The trust boundary your ML stack was built on broke this week

Palisade Research ran the same agent benchmark twice, twelve months apart. Autonomous hack success went from 6% to 81%. In the same window, a Claude agent running under Cursor deleted a production database and its backups in nine seconds because Railway's platform coupled backup lifecycle to resource deletion. Google confirmed the first AI-authored zero-day observed in the wild — a Python 2FA bypass with a hallucinated CVSS score in the metadata, which is now a free forensic tell.

That is the week in one paragraph. The rest is bookkeeping.

The critical patch triad, plus one

Four root-level vulnerabilities hit overlapping infrastructure tiers in the same window. CVE-2026-43284 (Dirty Frag) is a local-to-root on every Linux distro shipped since 2017, embargo already broken, public PoC circulating. CVE-2026-42511 hands root to any LAN-adjacent attacker via a crafted DHCP response against FreeBSD — 21 years old, no user interaction, and it lands on pfSense, OPNsense, and TrueNAS before the firewall has anything to filter. CVE-2026-42208 is an unauthenticated SQL injection in LiteLLM via a crafted Authorization header, and it's already being exploited. CVE-2026-41940 is a cPanel zero-day dropping Mirai variants and Sorry ransomware today.

And Ollama shipped an unauthenticated out-of-bounds read on port 11434 that returns whatever sits adjacent in process memory. In an LLM serving context that is upstream API keys, tokenized prompts with PII, and RAG chunks from internal knowledge bases. Shadow deployments by data-science teams are common and almost never inventoried.

The operational problem is sequencing. Most teams will patch LiteLLM first because it's the easiest change ticket. Order by blast radius: Dirty Frag touches every Linux host on the estate, cPanel is deploying ransomware now, FreeBSD DHCP hands root to anyone on the same L2 segment, LiteLLM leaks every credential it has ever proxied.

Yes, but — one could argue the 81% autonomous hack rate is a lab benchmark against known-CVE paths, not a real SOC with EDR and segmentation. Fair. The number that survives the caveat is the 13.5x year-over-year delta. That curve doesn't flatten on its own, and patch SLAs written for human-triage cadence assume an attacker moving at human cadence. That assumption stopped holding this week.

The supply chain is the new attack surface

A repo impersonating OpenAI's "Privacy Filter" reached #1 trending on HuggingFace with 244,000 downloads before takedown. The payload was a Rust infostealer targeting HF tokens, W&B keys, cloud credentials, and browser data. At that volume the pulls aren't curious humans browsing a typo-squat — they're automated training jobs, CI runs, and notebook kernels resolving model names at runtime.

The delivery mechanism is the point. Safetensors fixed pickle deserialization for weights, not for the rest of the repo. from_pretrained trusts the namespace and the download counter. Rust was picked deliberately: compiled, hard to reverse, no .NET or Java signatures for EDR to pattern-match on.

In the same seven days: Checkmarx's own GitHub repos pushed a malicious Jenkins AST plugin. SailPoint's GitHub was compromised through a third-party tool. JDownloader installers were trojanized for two days. 38 npm packages ran dependency confusion against Apple, Google, and Alibaba internal networks. Two of those four trust anchors are security vendors. And an academic audit found more than one-third of community-contributed agent skills carry exploitable vulnerabilities — meaning any registry-based skill import ships with a statistically guaranteed exploit primitive.

HuggingFace documents pinning to a commit SHA. Almost nobody does it. Open the lockfile. If it pins by tag or by branch, it pins to whatever the repo owner pushes next.

The geopolitical timer

Iran formally rejected the US peace plan this week. The Strait of Hormuz remains closed. Every prior Iranian diplomatic collapse — 2012 sanctions, Soleimani, 2020 JCPOA — has been followed within 2–6 weeks by measurable uplifts from APT33, APT34, MuddyWater, and CyberAv3ngers. Preferred initial access is documented: password spraying against Entra, credential phishing, exploitation of unpatched Fortinet/Ivanti/Citrix edges, default credentials on exposed Unitronics and Siemens PLCs. The detection engineering is bounded work with named TTPs. This is not a week to have open CVEs on your perimeter.

What to do before Friday

Patch the triad today, in blast-radius order: Dirty Frag across the Linux estate, cPanel across all 11.x branches with IOC sweeps for Mirai C2, FreeBSD DHCP on every appliance, LiteLLM with full rotation of every API key it has ever proxied regardless of log evidence. Scan external ASM for Ollama on port 11434 and put an auth proxy in front of every internal instance.

Grep CI, workstation, and package-cache logs for the four supply-chain artifacts of the last ten days: Checkmarx Jenkins AST plugin, JDownloader installers dated May 6–7, HuggingFace Open-OSS/privacy-filter, SailPoint GitHub pulls. Quarantine anything that hit them and rotate the tokens those machines touched.

The durable move is one policy change: enforce SHA pinning on every HuggingFace model pull in CI, and reject any repo artifact with executable bits or a PE/ELF header outside a declared allowlist. Trending rank is not a trust signal. Download count is not a trust signal. A commit hash is the only cryptographic answer you have, and it costs a lockfile line to use it.