AI just made vulnerability discovery free — and your dependency tree is the target

Nicholas Carlini pointed Claude Code at Ghost — a 13-year-old publishing platform with zero prior critical CVEs — and got a working blind SQL injection in hours. He pointed it at the Linux kernel and got a remotely exploitable heap overflow. Independent researchers ran "find the RCE" against vim and emacs and both cracked. The total, across a week of casual testing by frontier-model researchers: 500+ high-severity vulnerabilities in software that has been read, forked, and audited for a decade or more.

The cost of finding a zero-day is now roughly five dollars in API credits and one sentence of English.

That's the story. Everything else this week — the supply chain campaign, the AI dependency data, the agent injection benchmarks — is what happens when you compose that primitive with the rest of the stack.

The scanners were the weapon

Independent analysis from SANS's Kenneth Hartman confirmed what the vendors soft-pedaled: all 91 published tags of Checkmarx's ast-github-action were overwritten with malicious commits in a seven-minute window on March 23. Not "select versions." Not "older releases." All 91. Trivy's scanner was weaponized. LiteLLM was backdoored on PyPI. Axios — 100M+ weekly downloads — was compromised for three hours before the payload self-deleted, which is why your npm audit came back clean.

All of it is now attributed to a single actor, TeamPCP, who has moved into monetization: AstraZeneca data released publicly, Databricks reportedly investigating, and a mass ransomware affiliate program (Vect) launched March 27. If you ran a Checkmarx or Trivy scan between March 19 and March 27, treat the pipeline that executed it as compromised and rotate every secret it could touch. Not next sprint. Today.

The SHA-pinning defense most teams rely on has a documented flaw: an attacker forks the Action, injects a backdoor, and submits a PR that changes only the SHA. In the workflow diff it still reads owner/repo. Code review passes. GitHub's fix — dependency locking, scoped secrets, an L7 egress firewall that lives outside the runner VM — ships in Q3 2026. That's your exposure window.

Yes, but — one might argue that supply chain attacks are old news, that SolarWinds was worse, and that vendors patched fast. SolarWinds compromised a build system to poison an update. TeamPCP compromised the tools you use to detect compromises, in the same week AI made discovering new bugs free. The composition is what's new, and it's what breaks the current patch cadence.

Your coding agent is on the wrong side of this trade

A study of 117,000+ dependency changes across GitHub found that AI coding agents select known-vulnerable package versions 50% more often than human developers. Roughly 20% of AI-recommended packages are hallucinations — names that don't exist in any registry. Forty-three percent of those hallucinated names are consistent across queries, which means an attacker can enumerate them, register the popular ones on PyPI and npm, and wait. One researcher registered a single common hallucination and logged 30,000 downloads in weeks.

Georgia Tech has already traced 74 CVEs directly to AI-generated code, more than half rated Critical or High.

So the loop is: your agent picks worse dependencies, sometimes invents ones the attacker has pre-registered, ships them fast, and the same class of frontier model on the other side scans the resulting codebase for zero-days at API cost. Productivity gains you booked in Q1 are producing security debt in Q2 that a $5 prompt will find in Q3.

On the runtime side: DeepMind quantified hidden prompt injection via HTML/CSS at 86% success against browse-capable agents, and memory poisoning at 80%+ with less than 0.1% contamination. Simon Willison's "lethal trifecta" — private data access, untrusted content ingestion, external communication — is the audit primitive. Slack's 30 new AI features hit all three by default. NetSuite's MCP rollout to 43,000 customers hits all three. Claude Code's KAIROS daemon hits all three.

What actually needs to happen this week

Three things, in order.

First, verify. Grep every CI workflow for checkmarx/ast-github-action, aquasecurity/trivy-action, and any pinned LiteLLM or Telnyx version between Feb 28 and Mar 27. Every match means credential rotation for that pipeline — not a review, a rotation. While you're in there, hunt your FortiGate fleet for the forticloud-sync service account and Windows endpoints for jli.dll side-loading under java.exe. Operation Storming Tide's Russian-nexus persistence sat dormant for months; a clean scan in April doesn't mean anything.

Second, gate. No AI-authored PR that modifies a lockfile or package.json merges without a human reviewing the new dependency names against the official registry. This is a five-line CI check. It is the single highest-ROI security control any team using Copilot, Cursor, or Claude Code can deploy this quarter.

Third, patch the CVSS 9+ cluster that dropped in the same week and got buried by the AI news: ORY Oathkeeper (10.0, auth bypass), FastGPT (10.0, unauth proxy), Langflow (9.9, RCE that bypasses the previous fix), Rails Active Storage (9.8/9.1, arbitrary file read and delete), Grafana (9.1, chained RCE), gRPC-Go (8.1, path-based authz bypass via missing leading slash). Upgrade PyTorch to ≥2.6 while you're at it — NVIDIA APEX's pickle-based CVE is the ML-security scenario the field has warned about for years.

The offense side of vulnerability discovery just got a 100x cost reduction. The defense side got a three-to-six-month wait for GitHub's platform fixes. That gap is the operator's problem to close, and "we'll get to it in Q3" is not an answer that survives contact with a $5 API call.