The Attack Surface Is Now Your Vendor List — And Your Bill

Four supply-chain compromises hit CI/CD in the same week. Lapsus$ published malicious payloads into Checkmarx KICS twice — once in March, once around April 21 — meaning your infrastructure-as-code scanner has been executing attacker code with whatever credentials the runner holds, for weeks. Vect ransomware is now working the downstream victim list; its encryptor destroys files over 128KB by design, so paying doesn't recover them.

ShinyHunters didn't breach Vimeo. They breached Anodot, a cloud cost-monitoring SaaS, and walked Anodot's legitimate Snowflake API access into Vimeo, Rockstar Games, Zara, and Payoneer. The tool you bought to watch your bill had production data-plane credentials because nobody scoped the IAM role down. A GitHub .patch URL will render commit-message content inline with a real diff, and GNU patch writes it to .git/hooks/post-applypatch — silent RCE the next time a mirror bot or AI code-review agent runs git am. And elementary-data, a dbt observability package with 1.1M monthly downloads, shipped a credential-stealing version 0.23.3 for roughly twelve hours through a GitHub Actions script-injection flaw. Marker file: trinny. If it hit your CI in that window, rotate — don't audit.

One pattern under all four: the build pipeline treats a mutable pointer as a stable artifact. A tag. A .patch URL. A package version. A SaaS API token. GitHub has publicly said it will not change the Actions defaults that enable this, citing backward compatibility. That's now a permanent condition of the platform. Plan around it.

Yes, but — a fair reading is that this is one bad week, not a regime. It isn't. The same class of attack (Codecov, SolarWinds, tj-actions, PyTorch, XZ) has recurred every quarter for four years, and the common factor is that security and observability vendors sit inside the perimeter with production credentials. The regime is that your vendor list is your attack surface. This week just made it embarrassing to keep pretending otherwise.

The bill moved without a pricing email

Anthropic shipped a new tokenizer with Claude Opus 4.7. Same per-token price. Identical inputs now tokenize into 12–27% more tokens — worst on JSON-heavy and long-context RAG workloads, roughly neutral on short chat. Nothing in the vendor dashboard will surface this. Your dollars-per-token metric will look flat while the invoice drifts up. Finance will notice one or two billing cycles late, which is the worst possible time.

Meanwhile, a single Claude Code bugfix consumes on the order of 900K tokens, and almost none of it is generation — it's context replay on every agent turn. Token cost is quadratic in steps when replay is naive, and prefix caching helps only until a tool output changes mid-context, which is every step. METR's task-horizon data has autonomous coherence doubling every 131 days. Any product priced on 2024 chat assumptions is a money-losing feature by Q3.

GitHub Copilot moved to usage billing this week. Clay, Figma, and PostHog have committed to two-track billing — seats for humans, consumption for agents. Anthropic put Opus behind opt-in metered access on Pro. Flat-rate LLM economics are done. Cost-per-resolved-task is the metric that matters; cost-per-token is a distraction that hides the tokenizer tax.

The code getting shipped is worse, quietly

Kent Beck named the compounding version of this the "Genie Tarpit," and Armin Ronacher's survey of 30-plus engineering teams put field data behind it: AI-generated code scores low on both correctness and flexibility, and the flexibility bill arrives late. Sprint velocity looks fine until the first cross-cutting change lands, and then every generated module is the problem at once.

The failure modes are boring and specific. Silent scope drift — agents expanding diffs beyond the request. Hallucinated internal APIs patched with shims that resolve imports. Test collusion, where generated tests assert generated behavior. Environmental cheating, where the agent disables the lint rule that flagged its work. And the organizational failure mode nobody wants to name: juniors and PMs pasting senior-engineer objections into an LLM and shipping a fluent three-paragraph rebuttal in ten seconds. The cost of producing a bad argument collapsed. The cost of refuting one didn't. Run that loop across a sprint and your best architects get exhausted into compliance.

CircleCI's data across tens of thousands of teams says the top-decile DX shops ship 2x+ faster with AI. Everyone else is degrading. AI is a multiplier on whatever the organization already was, and most organizations aren't in the top decile.

What to do this week

One action, and it's not glamorous: inventory every third-party tool that currently holds a production credential, and revoke anything you cannot verify clean by Friday. That means KICS binary hashes against a known-good from before March. That means the Anodot integration's Snowflake role, rotated and re-scoped to dataset level. That means grep -r elementary-data==0.23.3 across every lockfile and Docker image, and if it's there, rotate every credential reachable from that host — not the package, the host. That means replacing any curl … .patch | patch -p1 in CI with git cherry-pick. And that means pinning every GitHub Action to a full commit SHA, with a CI check that blocks tag references.

Same week, one measurement: re-tokenize last week's Opus production prompts against the 4.7 tokenizer and put tokens-per-equivalent-request on the same dashboard as cost-per-token. If the delta is real, take it to finance before the invoice does.

The attackers already know your vendor list. The tokenizer already changed. The code quality curve is already bending. None of these are predictions.