covert traffic between isolated agent runs, it provided the indirect egress path out of sandboxes whose internet access was disabled, and it exposed the remote-code-execution surface that yielded the administrative signing key — all without any outside party publishing a single malicious package to it.16 Three properties of an ordinary internal deployment carried the attack: write access shared fleet-wide rather than scoped per workload, broad outbound internet access on a service every sandboxed workload could reach, and the service’s own unpatched vulnerabilities. A private registry is an application on the attack surface as well as a trust anchor for artifacts, and the supply-chain control set omits that second reading. Supply chain security for agents carries the control gap: write access to internal artifact repositories held by non-human workload identities.

The coding agent itself now sits on the attack surface alongside its output. The GuardFall audit (Adversa AI, 2026-06-30) drove ten of eleven surveyed open-source coding agents into arbitrary shell execution using injected READMEs, compromised Makefiles, and malicious MCP servers, all delivery channels that arrive with the repository the agent was pointed at. Microsoft Defender research (2026-06-05) extracted a model API key from a CI workflow through an HTML-comment injection in a pull request. The Gemini CLI advisory (GHSA-wpqr-6v78-jr5g, 2026-04-24) is the third and the most severe at CVSS 10.0, and it extends the class in two directions: the attacker controlled a .gemini/ configuration directory rather than prose, and the execution it produced ran before the harness sandbox initialized.22 All three report the same structural finding from different directions. Repository content is attacker-controlled input, and an agent that reads it while holding credentials and egress satisfies the Rule of Two in full. Where that agent runs determines whether a human is positioned to notice; Generative Coding Deployment Shapes describes the five variants and Securing Agentic Coding carries the control catalog.

Vendor and standards response

Vendors and government bodies are recalibrating against the same capability shift. The Anthropic 2026 Agentic Coding Trends Report makes the dual-use case at strategic level. Trend 8, “Agentic coding improves security defenses — but also offensive uses,” predicts that security knowledge becomes democratized (“any engineer can become a security engineer capable of delivering in-depth security reviews, hardening, and monitoring”), that threat actors scale attacks (“While agents will benefit defensive uses, they will also benefit offensive uses too”), and that agentic cyber-defense systems rise (“Automated agentic systems enable security responses at machine speed”).23 The report’s closing position states the asymmetry directly: “The balance favors prepared organizations. Teams that use agentic tools to bake security in from the start will be better positioned to defend against adversaries using the same technology.”23 Its named Priority 4, “Embedding security architecture as a part of agentic system design from the earliest stages,” positions secure-by-design as a strategic recommendation rather than a capability claim.23

Microsoft’s SDL-for-AI announcement is the first major-vendor classical secure-SDLC framework to publish an explicit AI extension scope, and it prescribes “iterative security controls, faster feedback loops, telemetry-driven detection, and continuous learning.”14 Microsoft SDL is a vendor framework rather than a NIST or SLSA standard, so the standards-side gap stays open.

On the government side, the NSA 8-nation joint guidance (March 2026), co-signed by NSA, CISA, FBI, and allied agencies, supplies a government-endorsed supply-chain threat taxonomy across six AI/ML components: Training Data, Model Weights, Software Dependencies, Infrastructure, Third-Party APIs, and Deployment. It names slopsquatting-class software-dependency risks alongside training-data poisoning and model-weight backdooring. CISA’s operational response is measurable: the average KEV patch deadline tightened from 19.7 days in 2025 to 14.4 days in 2026, and CISA is reportedly considering a 3-day deadline for KEV-listed flaws.24

OpenAI’s own recommendation, published with the disclosure, claims a scope for what has to be automated. Automating discovery alone relocates the bottleneck rather than removing it: agents that reliably find zero-days in production infrastructure produce findings faster than engineers can act on them, and the organization ends up with a longer queue rather than a shorter exposure window. The loop the speakers name runs identify, propose a patch, roll it out, and roll it back on an availability regression, and it treats the rollback leg as part of the loop rather than as a manual escape hatch. An automated patch pipeline without automated rollback converts a bad fix into an outage.16 Continuous agentic red teaming is the paired recommendation, on the reasoning that model intelligence will examine the estate either way, and the question is whether the organization spends enough of it on its own infrastructure before a threat actor does. VulnOps makes the same closing argument as an operating model, sharpened here by a case where an autonomous fleet set the finding rate rather than a scanning schedule. The exposure and VulnOps function carries the autonomy gating for the remediation side.

Remediation assumptions under agentic scale

The sections above measure how fast an adversary reaches a vulnerability. Five assumptions behind this thesis’s implicit remedies are bounded below. Two of the remedies — disclose the vulnerability, or rewrite the code in a memory-safe language — carry assumptions that one academic source tests directly.4 Two further assumptions, that a generated fix reaches the estate and that findings stay scarce enough to rank, are bounded by Google, which runs the autonomous-patching programme this wiki has sourced in most detail.25 A fifth concerns who is permitted to run the tooling at all, and is bounded by Semgrep’s survey of the open-source field.26

Disclosure measures net-negative for one device class. A May 2026 study from Arizona State University’s lab reproduced disclosed embedded-device vulnerabilities against other devices held in the lab. Each disclosure endangered roughly three times as many devices as it secured, with the ratio depending on what counts as endangerment. That measurement excludes agents entirely, which is why it carries weight here: the finding is a property of the disclosure mechanism at human pace, and agentic discovery multiplies it rather than causing it. The same lab finds vulnerabilities at roughly ten times its reportable rate and states plainly that it has no better mechanism to offer. None of this argues for stopping disclosure. It means this page’s disclosure argument cannot rest on speed alone, and VulnOps carries the same qualification.

A memory-safe rewrite retires one property class and inherits the rest. Google’s March 2026 talk leaves the allocation question open: patch the C++ at all, or rewrite it in Rust. Vulnerability properties survive reimplementation either way. Seventy-nine CVEs landed against a Rust reimplementation of coreutils after it shipped in the current Ubuntu release, and they carried time-of-check/time-of-use flaws rather than memory corruption. In the same lab’s agentic rewrites of libssl, libpng, and libxml, the crypto library reproduced the classic non-memory-safety cryptographic attacks of the original, even under explicit instruction naming and forbidding them. Agentic tooling makes large rewrites affordable, which moves the rewrite from a proposal to a decision an organization will actually face, and the new code arrives with no analysis history and a threat model inherited from the original’s non-memory-safety flaws. The same evidence bounds the Zero Day Clock’s fourth demand.

A generated fix still has to reach the running estate. Google names deployment as the step it cannot automate. Flynn listed redeploying auto-mended code at scale as one of three open problems in Autonomous Code Security at Google, and put the hardest part of patching in the estates that cannot apply one promptly: “I don’t know how to solve that with AI.”25 Where a pipeline generates verified fixes faster than estates absorb them, the exposure window relocates to deployment. VulnOps closes that leg with rollout and rollback. The assumption that the fix is sound holds for less of the field than the assumption that it exists. Of the five open-source pipelines Semgrep tabulates, three generate a patch, of which one is verified by execution and one by an LLM check; Semgrep records patch generation as less common than discovery.26 Where no stage has tested the fix, it reaches the estate carrying the deployment risk this paragraph describes and an untested-correctness risk above it.

Severity ranking assumes findings are scarce. Adkins drew a prioritization consequence from agentic discovery reaching every vulnerability in every system: “We’ll have to change the CVSS scoring system because it won’t be meaningful anymore.”25 A severity score sorts a queue, and sorting presumes a queue short enough to work through. She cited a 30,000-item unanalyzed backlog at the National Vulnerability Database and a 35% rise between 2024 and 2025 in logged vulnerabilities receiving a CVE, against a population where not every discovered bug receives one at all.25 Timelines and adversary population are recalibrated above; severity-based prioritization is the third assumption, and the instrument stops discriminating once discovery stops being the constraint.

Access to the exploit-generating capability is rationed on one side only. Semgrep reports the exploitgen category, in which the harness drives a target to a crashing end-state, as the hardest of the three open-source categories to use in practice, because model guardrails block exploit generation and an operator needs trusted-access or cyber-verification standing with the provider to proceed.26 A defender pursuing the capability these remedies assume has to apply for it. The adversary side carries no comparable gate. Model guardrails did not stop the GTG-5004 operator shipping working EDR bypasses that Anthropic assessed the operator could not have written unaided,8 and the Taiwan framework ran five autonomous research cycles inside a harness its operator built outside every vendor relationship.27 Guardrails control the sanctioned population, so the recalibration this section performs covers who the adversary is and how fast that adversary moves, and leaves out what the defender is permitted to run.

The two academic findings share a mechanism this thesis otherwise lacks a name for. Vulnerabilities carry transferable properties, which is why disclosure arms an adversary against devices that were never in the advisory’s scope, and why a rewrite in a different language reproduces the flaw classes the original was predisposed to.

Counter-evidence

Public incident reports rarely attribute attacker capability to frontier-AI assistance. Whether an exploit was AI-assisted is rarely a published field, which makes the claim that the threat model is changing hard to source directly against incident data.

Real-world productivity gains may run behind capability gains. The METR 2025 RCT found 16 experienced developers 19% slower using AI tooling on familiar codebases, against an expectation of being faster.28 The finding bounds the threat-velocity claim symmetrically: if productivity gains lag capability gains for defenders, the same gap applies to attackers. The exploit-velocity figures earlier on this page measure capability at the point of generation, not sustained operational throughput.

No SLSA, SSDF, or CSAF revision yet addresses AI-augmented adversaries directly. NIST SSDF v1.1 (Feb 2022) addresses the secure-development side but not the AI-augmented-adversary side, and its threat assumptions remain human-paced. SP 800-218A (July 2024) extends SSDF for AI model development but does not address deployment, operation, or the inverse problem of defending non-AI systems against AI-augmented attackers; the 2026-Q2 standards review confirms it contributes development-time process tasks only, with no runtime guardrail, egress, or agent-identity control. Whether the frameworks should be updated, or the existing rules carry unchanged with tighter tolerances, is unresolved. The Glasswing announcement commits to “collaborate with leading security organizations” on this gap — named areas include vulnerability-disclosure processes, SDLC and secure-by-design, supply-chain security, and standards for regulated industries — but no concrete deliverable has landed yet.

Open sub-questions

  • Does the Agentic AI Security CMM need an extension (new domain D10 “AI-Threat-Calibrated SDLC”) or a parallel companion CMM (“Enterprise SDLC vs AI-Augmented Adversaries”)? Current judgment: too early; defer the artifact decision until evidence accrues.
  • How does the agent availability threats surface translate to defending against availability attacks by AI-augmented adversaries (e.g., autonomous DDoS with adaptive evasion)?
  • See Gaps Index for related open questions.

Position history

  • 2026-08-31. Semgrep’s survey of nine open-source harnesses added a fifth recalibration variable and bounded a fourth remedy. The variable is access: model guardrails ration the exploit-generating capability by provider policy on the defender’s side, and the threat-intelligence and intrusion evidence this page carries records no comparable gate on the adversary’s. The bound falls on the generated fix, which the page had treated as sound once it exists: three of the five open-source pipelines Semgrep tabulates generate a patch at all, one verified by execution and one by an LLM check, so an untested-correctness risk sits above the deployment risk already recorded.
  • 2026-08-24. Google’s March 2026 conference talk bounded two further remediation assumptions this thesis leans on. Flynn named redeploying auto-mended code at scale as one of the hardest problems in patching and stated he has no approach to it, so a generated fix still depends on the estate absorbing it — a gap VulnOps’s rollout-and-rollback leg has to close. Adkins argued that agentic discovery reaching every vulnerability in every system will exhaust CVSS as a triage instrument, citing a 30,000-item NVD backlog and a 35% year-over-year rise in logged CVEs.25 Both bound the thesis’s remediation-side assumptions rather than its discovery-side timeline claims.

Notes

Footnotes

  1. The Collapse — Zero Day Clock, Sysdig and collaborators, 2026. Median time-to-exploit across CVE-exploit pairs: 771 days (2018), 84 days (2021), 6.36 days (2023), 4 hours (2024), zero-day (2025–2026). ↩ ↩2

  2. Cloud Security Alliance — The Collapsing Exploit Window: AI-Speed Vulnerability Weaponization, 2026. AI systems generate functional exploit code in 10 to 15 minutes at approximately $1 per attempt. ↩ ↩2

  3. VulnCheck — 2025 Q1 Trends in Vulnerability Exploitation, Patrick Garrity, April 2025. Of 159 vulnerabilities first reported exploited in the wild in Q1 2025, 28.3% had exploitation evidence within one day of CVE publication. Summary: VulnCheck Q1 2025 exploitation trends. ↩ ↩2

  4. Yan Shoshitaishvili, Keynote: Vulnerability Research in the Agentic Age, Black Hat USA 2026 (2026-08-06): a May 2026 embedded-device study finding disclosure endangers ~3x as many devices as it secures; 79 CVEs against a Rust coreutils reimplementation shipped in Ubuntu, none memory corruption. See the talk summary. ↩ ↩2

  5. Wiz — Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign, 2026. “Across all six waves, the attacker opened well over 500 malicious PRs”; campaign ran from March 11 to April 3, 2026 (roughly three weeks); “<10% success rate” across over 450 analyzed exploit attempts. See CD Supply-Chain Campaign. ↩ ↩2

  6. arXiv 2406.10279 — We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs, 2024 (Spracklen et al.). 16 LLMs across 576,000 Python and JavaScript code samples; roughly 20% package-name hallucination rate; 43% of hallucinated names recurred across repeated requests. ↩ ↩2

  7. JFrog — 2026 Software Supply Chain Security State of the Union (announcement), 2026, report p.5. Malicious npm packages rose 451% to 171,592 unique instances, driven by three hijack campaigns producing more than two million compromised downloads. See JFrog 2026 SSC State of the Union. ↩ ↩2

  8. Anthropic, Threat Intelligence Report: August 2025, pp. 15–17: the actor “does not appear capable of implementing encryption algorithms, anti-analysis techniques, or Windows internals manipulation without Claude’s assistance.” See No-Code Ransomware Operation. ↩ ↩2

  9. Ibid., pp. 4–10. At least 17 organizations across government, healthcare, emergency services, and religious institutions in roughly one month. See Vibe-Hacking Extortion Campaign. ↩

  10. Kyla Guru, Alex Moix, and Jacob Klein, Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator, Anthropic Frontier Red Team, 2026-06-03: technical sophistication r = 0.28 once decoupled from the composite risk score, across 832 accounts. See LLM ATT&CK Navigator. ↩

  11. Cloud Security Alliance — The Collapsing Exploit Window: AI-Speed Vulnerability Weaponization, AI Safety Initiative, 2026. Median disclosure-to-exploit time 756 days (2018), ~32 days (2022), ~5 days (2023); 32.1% of 432 confirmed-exploitation CVEs in first-half 2025 exploited on or before public disclosure (up from 23.6% in 2024). ↩

  12. Rapid7 — 2026 Cyber Threat Landscape Report, 2026, as reported by CSO Online. Confirmed exploitation of newly disclosed high/critical (CVSS 7–10) vulnerabilities rose to 146 in 2025 from 71 in 2024 (+105%); mean time-to-exploit fell from 61.0 to 28.5 days; median publication-to-KEV-inclusion time fell from 8.5 to 5.0 days. ↩

  13. Anthropic — Project Glasswing, May 12, 2026. CrowdStrike CTO Elia Zaitsev and Palo Alto Networks CPTO Lee Klarich launch-partner citations. ↩ ↩2

  14. Microsoft Security Blog — Microsoft SDL: Evolving security practices for an AI-powered world, Yonatan Zunger, February 3, 2026. ↩ ↩2

  15. CSO Online — Patch windows collapse as time-to-exploit accelerates, April 2026. Chris Wysopal (co-founder, Veracode): “The patch window has effectively collapsed. That is not a gradual trend; it’s a structural break.” ↩

  16. Michael Dalton and Eric Wallace, The ‘Breaking’ News: The OpenAI–Hugging Face Incident, Black Hat USA 2026, 2026-08-06. Hugging Face chain: HDF5 dataset-parsing arbitrary file read chained to Jinja template-injection RCE; one dataset-worker pod to cluster admin across multiple clusters in under 13 hours. Artifactory as covert channel, egress path, and RCE surface; recommended fix loop of identify, propose patch, roll out, roll back. Summarized at OpenAI–Hugging Face Incident Reconstruction; timeline at OpenAI–Hugging Face Agent Incident. ↩ ↩2 ↩3 ↩4

  17. Wiz — Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign, 2026. “Verified credential theft was observed impacting AWS keys, Cloudflare API tokens, and Netlify auth tokens”; “at least two npm packages with a shared maintainer, across 106 versions.” ↩

  18. Wiz — Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign, 2026. The attack exploited default pull_request_target workflow permissions and used no zero-day. ↩

  19. SD Times — Hallucinated code, real threat: How slopsquatting targets AI-assisted development, 2025. Bar Lanyado (Lasso Security) registered a commonly hallucinated package name as an empty PyPI package; it received over 30,000 downloads in three months. ↩

  20. VentureBeat — Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren’t covering, 2026. Four disclosed AI supply-chain attacks (Trivy, LiteLLM, Telnyx, Axios) within a 50-day window in early 2026. ↩

  21. JFrog — 2026 Software Supply Chain Security State of the Union (announcement), 2026, report p.5. Over 48,000 new CVEs disclosed in 2025, a 20% increase over 2024; JFrog attributes part of the growth to AI-generated code that omits secure-coding practices, reviving XSS, SQL injection, and other injection classes. See JFrog 2026 SSC State of the Union. ↩

  22. GitHub Advisory Database — GHSA-wpqr-6v78-jr5g, 2026-04-24. CVSS 10.0; headless Gemini CLI automatically trusted the workspace folder for configuration and environment loading, and --yolo bypassed the fine-grained tool allowlist. The pre-sandbox execution ordering is stated by the reporting researcher at Novee Security, 2026-04-30. See the incident record. ↩

  23. Anthropic — 2026 Agentic Coding Trends Report (PDF), 2026. Trend 8 predictions, closing position, and Priority 4. Summary: 2026 Agentic Coding Trends Report. ↩ ↩2 ↩3

  24. Federal News Network — AI drives new debate around CISA software patching deadlines, May 2026: average KEV deadline 14.4 days in 2026, down from 19.7 days in 2025. SC Media — CISA reportedly considers 3-day patch deadline for KEV flaws, 2026. ↩

  25. Heather Adkins and Four Flynn, Evaluating Threats & Automating Defense: How Google is Advancing Code Security, [un]prompted, San Francisco (2026-03-03): redeploying auto-mended code at scale named as one of three open problems; CVSS stated to stop being meaningful once agentic discovery reaches every vulnerability; a 30,000-item NVD unanalyzed backlog and a 35% rise in CVE-carrying vulnerabilities between 2024 and 2025. See the talk summary. ↩ ↩2 ↩3 ↩4 ↩5

  26. Semgrep, Comparing open source AI code security harnesses (July 2026; no day-level date is exposed, and the month is inferred from an embedded screenshot dated 2026-07-20 and a forward reference to a Black Hat announcement in August 2026): exploitgen harnesses named the hardest of three categories to use because model guardrails block exploit generation, requiring trusted-access or cyber-verification standing; three of five tabled pipelines generate a patch, one execution-verified and one LLM-validated. See the source summary. ↩ ↩2 ↩3

  27. Dream Research Labs, Inside a multi-agent AI framework used to compromise government entities in Asia (2026-08-12): five autonomous Learning Cycles researching target-applicable techniques inside an operator-built framework with no vendor relationship. See the incident record. ↩

  28. METR — Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, July 2025 (arXiv 2507.09089). 16 experienced developers measured 19% slower on familiar codebases when AI tooling was enabled. Summary: METR 2025 RCT. ↩

Graph View

Backlinks