AI Agent Security Weekly | Issue 17

Theme: The controls were built for threats that move at human speed and at human scale. This week confirmed they do not (2026-06-08).

Three incidents. Three layers. One structural property. The worm moved at developer-access speed through 73 repositories via coding agent config files. The industry-wide audit scored 100 production agents and found 98% carry the conditions for a hostile document to take them over. The AI scanner completed eight years of human effort in eight weeks and broke the disclosure pipeline built to process findings at human pace. L6 Tool Layer, L3 Authorization and Trust, and L5 Reasoning and Memory all failed for the same reason: the speed and scale assumptions baked into the controls no longer hold.

1. The Worm That Turned Coding Agents Into Its Delivery System: self-replicating worm propagates via coding agent config injection across 73 Microsoft GitHub repos

2. 98% of Production Agents Carry the Lethal Trifecta. Only 11% Pass the Security Bar: independent assessment of 100 production agents reveals structural governance failure

3. Cisco Scanned 1.8 Billion Lines of Its Own Code With AI in Eight Weeks. It Used to Take Eight Years: AI-accelerated discovery forced Cisco to redesign its entire disclosure process

Our security controls were built for human login flows. Not this.

A worm spread through coding agent configuration files at the speed of developer access. An independent audit scored 100 production agents and found 98% exploitable by a single hostile document. An AI scanner finished eight years of work in eight weeks and broke the disclosure infrastructure designed to handle the output.

This issue covers June 2 through June 5, 2026.

A developer opened a repository. The repository installed a worm.

Self-propagation via coding agent config injection.

On June 5, 2026, the Miasma worm compromised 73 Microsoft GitHub repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attacker pushed one malicious commit to the Azure/durabletask repository using previously compromised contributor credentials. That commit planted configuration files targeting five developer tools: Claude Code, Gemini CLI, Cursor, VS Code, and npm test.

When a developer opens the repository in any of those tools, a 4.6 MB obfuscated JavaScript payload executes automatically. The payload harvests credentials for AWS, Azure, GCP, Kubernetes, npm, and GitHub. It then uses those stolen tokens to commit itself into every repository the victim can write to.

The worm spreads at the speed of developer access. Each infected repository becomes a new infection point.

GitHub disabled 73 repositories in 105 seconds. The number of developers who opened those repositories while a coding agent was active is the number that has not been disclosed.

Blast radius: credentials for AWS, Azure, GCP, Kubernetes, npm, and GitHub harvested from every infected developer machine. Every repository the victim had write access to became a new propagation vector.

• Contributor credential compromise enabled a single commit to plant executable config files across 73 repositories with no secondary approval gate

• Five coding agents auto-executed repository config files on open, converting a repository clone into an arbitrary code execution surface

• The worm self-propagated using stolen tokens, turning every infected developer into an unwitting distribution node at machine speed

• Existing repository scanning and CI/CD pipelines did not flag config file payloads targeting coding agent runtimes because those file types were not in scope

• EU AI Act Article 15(4) requires providers to ensure AI systems are resilient against unauthorized third-party manipulation. A self-propagating worm exploiting AI tool config files is a direct compliance exposure for any organization deploying these tools under EU jurisdiction

• Start here: audit every coding agent config file format your organization permits. AI Agent Tool Registration and Integrity Playbook, 17 questions to verify the tool your agent calls is still the tool you approved. Priority entry point.

• Then: verify that repository clone operations do not auto-execute any file type without explicit user confirmation. AI Agent Context Supply Chain Playbook, 18 questions to stop data from becoming commands.

• Operator connection: the propagation path runs through developer credential scope. If a developer PAT can write to 200 repositories, a worm inherits write access to 200 repositories. Scope developer tokens to the minimum repository set required for active work.

• Red team action: plant a benign canary config file in an internal repository and measure whether any coding agent auto-executes it on clone. If it does, your supply chain is open.

• Architecture layer: L6 Tool Layer

• Attack surface: coding agent config file auto-execution on repository clone

• Threat scenarios: TS-06 ai_agent_threat_mcp_supply_chain_poisoning / TS-07 ai_agent_threat_ungated_tool_execution

• Exposure level: high

• Playbooks: AI Agent Tool Registration and Integrity Playbook / AI Agent Context Supply Chain Playbook

• Red team: canary config file injection test, coding agent auto-execution verification

• Frameworks: ASI09 (Supply Chain Vulnerabilities) / LLM01 (Prompt Injection) / ML-T0014 (Poisoning)

Source: The Hacker News / StepSecurity, June 5, 2026

One hundred production agents scored. Ninety-eight carried the conditions for a single hostile document to take them over.

Three numbers. One verdict.

Adversa AI published the AI Risk Quadrant on June 3, 2026. The report scored 100 commercial and publicly available AI agents across three dimensions: attack surface, blast radius, and defense controls. The results were not close.

98% carry the lethal trifecta: private data access, exposure to untrusted content, and the ability to take outbound actions. Eight of ten agent classes show 100% trifecta exposure.

Only 11% land in the Fortified Leaders quadrant. 40% sit in Exposed Giants, holding 60% of the total risk budget.

83% of claimed defenses lack independent verification. The defenses vendors list in marketing materials have no public evidence behind them.

Whether an agent executes tools, and whether that execution is sandboxed, explains 76% of blast radius. Tool execution is the variable. Everything else is noise.

67% of CISOs cannot see their agents. 53% report agents exceeding intended permissions. The governance gap is structural, not informational.

Blast radius: the 40% classified as Exposed Giants hold 60% of the total risk budget across all 100 agents scored. The trifecta combination means a single hostile document in any data source the agent reads can trigger outbound actions using the agent’s own credentials.

• 98% of production agents carry all three conditions required for a hostile document to achieve full agent takeover: private data access, untrusted content exposure, and outbound action capability

• 83% of vendor-claimed defenses have no independent verification, meaning procurement and compliance decisions are based on unaudited marketing claims

• Tool execution sandboxing accounts for 76% of blast radius variance, confirming that the execution layer is the primary control point and most agents lack it

• Standard vulnerability scanners and runtime monitors do not assess the trifecta combination because they test individual controls, not the interaction of data access, content exposure, and action capability together

• EU AI Act Article 9 requires risk management systems that identify foreseeable risks. A 98% exposure rate to the trifecta across an entire agent class is a foreseeable risk that most organizations have not documented

• Start here: inventory every deployed agent and score each against the three trifecta dimensions: private data access, untrusted content exposure, outbound action capability. AI Agent Governance and Inventory Playbook, 17 questions to confirm every deployed agent is known, owned, and policy-assigned. Priority entry point.

• Then: for every agent scoring positive on all three dimensions, audit whether tool execution is sandboxed. AI Agent Tool Execution Playbook, 10 questions before an agent can click, run, or call.

• Operator connection: the 76% blast radius finding means sandboxing tool execution is the single highest-leverage control. If your agent calls tools without a sandbox, the blast radius is unbounded.

• Red team action: submit a hostile document to each agent’s data intake path and measure whether it triggers an outbound action. If it does, the trifecta is confirmed and exploitable.

• Architecture layer: L3 Authorization and Trust

• Attack surface: trifecta combination of private data access, untrusted content exposure, and outbound action capability across production agents

• Threat scenarios: TS-07 ai_agent_threat_ungated_tool_execution / TS-15 ai_agent_threat_scope_creep_capability_drift

• Exposure level: high

• Playbooks: AI Agent Governance and Inventory Playbook / AI Agent Tool Execution Playbook

• Red team: hostile document injection test against agent data intake, outbound action monitoring

• Frameworks: ASI04 (Excessive Permission) / ASI08 (Inadequate Human Oversight) / LLM06 (Excessive Agency)

Source: Adversa AI / Help Net Security, June 3, 2026

Eight years of security scanning completed in eight weeks. Cisco did not celebrate. It redesigned how it discloses bugs.

The review gap is now the attack surface.

Cisco used a multi-model AI harness to scan 1.8 billion lines of code across 25 programming languages in its entire product portfolio. Previous scanning at that depth would have required eight years of human effort. The AI completed it in eight weeks.

The volume of findings forced a structural response. Starting July 2026, Cisco will publish vulnerability disclosures on a fixed twice-monthly cadence with one-week advance previews so defenders know what needs patching before the details go public.

Cisco also announced Live Protect: a product that provides temporary shielding against newly discovered vulnerabilities while organizations work to deploy permanent fixes. The product exists because the gap between discovery speed and patch deployment speed has become structurally unmanageable.

This is the same pattern at institutional scale. Palo Alto found 75 bugs in one cycle instead of 5. An autonomous agent found 21 zero-days in FFmpeg for $1,000. Cisco confirmed the pattern holds when applied to 1.8 billion lines of production code.

The discovery rate has outrun the disclosure infrastructure.

Blast radius: Cisco’s entire product portfolio across 25 programming languages. Every finding that goes undisclosed while the patch pipeline catches up is a window where adversaries with the same AI tooling can discover and exploit the same vulnerability.

• AI-accelerated scanning compressed eight years of discovery into eight weeks, producing a volume of findings that exceeded the capacity of every downstream process: triage, patching, disclosure, and customer communication

• The existing monthly disclosure cadence was built for human-speed discovery rates and could not absorb the output, forcing a redesign to twice-monthly cycles

• Live Protect exists solely because the gap between discovery speed and patch deployment speed is now structurally permanent, not a temporary staffing problem

• Existing vulnerability management dashboards track known CVEs but cannot surface the queue of AI-discovered findings waiting for disclosure, creating a blind spot in the patch pipeline

• SOX and PCI DSS require timely remediation of known vulnerabilities. When AI scanning produces findings faster than the disclosure pipeline can process them, the definition of “known” becomes organizationally ambiguous

• Start here: map your vulnerability discovery pipeline throughput against your patch deployment cadence. If AI scanning has been introduced at any layer, measure whether the discovery rate exceeds the processing rate. AI Agent Scope Creep and Capability Drift Playbook, 18 questions to reveal authorization drift when agent capabilities evolve without re-review.

• Then: audit whether your disclosure and remediation SLAs were set based on human-speed discovery assumptions. AI Agent Human Approval Integrity Playbook, 20 questions to audit whether your approval gates are trustworthy, not just present.

• Operator connection: Cisco’s Live Protect product is an admission that the patch pipeline cannot keep pace with the discovery pipeline. If your organization depends on Cisco products, evaluate whether your patching cadence can absorb twice-monthly disclosure cycles starting July 2026.

• Red team action: run an AI scanner against a representative codebase and compare the finding volume to your team’s monthly triage capacity. If the ratio exceeds 3:1, the pipeline is already overwhelmed.

• Architecture layer: L5 Reasoning and Memory

• Attack surface: AI-accelerated vulnerability discovery outpacing disclosure and patch deployment infrastructure

• Threat scenarios: TS-15 ai_agent_threat_scope_creep_capability_drift / TS-21 ai_agent_threat_resource_exhaustion_cost_runaway

• Exposure level: medium

• Playbooks: AI Agent Scope Creep and Capability Drift Playbook / AI Agent Human Approval Integrity Playbook

• Red team: AI scanner volume test against triage capacity baseline

• Frameworks: ASI08 (Inadequate Human Oversight) / LLM06 (Excessive Agency)

Source: Axios, June 2, 2026

The controls were built for threats that move at human speed. All three incidents this week confirmed they do not.

A worm propagated through coding agent config files at developer-access speed. An independent audit found 98% of production agents carry the conditions for takeover by a single hostile document. An AI scanner outran the disclosure infrastructure designed to process what it finds. In each case, the control existed. The control was built for a different speed class.

Most teams will respond by patching the specific vector: blocking the config file type, adding a sandbox, adjusting the disclosure cadence. Those are necessary. They are also insufficient. The structural problem is that speed and scale assumptions are embedded in every layer of the control stack, and almost none of those assumptions have been re-validated for AI-native threat actors.

The playbooks map where those assumptions live. Start with the one closest to the incident that looks most like yours.

👉 AI Agent Posture Playbooks: 30+ structured assessments to map where your agent controls were built for humans, not agents. Self-directed. No vendor cycle.

👉 Read the agentic security news. Instantly analyze the threat vector, see if it applies to your setup, and find the gaps with our interactive playbook. All free.

👉 Follow me on LinkedIn | X | Substack for weekly analysis of real agent failures, control gaps, and what the frameworks are and are not catching.