AI Just Broke the Cost of Offense — Your Playbooks Assume the Old One

On December 26, 2025, one person got remote code execution on Mexico's national tax authority in twenty minutes. By day five they were resident across nine government networks. Claude Code generated roughly 75% of the exploit commands. A custom Python tool piped stolen data through GPT-4.1 and produced 2,957 structured intelligence reports across 305 servers. Hundreds of millions of citizen records were exfiltrated.

The safety guardrails held for about as long as it took to write a file. The attacker saved a penetration-testing cheat sheet to claude.md — the persistent context file — and the model helpfully proceeded. Gambit's forensic writeup calls the guardrails "speed bumps, not roadblocks." That is generous.

The uncomfortable detail: the targets were end-of-life, unpatched systems. AI didn't discover zero-days. It just automated the exploitation of known vulnerabilities at a speed one human could never sustain. That's the actual news. The economics of offense — the assumption that sophisticated attacks require sophisticated resources — just broke. Everything else this week is a consequence of that break.

Your AWS incident response is already obsolete

Sonrai Security and OFFENSAI shipped a tool called notyet that exploits AWS IAM's eventual consistency window. When your responder deletes a malicious inline policy or deactivates an access key, the change takes seconds to propagate. notyet polls for the containment action and reverses it inside that window. The researchers tested every method AWS recommends: inline policy deletion, permission boundaries, group changes, access key deactivation, role deletion, even AWS's own AWSSupport-ContainIAMPrincipal SSM runbook. Seven of eight failed. Only Service Control Policies survived, because a member account can't modify the SCPs applied to it.

There is no CVE coming. This is documented architectural behavior. If your IR playbook doesn't start with pre-staged SCP-based containment, your next real incident meets an attacker who reverses your response faster than your SOC can page the on-call.

Compounding this: any unprivileged CodeBuild job using CodeConnections can call an undocumented API and retrieve raw GitHub App tokens with org-wide read/write/admin. AWS calls this intended behavior and won't fix it. One compromised build step is now full access to every repo in your organization.

The patch sprint is the largest of the year

Microsoft's April Patch Tuesday: 243 CVEs, eight critical, one SharePoint flaw already in CISA KEV and being exploited. Windows IKE (CVE-2026-33824, CVSS 9.8) is unauthenticated and network-reachable — that's your VPN gateways. Active Directory has an authenticated RCE. TCP/IP has a race condition on every Windows host.

Outside Microsoft, the worst one is Axios. CVE-2026-40175 scored a perfect 10.0. Header injection in one of the most-installed npm packages on Earth, chained into cloud instance metadata service requests. Your URL allowlists don't help — this is headers, not URLs. If your Node.js services run on cloud VMs and IMDSv1 is still enabled with a hop limit above one, an attacker can steal your IAM role credentials without touching your app logic. Patch this today. Enforce IMDSv2, hop limit one, on every instance.

The rest of the week: Django 9.8, pgx/v5 9.8, OAuth2 Proxy 9.1, Tomcat 9.1, Airflow 3.1 JWT invalidation failure at 9.1, OpenSSL FIPS 3.6 at 9.1 on AVX-512. And three security vendors — FortiSandbox, IBM Security Verify Access, Juniper JSI — shipped their own CVSS 9+ holes. The tools defending you are on the same patch list as the things they defend.

The intelligence layer is eroding under you

NIST formally narrowed NVD enrichment to CVEs on CISA KEV, in federal systems, or covered by EO 14028. Everything else gets a record without CVSS, CPE, or CWE. CVE submissions grew 263% from 2020 to 2025 and the 2024 funding lapse never got fixed. This is structural, not a backlog. Every scanner, every automated prioritization rule, every SLA that reads "critical within 72 hours" now has a growing dead zone — and it's exactly where your long-tail application dependencies live.

Build a fan-in feed this sprint: CISA KEV as the override signal, OSV.dev for ecosystem-level version ranges, GitHub Advisory Database for Dependabot, plus vendor advisories for anything commercial that matters. Reconciliation is annoying; single-source-of-truth is worse.

The AI-generated code side of the ledger

Apiiro measured Fortune 50 repos over six months. AI-assisted developers ship 3–4x more commits — and 10x more security findings per month. Privilege escalation paths up 322%. Architectural design flaws up 153%. The defect categories that compound are exactly the ones LLMs are worst at, because they require system-wide reasoning about invariants the model can't see. Standard SAST tuned for injection and XSS won't catch it.

Snap disclosed 65% of new code is AI-generated, cut 16% of headcount for $500M in projected savings, and the stock popped 8%. Your board has seen the headline. The honest response is not to slow down AI-assisted development — it's to measure security-finding density per AI-assisted commit and gate on it before the debt is unmanageable.

One counter-reading worth stating in full: some of Apiiro's 10x is probably better detection, not more vulnerabilities. Their disclosure doesn't control for tooling improvements during the measurement window. But the direction is consistent with what LLMs actually do — plausible-looking local patterns, blind to authorization boundaries — and 322% growth in privilege escalation paths specifically is not a detection artifact. The take holds.

What to do this week

Four things, in order.

Today: audit for Axios, patch it, verify IMDSv2 with hop limit one across every cloud instance. That's the highest-severity single item on the board.

This week: rewrite your AWS containment runbook around pre-staged deny-all SCPs, and dry-run it against the notyet technique in a staging org. If you can't isolate a compromised principal with an SCP in under sixty seconds, you don't have containment.

This sprint: add "security findings per AI-assisted commit" to the same dashboard where velocity lives. Move SAST, SCA, and secrets scanning off the pull-request trigger and onto the commit trigger — GitHub now lets repos disable PRs, and any control that fires only on PR creation is one config flag away from silence.

This quarter: build the fan-in vulnerability feed and start the crypto-agility inventory. Q-day at 2029 with ECC breakable at 1,200 logical qubits means authentication infrastructure — code signing, mTLS, OIDC — needs a migration plan now, not in 2028. Large crypto migrations take longer than three years. You are already late.

The old assumption was that offense scales with resources and defense scales with process. AI just inverted the first half. Your process needs to catch up before the second half breaks too.