Version 11

The Mini Shai-Hulud supply chain campaign has reached its most consequential confirmed scope: CISA issued a formal advisory on the axios npm compromise [1] — a transitive dependency for hundreds of millions of projects — while SANS ISC's fifth TeamPCP update documents first confirmed victim disclosures and narrows axios attribution [5]. A separate TrapDoor campaign simultaneously hit 34+ packages across npm, PyPI, and crates.io [11]. A critical, trivially exploitable vulnerability in Starlette — the ASGI framework underpinning MCP servers (325 million weekly downloads) — now imperils the AI agent infrastructure layer directly [13]. Microsoft has patched four Copilot CVEs [14][15] following Simon Willison's prompt injection disclosure [16], and Google's Threat Intelligence Group has confirmed the first criminal AI-generated zero-day, targeting a 2FA trust assumption [18][19].

Three attack surfaces — software supply chains, MCP server infrastructure, and AI product internals — are now under simultaneous, confirmed active exploitation. No isolated defensive perimeter exists: the developer tooling, AI frameworks, and AI-powered products that accelerate development have become co-equal attack vectors. Meanwhile, AI is generating offensive capability at an institutionally documented doubling rate while also overwhelming the human infrastructure defending open-source software.

The Mini Shai-Hulud supply chain campaign, launched by TeamPCP on May 11, 2026, has reached its most consequential confirmed scope. CISA issued a formal advisory on the axios npm supply chain compromise [1] — axios is a transitive dependency across hundreds of millions of JavaScript projects — and multiple security vendors including Orca Security, Huntress, Tenable, and Microsoft have published axios-specific analyses confirming the compromise [2][3][4]. SANS ISC's fifth TeamPCP campaign update reports first confirmed victim disclosures and an axios attribution that is actively narrowing [5], though the CISA advisory's April 2026 date predates TeamPCP's May 11 launch, creating unresolved ambiguity about whether these represent a single incident or two related ones. The broader campaign scope includes GitHub's theft of 3,800–4,000 internal repositories via a poisoned Nx Console VS Code extension [6][7], CERT-EU's confirmation of a European Commission breach across 30 EU institutions via the Trivy container scanner [8], Mandiant's estimate of 1,000+ compromised SaaS environments [9], and Mistral AI's acknowledgment of 450 repositories being advertised for sale at $25,000 [10]. A separate coordinated campaign, TrapDoor, simultaneously attacked 34+ packages across npm, PyPI, and crates.io to steal wallets and SSH keys [11][12] — signaling that multiple independent actors are now running parallel supply chain operations.

Two AI-specific attack surfaces have crystallized beyond the supply chain layer. A critical, trivially exploitable vulnerability in Starlette — the ASGI framework underlying FastAPI and the MCP servers that connect AI agents to databases, email, and calendar accounts — affects an estimated 325 million weekly downloads [13]. Successful exploitation yields access to all credentials stored by MCP servers, making this a structural vulnerability in the agentic AI stack rather than an isolated application flaw. Microsoft issued patches for at least four Copilot CVEs — CVE-2026-26129, CVE-2026-26164, CVE-2026-33111 (information disclosure), and CVE-2026-26137 (SSRF) [14][15] — following Simon Willison's documentation of data exfiltration in shipping Copilot Cowork via prompt injection [16]. Willison separately reported a systemic side effect of widespread AI security tooling: the curl project is receiving AI-assisted security reports at 4–5 times the 2024 rate, with each requiring high-priority treatment, creating unsustainable maintainer burnout despite no increase in actual finding severity [17].

AI systems are now functioning as attack tools at a newly confirmed level. Google's Threat Intelligence Group intercepted the first confirmed criminal AI-generated zero-day, targeting a hardcoded trust assumption in two-factor authentication logic — a class of path-tracing flaw that AI identifies by modeling user flows through systems rather than scanning for memory corruption [18][19][20]. Claude Mythos Preview, confirmed by AISI as the first AI system to autonomously complete both UK offensive cyber ranges [21][22], has been independently validated by Cloudflare across 50+ repositories, finding it capable of chaining bugs into working exploits that earlier frontier models missed [23][24]. AISI has quantified this trajectory as autonomous AI cyber capability doubling approximately every 4.7 months [25]. On the defensive side, Microsoft's MDASH multi-agent security system independently discovered 16 Windows vulnerabilities, including four critical remote-code execution flaws patched in a subsequent Patch Tuesday [26][27], demonstrating that the same capability is available to defenders.

The governance and capability disclosure dimensions have expanded in parallel. Anthropic's Project Glasswing pairs Mythos's offensive capabilities with a structured disclosure and coordinated remediation program [28], while OpenAI has expanded its Trusted Access for Cyber program to include GPT-5.5 and a specialized GPT-5.5-Cyber variant restricted to vetted security defenders [29]. METR's Frontier Risk Report for February–March 2026 provides independent quantification of frontier model risk trajectories [30]. The debate over NIST's CAISI voluntary framework — whether it evaluates frontier capability or only publicly released models — persists, with AuthMind arguing that Anthropic's decision to withhold Mythos means the most capable AI cyber systems operate outside any public audit [31][32], and AISI's 4.7-month doubling rate making that oversight gap progressively more significant. A Jane Street challenge on the Alignment Forum demonstrated that SVD analysis of model weight differences can crack hidden LLM backdoors [33], adding a weight-level methodology to the emerging field of AI supply chain integrity verification.