Version 13

The Mini Shai-Hulud supply chain campaign (TeamPCP) has confirmed scope across 1,000+ SaaS environments, GitHub's internal repositories, and 30 EU institutions [3][6][4]; a second incident found 73 Microsoft-signed packages with AI-agent-triggered credential stealers, removed by GitHub as a terms-of-service violation rather than a malicious-content warning [10]. SafeBreach Labs bypassed Google Gemini's prompt injection defenses for the second time via crafted WhatsApp messages [11], and Google DeepMind documented malicious websites that serve hidden attack instructions specifically to AI agents [12]. Anthropic's Frontier Red Team reports medium-to-high risk attackers grew from 33% to 56% of banned malicious accounts as AI enables less-skilled actors to perform post-compromise tasks — and MITRE ATT&CK has no identifiers for AI agentic attack orchestration, the mode expected to grow most [19]. Defenses are developing — OpenAI's Lockdown Mode targets the exfiltration vector [18], Anthropic's Glasswing reports 10,000+ critical flaws found across ~200 partners [26] — but autonomous AI cyber capability is documented as doubling approximately every 4.7 months [25].

Anthropic's empirical data shows AI is eroding the skill barrier separating sophisticated attackers from novice ones [19], while MITRE ATT&CK lacks the identifiers needed to track AI agentic orchestration — the attack mode most expected to grow [19]. Repeated bypasses of a major AI provider's patched prompt injection defenses [11], combined with supply chain packages specifically designed to activate in AI coding agents [10], show the attack surface expanding faster than product-layer defenses.

The Mini Shai-Hulud supply chain campaign, launched by threat actor TeamPCP on May 11, 2026, has confirmed impact across a broad range of organizations. CISA issued a formal advisory on an axios npm supply chain compromise [1], while SANS ISC's fifth campaign update documents the first confirmed victim disclosures [2]. Mandiant estimates more than 1,000 SaaS environments were compromised [3]. GitHub confirmed that approximately 3,800–4,000 internal repositories were stolen via a poisoned Nx Console VS Code extension [4][5]. CERT-EU confirmed a European Commission breach spanning 30 EU institutions via the Trivy container scanner [6], and Mistral AI acknowledged that 450 repositories are advertised for sale at $25,000 [7]. Concurrent with TeamPCP, a TrapDoor campaign hit 34+ packages across npm, PyPI, and crates.io [8], and an AntV ecosystem attack faked Sigstore provenance badges across 600+ packages [9], exploiting the trust signals that standard supply chain guidance recommends. A separate incident emerged on June 8: 73 Microsoft-signed open source packages were found to contain credential-stealing code designed to activate specifically when developers opened them in AI coding agents. GitHub removed the packages but described the action as a terms-of-service violation rather than warning that developer systems may be compromised; Microsoft did not publicly raise the possibility of malicious content until days after the removal [10]. It was the second such incident involving Microsoft packages within weeks.

AI-connected products are attack surfaces at multiple layers. SafeBreach Labs bypassed Google Gemini's prompt injection defenses for the second time using a technique called 'Fake Context Alignment,' which embeds malicious instructions in crafted WhatsApp messages so they appear to be legitimate conversation context; the attack covers six messaging platforms — WhatsApp, Slack, Signal, SMS, Instagram, and Messenger — any notification-reading surface Gemini has access to [11]. The same team had previously bypassed Gemini via Google Calendar invites. Google DeepMind separately documented that malicious websites can detect when an AI agent is browsing and serve it hidden content, including instructions buried in HTML comments invisible to human visitors, across six distinct attack types [12]. Microsoft patched four Copilot CVEs after documentation of data exfiltration via prompt injection [13][14], and a critical vulnerability in Starlette — the ASGI framework underlying FastAPI and MCP servers — affects an estimated 325 million weekly downloads [15]. Meta's AI support chatbot was used to take over high-profile Instagram accounts, including the Obama White House account, by asking the bot to substitute a new email address during a password reset; Meta had deployed the chatbot with direct account-modification authority and no identity verification, and issued an emergency patch on May 29, 2026 [16][17]. Simon Willison, analyzing OpenAI's Lockdown Mode feature, introduced the 'Lethal Trifecta' framework: access to private data, exposure to untrusted content, and an exfiltration channel together constitute the structural condition enabling LLM data theft; he argues Lockdown Mode addresses only the third leg, and that its existence implies ChatGPT in default settings does not robustly block determined exfiltration [18].

AI is advancing attack capability empirically. Anthropic's Frontier Red Team analyzed 832 banned malicious accounts and found 67.3% used AI specifically for writing malware [19]. Medium-to-high risk actors grew from 33% to 56% of the total between the two halves of the study — a roughly 1.7-fold increase — and the team found that traditional risk signals such as technique count no longer reliably distinguish sophisticated from novice attackers because AI enables less-skilled actors to perform post-compromise tasks like account discovery and lateral movement [19]. The report identifies a specific institutional gap: MITRE ATT&CK has no identifiers for agentic orchestration, where an AI model chains attack stages and executes with minimal human input [19]. Google's Threat Intelligence Group confirmed the first criminal AI-generated zero-day, targeting a hardcoded trust assumption in two-factor authentication logic [20][21], while Microsoft's MDASH multi-agent system independently discovered 16 Windows vulnerabilities including four critical remote code execution flaws [22][23].

Governance frameworks are falling behind capability on multiple dimensions. AISI evaluated Claude Mythos as the first AI to autonomously complete both UK offensive cyber ranges and measures autonomous AI cyber capability as doubling approximately every 4.7 months [24][25]. Anthropic's Project Glasswing, now at approximately 200 partner organizations across 15+ countries covering power, water, healthcare, communications, and hardware, reports more than 10,000 high- or critical-severity flaws found using Mythos Preview [26]. Anthropic justifies the expansion with a timing argument: other AI companies are projected to have Mythos-class models within 6–12 months, making controlled deployment under structured conditions preferable to waiting [26]. AuthMind and the Turing Institute's CETAS argue that this expansion deploys Mythos outside any CAISI review, which is precisely the unaudited frontier deployment their governance critique describes [27]. The NIST CAISI framework, formalized as the US pre-deployment compliance gate with agreements covering Google, Microsoft, and xAI [28], has not addressed the distinction between models submitted for review and those deployed under programs like Glasswing.