Stories This Week
- Comment and Control — Three Coding Agents, One Bug Class, Zero CVEs: On April 15, researcher Aonan Guan — working with Johns Hopkins University's Zhengyu Liu and Gavin Zhong — published the first cross-vendor demonstration of a prompt-injection pattern that turns GitHub itself into the command-and-control channel for stealing runner credentials out of AI coding agents. The same bug class lives in three of the most widely deployed agents on GitHub Actions: Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent.
The pattern is identical across all three. The agent reads GitHub data (PR titles, issue bodies, comments), treats that data as part of its prompt context, and executes tools based on the content.
- Marimo CVE-2026-39987 weaponized via HuggingFace-as-C2: Marimo CVE-2026-39987 weaponized via HuggingFace-as-C2. Three days after marimo's April 8 disclosure of CVE-2026-39987 (pre-auth RCE in the Python notebook platform), Sysdig's Threat Research Team observed a threat actor deploying a novel NKAbuse variant — a Go-based backdoor using the NKN blockchain for command-and-control — from a typosquatted HuggingFace Space. Between April 11 and April 14, 12 source IPs across 10 countries generated 662 exploit events, with lateral movement to PostgreSQL and Redis via credentials extracted from `.env` files.
- Google DeepMind — "AI Agent Traps.": Google DeepMind — "AI Agent Traps." DeepMind researchers Matija Franklin, Nenad Tomasev, Julian Jacobs, Joel Z. Leibo, and Simon Osindero published the first comprehensive taxonomy of internet-based attacks on autonomous AI agents. Six categories: content injection (malicious instructions in HTML comments, invisible CSS, image metadata — up to 86% partial hijack rates in tests), semantic manipulation (exploiting agent susceptibility to anchoring and framing), cognitive/memory traps (RAG-store poisoning succeeded in >80% of cases with <0.1% data contamination), behavioral control (direct action hijack), systemic/multi-agent (cascading failures across interacting agents, "digital flash crashes"), and human-in-the-loop (manipulating what reviewers see so harmful actions get approved).
- SANS + CSA + OWASP GenAI — "The AI Vulnerability Storm.": SANS + CSA + OWASP GenAI — "The AI Vulnerability Storm." A joint emergency strategy briefing published April 14 by SANS Institute, the Cloud Security Alliance, [un]prompted, and the OWASP GenAI Security Project, written over a single weekend by 60+ contributors and reviewed by 250+ CISOs. Deliverables are unusually operational: a risk register mapped to OWASP LLM Top 10 (2025), OWASP Agentic Top 10 (2026), MITRE ATLAS, and NIST CSF 2.0; eleven immediate priority actions with start dates; and a CISO board-briefing template. Response velocity is now a framework feature.
- The Mythos skepticism cluster: The Mythos skepticism cluster. Two weeks after the Mythos preview, the commentary has turned critical. Gary Marcus, writing on Substack, called the rollout *"planting seeds in the hype garden"* and described the demonstrated capability as incremental rather than a fundamental leap — calling for independent replication and open benchmarks.
- Industry Signal: The biggest cloud-security-meets-AI event of 2026 after RSAC. It's also the first Cloud Next since Google closed its $32B acquisition of Wiz in March — so this is the debut of "Wiz inside Google" as a unified pitch rather than a partnership.
Mandalay Bay, Las Vegas. Expected anchors: Google Unified Security + Wiz CNAPP integration sessions, the 2026 Mandiant M-Trends threat report, a deep agentic-SOC track, and a "Securing AI-Generated Code" session that will draw a crowd after the Comment and Control week.
Curator's Corner
The Big Three consulting firms don't just advise on AI. They have become, in under two years, the fastest-growing storehouses of client intellectual capital on earth.
McKinsey's Lilli held 46.5 million chat messages. 728,000 files. 57,000 accounts. All 95 system prompts, exposed. BCG's data warehouse fell next. Then Bain's Pyxis — eighteen minutes, start to finish, to a credential sitting in a public JavaScript file.
Stop and think about what's inside those platforms.
A consulting firm's AI is not a product. It is the compressed memory of every engagement the firm has ever run. Market entry plans. Pricing models. Restructuring scenarios. Board decks two quarters before they're presented. M&A target lists. Post-merger integration playbooks. The raw, unredacted conversations between a partner and a Fortune 500 executive about the thing that executive would never put in writing anywhere else.
That is the product the Big Three sell. The chatbot is just the wrapper.
The attacker understood this before the defenders did. An autonomous AI pen-test agent — not a nation-state, not a ransomware crew, one person with a clever tool — chose its three targets by reading the firms' own responsible-disclosure policies. It picked the vaults with the thinnest walls and the richest contents. Then it walked in through the front door each firm had left standing open in public JavaScript.