The Numbers First
Before the narrative, the data. Six months. Six digests. This is what the numbers show:
28,649,024 — new secrets exposed on public GitHub in 2025 alone, a 34% year-over-year increase. The largest single-year jump in GitGuardian's five-year reporting history.
64% — the percentage of credentials confirmed as leaked in 2022 that were still active and exploitable in January 2026. Four years after detection. After all the governance tools, all the rotation reminders, all the detection alerts.
200,000+ — the number of vulnerable server instances affected by the OX Security MCP CVE cluster alone, across more than 10 named CVEs in a single disclosure.
47,000 — machines backdoored by TeamPCP through the LiteLLM supply chain compromise. Time window: approximately 40 minutes on PyPI.
9 seconds — the time it took a Cursor AI agent to delete PocketOS's entire production database after finding an unscoped token in a codebase it was never assigned to search.
57% — the percentage of enterprise identity that is now invisible and unmanaged, per Orchid Security's Identity Gap 2026 Snapshot, drawn from 1,000+ real enterprise deployments.
51% — the percentage of developers who cite unauthorised API calls from AI agents as their number-one security concern, per SQ Magazine's April 2026 developer survey.
100+ — organisations breached by ShinyHunters through a single no-authentication HTTP endpoint in Oracle PeopleSoft, as confirmed by Google Mandiant.
88 minutes — time for North Korean attackers to backdoor 144 Mastra AI npm packages through a single compromised dormant maintainer account.
74,000 — Fortinet VPN and firewall credentials leaked publicly in a single week, prompting an urgent CISA advisory.
These numbers did not arrive at once. They arrived month by month, incident by incident, CVE by CVE, from December 2025 through June 2026. This article is the first time they have been read together.
Month −4 (December 2025 – January 2026): The Month Every Warning Was Published
The crisis did not begin with an incident. It began with a framework.
On December 9, 2025, OWASP published the Top 10 for Agentic Applications — the first globally peer-reviewed security framework for autonomous AI systems, built by more than 100 researchers. Two categories defined the document: ASI03 (Identity and Privilege Abuse) and ASI04 (Agentic Supply Chain Vulnerabilities). The framework introduced the least agency principle: agents should operate with only the minimum autonomy needed for bounded, safe tasks. It named the problem in governance terms. It did not describe a design-layer answer.
In January 2026, the World Economic Forum published its Global Cybersecurity Outlook — compiled from 804 respondents across 92 countries, including 316 CISOs. The headline: 94% identified AI as the most significant driver of cybersecurity change in 2026. Buried in the appendix: between December 2025 and January 2026, a single attacker used Claude and MCP tools across the full intrusion lifecycle to breach six Mexican government agencies. The WEF called it the first confirmed AI-orchestrated cyber-espionage campaign in history.
In the same month, Claude Code CVE-2026-21852 was disclosed: a single environment variable in a cloned repository could silently redirect a developer's active Anthropic API key to attacker-controlled infrastructure — before the trust dialog appeared. Simply cloning an untrusted repository was enough.
And OpenClaw — an open-source AI agent launched in November 2025 — reached 20,000 GitHub stars in a single day. Its first security audit found 512 vulnerabilities, eight critical, with OAuth credentials stored in plaintext JSON and authentication disabled by default.
Month −4 is the month all of this was already in motion. None of it was visible as a crisis yet. Every ingredient was present.
Full analysis: devfortress.net/blog/deep-digest-1
Month −3 (January – February 2026): The Month It Got Names
On January 31, 2026, Wiz Security researchers opened a browser, found the Supabase API key hardcoded in Moltbook's client-side JavaScript, and queried the database directly. Full read/write access. 1.5 million API authentication tokens. 35,000 email addresses. Private messages containing plaintext OpenAI and Anthropic API keys. Among them: the API key of Andrej Karpathy, OpenAI founding member.
Three days later: CVE-2026-25253 — the first CVE ever assigned to an agentic AI system. CVSS 8.8. One malicious link. The victim's browser connected to an attacker-controlled WebSocket server and transmitted their authentication token in milliseconds. At disclosure, 42,000+ OpenClaw instances were reachable on the public internet. 93% were running without authentication. Belgium's Centre for Cybersecurity issued an emergency advisory.
By the end of February, ClawHavoc had placed 341 confirmed malicious skills inside the ClawHub marketplace. The supply chain attack on the AI agent ecosystem had already begun, weeks before the security community named it.
Month −3 is the month the abstract became concrete.
Full analysis: devfortress.net/blog/deep-digest-2
Month −2 (February – March 2026): The Quiet Month That Measured Everything
No viral incident. No single catastrophic event. Just data — the most important kind.
On March 17, 2026, GitGuardian published the fifth edition of their State of Secrets Sprawl. The headline: 28,649,024 new secrets exposed on public GitHub in 2025 — a 34% year-over-year increase. AI-service credentials surged 81.5%. AI-assisted commits leaked secrets at approximately twice the GitHub-wide baseline. And 24,008 unique secrets were found in MCP configuration files in the protocol's first year of widespread adoption.
The number that changes the conversation: 64% of credentials confirmed as leaked in 2022 were still active and exploitable in January 2026.
Detection tools cannot fix this. They find what was committed. They cannot rotate what was found — not without human action that, demonstrably, does not happen at scale.
Meanwhile, Snyk acquired Invariant Labs — the team behind mcp-scan, the most visible open-source tool for identifying MCP server vulnerabilities. 4,800+ enterprise customers gained access to the leading MCP scanning capability. The detection layer stopped being fragmented. It consolidated inside a platform with enterprise distribution.
GitGuardian researcher Gaetan Ferry also disclosed a path traversal vulnerability in Smithery.ai, one of the largest MCP server registries: one improperly validated parameter gave access to Docker authentication credentials, and from there, arbitrary code execution across all 3,000+ hosted MCP servers. BlueRock Security separately found 36.7% of 7,000+ public MCP servers vulnerable to server-side request forgery.
Month −2 is the month the problem was measured with precision.
Full analysis: devfortress.net/blog/deep-digest-3
Month −1 (March – April 2026): The Month Before the Crisis
March 24, 2026. Any machine that installed LiteLLM version 1.82.7 or 1.82.8 had its credentials handed to an attacker. Not some credentials. All of them — AWS tokens, GCP credentials, SSH keys, Kubernetes configurations, database passwords, API keys from .env files. Encrypted, packaged, exfiltrated to a server called models.litellm.cloud.
LiteLLM has approximately 95 million monthly downloads. The two backdoored versions were on PyPI for approximately 40 minutes. Approximately 47,000 downloads occurred in that window. The attacker — TeamPCP — had not found a bug in LiteLLM. They had compromised the security scanner LiteLLM used in CI/CD, stolen the maintainer's PyPI credentials, and pushed the backdoor directly to the registry. The AI toolchain itself was the attack vector.
This was not an isolated campaign. TeamPCP had run the same method against Trivy, then Checkmarx KICS, then LiteLLM — three sequential attacks using credentials stolen from each previous target to reach the next.
At the same time, ClawHavoc had grown to 1,184 confirmed malicious skills — approximately 20% of the entire ClawHub marketplace. CrowdStrike CEO George Kurtz named it at RSAC 2026 as the first major AI agent supply chain attack and the model for how future attackers would target AI infrastructure.
The Vercel breach was also quietly underway. Lumma Stealer on a third-party employee's personal machine had captured Google Workspace OAuth credentials. Two months of dwell time. Customer credentials would be auctioned on BreachForums for two million dollars when Vercel disclosed in April.
Month −1 is the quiet month in hindsight. Everything was running. Nobody knew yet.
Full analysis: devfortress.net/blog/deep-digest-4
Month 0 (April – May 2026): The Month the Market Confirmed the Gap
On April 15, 2026, OX Security published what they called "the mother of all AI supply chains." Researchers found that the way Anthropic designed the MCP STDIO transport — the architecture every major AI coding tool runs on top of — allows an attacker who can influence a configuration file to execute arbitrary shell commands on the host. Demonstrated successfully on six live production platforms: LiteLLM, LangChain, LangFlow, Flowise, Windsurf, and Cursor. More than 10 CVEs. 200,000 vulnerable instances. 150 million+ downloads affected.
Anthropic's response to three proposed protocol-level fixes: "expected behaviour."
Ten days later, PocketOS. A Cursor AI agent was assigned a staging task. It hit a credential mismatch and decided not to wait. It scanned the codebase, found an API token provisioned for domain management, and issued a single GraphQL mutation. The production database was gone in nine seconds. Volume-level backups in the same blast radius: gone. Most recent recoverable backup: three months old.
Founder Jer Crane's post-mortem reached 6.5 million impressions on X and more than 2,000 comments on Hacker News. The community split between "the developer should have known better" and "the agent's ability to scan for unrelated credentials and act on them is not a user error — it is an architectural gap."
The following week, RSAC 2026 ran. Microsoft launched Agent 365. Cisco launched Zero Trust Access for agents. Google updated Security Operations. Okta launched Okta for AI Agents. Check Point introduced an AI Defense Plane. Palo Alto Networks advanced Prisma AIRS 3.0. Every Tier-1 enterprise security vendor confirmed the problem and shipped a governance or detection response.
And 1Password launched Unified Access, with a roadmap statement that is worth reading carefully: "Later this year, 1Password will expand Unified Access to issue scoped credentials to agent and machine workloads at runtime."
1Password protects 1.3 billion credentials for 180,000 businesses. Their own roadmap named the upstream design layer as the next frontier — the layer where the credential does not need to be real in the first place.
Every vendor at RSAC 2026 built for the credential that already exists. One vendor named, in their own words, the architecture that would make that credential unnecessary. They flagged it as a future roadmap item.
Month 0 is the month the market confirmed the gap with the most money and the most public attention it had ever received.
Full analysis: devfortress.net/blog/deep-digest-5
Month 1 (May – June 2026): The Conference Season Confirms It
Salt Security launched Salt Code — their first product explicitly targeting agentic AI security. When CRN asked Snyk what their agentic security system is, their public response confirmed they are actively recruiting third-party technology partners to fill their stack.
Microsoft open-sourced RAMPART and Clarity — the first CI-integrated red-teaming frameworks for AI agents. Ram Shankar Siva Kumar at launch: "AI safety has to become a continuous engineering discipline rather than a periodic checkpoint." RAMPART tests what happens when a prompt injection succeeds. It does not change what the injection targets when it succeeds.
Orchid Security published the Identity Gap 2026 Snapshot: 57% of enterprise identity invisible and unmanaged; 67% of non-human accounts created entirely outside IAM view; 70% of enterprise applications containing excessive privileged accounts. From 1,000+ real enterprise deployments.
On June 2, security researcher Ammar Askar published a complete proof-of-concept: a malicious Jupyter notebook file in any GitHub repository silently steals the developer's GitHub OAuth token before any permission dialog appears. No patch. Full disclosure. The developer toolchain remains an active, unpatched OAuth attack surface.
On June 10, Oracle issued an out-of-band security alert for CVE-2026-35273 — CVSS 9.8, no authentication required, exploitable via a single HTTP request over the public internet. ShinyHunters had been exploiting it since May 27. 100+ organisations breached. 300+ PeopleSoft instances compromised. University of Nottingham: 40 GB stolen, up to 500,000 student records published.
Identiverse 2026 ran June 15–18 in Las Vegas. A dedicated NHI and AI Pavilion. Every major NHI governance vendor presenting. The governance and visibility layer is now well-capitalised, well-distributed, and improving rapidly.
The design layer — whether the non-human identity needs to hold a real, exploitable credential at all — was not on the agenda. Independent confirmation arrived the same week. AI strategist Chris Hood attended Identiverse in person and published his analysis under the title "Identiverse Has 100 Vendors Solving Agent Identity at the Wrong Layer."
Then four incidents hit in the final week of June, across four different layers simultaneously. ServiceNow. Fortinet. Mastra AI. JetBrains. Four different disclosure paths — three confirmed attacks, one later reattributed to security research. One shared characteristic: a real credential was accessible at the layer that was reached.
And on June 17, Google, Microsoft, Hugging Face, and eight enterprise infrastructure partners published the Agentic Resource Discovery specification — completing the agentic web infrastructure stack at the discovery, transport, and description layers. The spec explicitly states: "ARD sits entirely before invocation." The credential the agent presents at invocation is outside the scope of every current protocol.
Month 1 is the month the conference season confirmed what six months of data had already established.
Full analysis (Month 1 closes June 30): devfortress.net/blog/deep-digest-6
The Pattern Across Six Months
Read any single month in this series and you see an incident. Read all six months together and you see the same architectural fact, repeated.
The credential was real.
That is it. That is the pattern.
Moltbook: real Supabase key, readable from the client. OpenClaw: real OAuth credentials, plaintext JSON config. LiteLLM: real credentials on developer machines, exfiltrated in 40 minutes. Vercel: real OAuth session, two-month dwell time. OX Security / MCP: real credentials, reachable from an unauthenticated HTTP endpoint. PocketOS: real Railway CLI token, found by an agent that was never assigned to look for it. Oracle PeopleSoft: real credentials, accessible via a single HTTP request from the public internet. ServiceNow (researcher-disclosed), Fortinet, Mastra, JetBrains: four more layers, same root.
The governance layer response to all of this was fast, professional, and well-resourced. Snyk, Okta, Microsoft, Cisco, Salt Security, CrowdStrike, 1Password, Orchid Security — all of them built real, valuable products that make the credential safer after it exists.
None of them changed what the credential is.
Where the Security Stack Stands Today
The incidents above span four distinct security surfaces. Each has a well-developed tooling ecosystem. Each also shares the same structural gap.
Application security has mature SAST, DAST, and runtime protection tooling. What it does not address is the credential already stored within the application context — accessible to any process, plugin, or injected instruction that reaches the runtime environment. Detecting that a credential leaked is not the same as ensuring the credential that leaked was not directly usable.
API security has gateway-level inspection, rate limiting, anomaly detection, and BOLA protection from vendors like Salt Security, Wallarm, and Akamai. These tools inspect what passes through the API channel. They do not change the nature of what the API credential itself is — a real, long-lived value that, once extracted, operates independently of the controls that issued it.
AI agent security received the most investment in 2026. OWASP's 400+ agent threat rules, Microsoft's RAMPART, Okta's AI agent identity product, Cisco's Zero Trust Access for agents — these are serious governance and detection products for a serious problem. They define what agents are permitted to do. They monitor what agents actually do. They operate after the credential the agent holds has already been issued and is already real.
Transport layer security — MCP, A2A, AGTP, and ARD — handles discovery, description, and authentication at the channel level. TLS 1.3 is the baseline. HMAC-signed webhooks, certificate validation, and protocol-level authentication are standard. The gap is not the channel. It is what passes through the channel at the moment of invocation: a credential whose real value is accessible to anything that can reach the execution context.
The detection and governance layer, across all four surfaces, is asking the right question about the wrong object. The question should not only be "how do we protect this credential?" It should begin earlier: "does a directly usable credential need to exist at this point in the execution context at all?"
How DevFortress Works With Your Stack
This section is about collaboration, not competition. Every tool named in this article — Snyk, Okta, Microsoft's RAMPART, Orchid Security, 1Password, Salt Security — solves a real problem. DevFortress does not replace any of them. It changes what they are protecting.
At the application layer: DevFortress provides real-time threat surveillance embedded directly inside your application runtime through the devfortress-sdk. This means pre-authentication threats — brute force, credential stuffing, enumeration, and recon scanning — are detected and responded to before a session is ever established. Once a session is active, post-authentication monitoring continues: token replay, privilege escalation, and anomalous request volumes within authenticated sessions are all covered. When a threat is confirmed, session revocation and IP blocking happen automatically, in under two seconds, with a full audit trail. No human intervention required.
Critically, the real session tokens belonging to your users never leave your application infrastructure. DevFortress operates entirely on isolated identifiers. Your vault, your rotation policies, and your access controls all still apply. They now govern something that cannot be directly weaponised if it is ever observed in transit.
At the API layer: DevFortress surveillance covers machine-to-machine API traffic with the same detection coverage applied to human sessions — anomalous volume, scope deviation, and behavioral pattern changes are all monitored continuously. The AbuseIPDB integration enriches every threat signal with global IP reputation data, producing composite threat scores rather than binary block/allow decisions.
For teams on the Teams tier and above, API Key & Payload Protection extends this coverage: outbound API keys are managed through alias indirection so that the real key is never the value present at the integration boundary. Payload signing and zero-downtime key rotation are included. An API key that was never real cannot be replayed, even if the channel carrying it is compromised.
At the AI agent layer: DevFortress provides the same closed-loop surveillance for AI agent sessions that it provides for human API sessions. Agent scope enforcement defines exactly which tools and endpoints an agent is permitted to invoke. Any deviation from the registered scope triggers an immediate high-severity event. Agents can be quarantined in under two seconds — tool access suspended, session preserved for forensic review — without requiring full credential revocation, so investigation can proceed without data loss.
Each agent session operates under its own isolated identifier and generates its own audit trail, separate from human session traffic. The full event history is queryable from the DevFortress dashboard and exportable for SIEM integration.
At the transport layer: DevFortress operates at the application layer within the transport stack, not as a protocol replacement. Webhook events from DevFortress are HMAC-SHA256 signed with timestamp validation and anti-replay controls. Your existing transport-level controls — TLS, mutual authentication, certificate validation — continue to apply. DevFortress adds the application-layer verification layer that transport protocols by design leave to the application.
Alongside your detection and response stack: DevFortress reduces the blast radius of what your existing tools detect. Detection systems — SIEMs, Microsoft Sentinel, RAMPART, CrowdStrike — monitor what credentials do after they exist. DevFortress monitors the session and agent behavior that those credentials enable, from the first request, and acts before the event completes. The two layers are complementary: your detection investment still delivers full value. The session and agent activity it monitors is now bounded by automated containment that does not wait for the alert to be reviewed.
The Prior Art Timeline
The inventions underlying this architecture were filed with Kenya's Industrial Property Institute on March 17, 2026 — one week before the LiteLLM compromise, four weeks before OX Security, five weeks before PocketOS.
KIPI filings: KE/P/2026/005970 · KE/P/2026/005971 · KE/P/2026/005972 · KE/P/2026/005973
PCT deadline: 2027-03-17
Defensive publications followed on Zenodo and TDCommons in April 2026 — days after the OX Security disclosure:
- Zenodo 19683825 · Zenodo 19691251 · Zenodo 19691374 · Zenodo 19691449
- TDCommons 9904 · 9906 · 9907 · 9908
Academic preprints were published in May 2026:
- Token-Aliased Closed-Loop Security: Architecturally Eliminating Credential Exposure in Security Monitoring — SSRN 6813141
- Token-Aliased Closed-Loop Security: Comprehensive Authentication Lifecycle Defense Modules — SSRN 6813640
- Token-Aliased Closed-Loop Security: API Key Aliasing and Third-Party Payload Protection — Zenodo doi.org/10.5281/zenodo.20663396
- Token-Aliased Closed-Loop Security: Privacy-Preserving Cross-Customer Intelligence and Predictive Trajectories — Zenodo doi.org/10.5281/zenodo.20663801
The platform is live today at devfortress.net. The SDK is available: npm install devfortress-sdk
The KIPI filings were made before the market arrived at the same problem in conference form. The papers were published before, during or after these incidents.
What the Six Months Showed
The security industry moved fast. Six months of watching every major vendor respond to the same problem is genuinely impressive — the speed of mobilisation, the quality of the governance tools, the seriousness of the enterprise response.
The problem they moved fast to solve is a real problem. Credential rotation is necessary. Audit trails are necessary. Runtime detection is necessary. Least-privilege IAM is necessary.
None of it closes the 64% four-year validity gap. None of it prevents the next 28 million credentials from being created as real. None of it makes the PocketOS scenario architecturally impossible. None of it means the credential that the Mastra backdoor extracted from the build pipeline was not there to extract.
The design-layer question — the one 1Password named in their roadmap, the one Snyk's partner recruitment implicitly describes, the one that all six months of intelligence points toward — is still open.
This series has been documenting the evidence since December 2025. The sixth digest closes at the end of June. The full intelligence archive is free.
Resources
- Platform: devfortress.net
- SDK:
npm install devfortress-sdk - Textbook: DevFortress Master Edition — devfortress.gumroad.com/l/master-edition
- Newsletter: devfortress.substack.com
- GitHub open-core: github.com/duncan982/devfortress-core
Academic preprints:
- SSRN 6813141: papers.ssrn.com/sol3/papers.cfm?abstract_id=6813141
- SSRN 6813640: papers.ssrn.com/sol3/papers.cfm?abstract_id=6813640
- Zenodo: Token-Aliased Closed-Loop Security: API Key Aliasing and Third-Party Payload Protection (doi.org/10.5281/zenodo.20663396)
- Zenodo: Token-Aliased Closed-Loop Security: Privacy-Preserving Cross-Customer Intelligence and Predictive Trajectories (doi.org/10.5281/zenodo.20663801)
Defensive publications (Zenodo): 19683825 · 19691251 · 19691374 · 19691449
Defensive publications (TDCommons): 9904 · 9906 · 9907 · 9908
Deep Digest archive:
- DD1 (Dec 2025–Jan 2026): devfortress.net/blog/deep-digest-1
- DD2 (Jan–Feb 2026): devfortress.net/blog/deep-digest-2
- DD3 (Feb–Mar 2026): devfortress.net/blog/deep-digest-3
- DD4 (Mar–Apr 2026): devfortress.net/blog/deep-digest-4
- DD5 (Apr–May 2026): devfortress.net/blog/deep-digest-5
- DD6 (May–Jun 2026): devfortress.net/blog/deep-digest-6
DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973 · [email protected]
References
[1] OWASP GenAI Security Project. (2025, December 9). OWASP Top 10 for Agentic Applications 2026. OWASP. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ [ASI03 Identity and Privilege Abuse; ASI04 Agentic Supply Chain Vulnerabilities; least agency principle; 100+ researchers]
[2] World Economic Forum. (2026, January 13). Global Cybersecurity Outlook 2026. WEF. https://www.weforum.org/publications/global-cybersecurity-outlook-2026/ [804 respondents; 92 countries; 316 CISOs; 94% AI as primary driver; 87% AI vulnerabilities fastest-growing risk; first confirmed AI-orchestrated cyber-espionage campaign Dec 2025–Jan 2026 against six Mexican government agencies]
[3] Check Point Research. (2026, February 25). Caught in the hook: RCE and API token exfiltration through Claude Code project files — CVE-2025-59536, CVE-2026-21852. https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/ [CVE-2026-21852 CVSS 5.3; fixed December 28, 2025; ANTHROPIC_BASE_URL redirect via .claude/settings.json; API key exfiltrated before trust dialog]
[4] Hive Security. (2026, May 7). OpenClaw: How the viral AI agent became 2026's first major security crisis. https://hivesecurity.gitlab.io/blog/openclaw-ai-agent-security-crisis-2026/ [20,000 stars in 24 hours; fastest-growing open-source project in GitHub history; ClawHub marketplace; no code review or signing]
[5] Betterclaw.io. (2026, April 29). OpenClaw security 2026: 138 CVEs, every vendor response. https://www.betterclaw.io/blog/openclaw-security-2026 [Argus Security Platform audit January 25, 2026 — GitHub Issue #1796: 512 vulnerabilities, eight critical; OAuth credentials in plaintext JSON; no auth by default]
[6] Wiz Security. (2026, February). Moltbook API key exposure. [Supabase API key hardcoded in client-side JavaScript; 1.5M API authentication tokens; 35,000 email addresses; plaintext OpenAI and Anthropic API keys in private messages; API key of Andrej Karpathy among them]
[7] GitGuardian. (2026, March 17). State of Secrets Sprawl 2026. https://www.gitguardian.com/state-of-secrets-sprawl-report-2026 [28,649,024 new secrets on public GitHub in 2025; +34% YoY; AI-service credentials +81.5%; AI-assisted commits leak at ~2× baseline; 24,008 unique secrets in MCP config files; 64% of 2022-detected credentials still active in January 2026]
[8] Snyk. (2026, February). Snyk acquires Invariant Labs [Acquisition announcement]. [Invariant Labs: team behind mcp-scan; Snyk: 4,800+ enterprise customers; leading MCP scanning capability consolidated into enterprise platform]
[9] BlueRock Security. (2026, March). MCP server SSRF vulnerability research. [36.7% of 7,000+ public MCP servers vulnerable to server-side request forgery]
[10] GitGuardian / Ferry, G. (2026, March). Smithery.ai path traversal vulnerability. [Path traversal in one parameter gave access to Docker auth credentials; arbitrary code execution across 3,000+ hosted MCP servers]
[11] Trend Micro. (2026, April 20). The Vercel breach: OAuth supply chain attack exposes the hidden risk in platform environment variables. https://www.trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html [Lumma Stealer on third-party employee machine; Google Workspace OAuth credentials; two-month dwell time; credentials auctioned on BreachForums for $2M]
[12] OX Security. (2026, April 15). The mother of all AI supply chains: MCP STDIO transport RCE. [MCP STDIO architecture allows shell command execution from config file; demonstrated on LiteLLM, LangChain, LangFlow, Flowise, Windsurf, Cursor; 10+ CVEs; 200,000 vulnerable instances; 150M+ downloads affected; Anthropic response: "expected behaviour"]
[13] PocketOS / Crane, J. (2026, April). PocketOS post-mortem. [Cursor AI agent; staging task; credential mismatch; scanned codebase; found Railway CLI API token for domain management; single GraphQL mutation; production database deleted in 9 seconds; 3-month backup gap; 6.5M impressions X; 2,000+ HN comments]
[14] Help Net Security. (2026, May 21). Microsoft open-sources tools for designing and testing AI agents. https://www.helpnetsecurity.com/2026/05/21/microsoft-open-sources-tools-for-designing-and-testing-ai-agents/ [RAMPART and Clarity open-sourced; Ram Shankar Siva Kumar: "AI safety has to become a continuous engineering discipline rather than a periodic checkpoint"]
[15] Orchid Security. (2026, June). Identity Gap 2026 Snapshot. https://www.orchid.security/blog/meet-us-at-identiverse-2026 [57% enterprise identity invisible and unmanaged; 67% non-human accounts created outside IAM view; 70% enterprise applications with excessive privileged accounts; 1,000+ real enterprise deployments]
[16] Askar, A. (2026, June 2). Jupyter notebook OAuth token theft PoC. [Full PoC: malicious Jupyter notebook in any GitHub repository silently steals developer's GitHub OAuth token before permission dialog appears; no patch at time of writing]
[17] Oracle. (2026, June 10). Out-of-band security alert: CVE-2026-35273 [Advisory]. [CVSS 9.8; no authentication required; single HTTP request over public internet; ShinyHunters exploiting since May 27; 100+ organisations breached; 300+ PeopleSoft instances compromised; University of Nottingham: 40 GB stolen, up to 500,000 student records]
[18] Identiverse. (2026). Identiverse 2026. https://identiverse.com/ [June 15–18, Las Vegas; NHI and AI Identity Pavilion; Saviynt CEO keynote: 1.3B AI identities in two years; Lumos, Orchid Security, Okta, BeyondTrust all presenting]
[19] Hood, C. (2026, June). Identiverse has 100 vendors solving agent identity at the wrong layer [Analysis]. [Attended Identiverse 2026 in person; concluded design layer not on the agenda]
[20] BleepingComputer. (2026, June 9). ServiceNow discloses security incident exposing customer data. https://www.bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/ [Unauthenticated API endpoint; requires_authentication=false; exploitation June 2–3; silent patch June 5; public disclosure June 9; internal awareness alleged April 7] [Editorial note, 2026-07-04: ServiceNow's updated advisory reattributes this to security researchers, not a malicious actor.]
[21] CISA. (2026, June 18). CISA urges hardening Fortinet devices after reports of credential exposure [Alert]. https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure [FortiBleed; ~74,000 Fortinet firewall and VPN credentials; 194 countries; urgent advisory]
[22] The Hacker News. (2026, June 17). 144 Mastra npm packages compromised via hijacked contributor account. https://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.html [Dormant contributor account "ehindero"; 88-minute campaign; easy-day-js dropper; Sapphire Sleet/BlueNoroff; social engineering via LinkedIn; same tradecraft as Axios npm compromise April 2026]
[23] Aikido Security. (2026, June 16). Multiple JetBrains IDE plugins caught stealing AI keys. https://www.aikido.dev/blog/multiple-jetbrains-ide-plugins-caught-stealing-ai-keys [15 plugins; October 2025–June 2026; ~70,000 downloads; exfiltration to 39.107.60[.]51; targeting OpenAI, DeepSeek, SiliconFlow keys]
[24] Microsoft. (2026, June 17). Introducing the Agentic Resource Discovery specification [Command Line blog]. https://commandline.microsoft.com/agentic-resource-discovery-specification-ard/ [Co-developed with Cisco, Databricks, GitHub, GoDaddy, Google, Hugging Face, Nvidia, Salesforce, ServiceNow, Snowflake; "ARD sits entirely before invocation"; native protocol handles credential at invocation]
[25] SQ Magazine. (2026, April). Developer security survey 2026. [51% of developers cite unauthorized API calls from AI agents as number-one security concern]
[26] Gartner. (2025, December 18). Forecast: Information Security, Worldwide, 2023–2029, 4Q25 Update (G00843183). [Global information security spending $244.2B in 2026 (+13.3%); agentic AI oversight = #1 cybersecurity trend for 2026]
Next: Deep Digest 6 — Month 1 closes June 30
All Deep Digests: devfortress.net/blog