Exploits arrive in twelve hours. Your patch SLA still says thirty days.

Sysdig watched LMDeploy get exploited 12.5 hours after disclosure with no public PoC in circulation. LiteLLM's pre-auth SQLi (CVE-2026-42208), which fronts most teams' OpenAI, Anthropic, and Bedrock keys, was weaponized in under 36 hours. In the same week, the MOAK project demonstrated that publicly available Opus 4.6 and GPT-5.4 autonomously produce working exploits for 174 of 178 CISA KEV entries published after model training cutoffs. That's 97.8%, and memorization is ruled out because the entries post-date the cutoffs.

The mechanism is boring and specific: the agent reads a CVE advisory, writes an exploit, runs it, reads the output, iterates. No human. HackerOne paused the Internet Bug Bounty this week citing AI-driven submission volume outpacing remediation capacity — which is the first institutional admission that discovery has decoupled from patching.

Yes, but — the 98% number is a benchmark, not a claim about your production traffic. Real damage still concentrates on unpatched internet-facing edge appliances and identity providers. The takeaway isn't that everything blows up. It's that the long tail of KEV entries, previously ignored because writing an exploit was the slow step, is now cheap to hit. That's the change. It's enough.

Your patch SLA is now a perimeter control

CISA's 30-day BOD window was calibrated for a world where exploit development was the bottleneck. It isn't anymore. Every KEV-linked SLA needs to be rewritten to 72 hours for internet-exposed assets, 48 hours where the advisory carries technical detail. The KEV feed belongs wired into deployment, not into a Jira queue. For assets that genuinely can't patch that fast — the edge appliances, the legacy identity systems — virtual patching at the WAF is now the only posture that survives the window between advisory and first contact.

The cover story for the same week is that 88% of GitHub Enterprise Server instances haven't patched CVE-2026-3854. Any authenticated user with push access gets RCE via crafted git push options. Fixed in 3.14.24 through 3.19.3. If you're in the 88%, that's an emergency change window today, followed by rotating every Actions runner token, deploy key, and cached PAT that sat behind an unpatched instance. Assume breach during the window.

The identity model broke on the other side too

Cloudflare, Stripe, and Cursor all shipped agent-as-first-class-principal APIs in the same news cycle. Cloudflare lets an agent create accounts, buy domains, mint tokens, and deploy. Stripe's Link CLI issues one-time-use payment credentials without exposing the real card. Cursor's SDK drops the coding-agent runtime into CI/CD as an embeddable TypeScript API.

Meanwhile Anthropic published a number their marketing team probably didn't love: 93% of agent prompts are auto-approved. At that rate, the human in the loop is a rubber stamp with a pulse. The approval signal carries near-zero mutual information with risk — same failure mode as a decade of database-query approval queues, where reviewers click through because review doesn't fit in the time budget.

The governance move isn't better prompts to reviewers. It's replacing per-action approval with continuous policy enforcement — override rate on high-risk actions, policy-violation count per thousand traces, action entropy per agent, tool-boundary violations. Log a first-class authority_level field on every agent decision: tool_assist, human_gated, or autonomous. That field is cheap to add now and expensive to backfill after litigation, because a Northern District of California court just ruled under Rule 10b-5 that when a platform's AI exercises "ultimate authority" over assembled content, the platform is the legal maker of that content. Section 230-style shields don't automatically extend to agent decisions. Most production agentic stacks ship in the autonomous row and log like the tool-assist one. Discovery will notice.

The supply chain is doing the amplification work

The TeamPCP cascade is the pattern to internalize. They poisoned checkmarx/kics:latest on Docker Hub. Bitwarden's Dependabot automation pulled it into CI. The malicious code shipped as @bitwarden/cli 2026.4.0. That's the exact automation topology most ML teams run — tag-based image pulls, bot-driven dependency updates, CI runners holding model registry credentials. In the same 48-hour window, SAP npm maintainer accounts were hijacked and pushed an 11MB credential stealer harvesting AWS, Azure, GCP, and GitHub tokens via preinstall hooks.

One policy change closes most of this week's blast radius: ban tag-based image pulls and default-deny install-time scripts (npm --ignore-scripts, digest-pinned images) in CI. Both are enforceable with a linter and a registry policy. Between them, they would have blocked the majority of the week's supply chain exposure.

What to do this week

Three moves, in order. First, patch GHES today if you're in the 88%, then rotate every token that transited an unpatched instance or an unpatched LiteLLM proxy. Second, rewrite your KEV-linked patch SLA from 30 days to 72 hours for anything internet-facing, and stand up virtual patching for assets that can't hit it. Third, add authority_level and human_reviewer_id as first-class fields on every agent decision record, and replace your per-action approval dashboard with one that tracks override rate and policy violations. The court ruling makes autonomy a discoverable design parameter. The Cloudflare and Stripe releases make it a production one.

The gap between advisory published and working exploit available is now the time it takes to run an inference call. Patch velocity is a perimeter control now, not a hygiene metric.