Autonomous Autopsy

This episode covers the TeamPCP supply chain campaign of May 2026, in which attackers hijacked TanStack's CI/CD pipeline to publish 84 malicious npm packages with valid SLSA Build Level 3 provenance, and a parallel operation called TrapDoor that weaponized AI coding assistants through hidden Unicode instructions in project config files.

• Mini Shai-Hulud worm: how three chained GitHub Actions weaknesses enabled a self-propagating worm that compromised OpenAI devices, infected 170+ packages, and caused GitHub to lose approximately 3,800 internal repositories — with zero CVEs assigned
• TrapDoor campaign: 34 malicious packages across npm, PyPI, and Crates.io using zero-width Unicode characters in .cursorrules and CLAUDE.md files to deliver instructions invisible to human reviewers but parsed by Cursor and Claude Code
• Detection failure: why traditional scanners had no coverage, and how Socket's behavioral cross-registry detection surfaced TrapDoor in under six minutes
• Monday-morning controls: specific steps including cat -v inspection of AI config files, persistence daemon removal, and a single YAML condition that blocks the pull_request_target attack vector

Published June 9, 2026 — listeners leave with concrete, actionable mitigations rather than general security guidance.

This episode covers the March 24, 2026 supply chain compromise of LiteLLM, a widely used AI proxy library with over 95 million monthly downloads, in which attackers backdoored PyPI packages by first exploiting a pull_request_target misconfiguration in Trivy's GitHub Actions pipeline.

• How TeamPCP used Trivy's CI to steal LiteLLM's PyPI publishing token and push malicious packages with no corresponding Git tags or release artifacts
• The three-stage payload: credential harvesting, Kubernetes lateral movement via privileged pods, and a persistent systemd backdoor polling checkmarx.zone every 50 minutes
• The downstream blast radius, including transitive exposure through CrewAI, MLflow, Microsoft GraphRAG, and Google ADK, plus the Mercor breach affecting 40,000 contractors and 4TB of stolen data
• Two structural fixes: migrating PyPI publishing to Trusted Publisher OIDC tokens and pinning all GitHub Actions steps to commit SHAs instead of mutable version tags

The practical takeaway is that both mitigations require no vendor cooperation and can be implemented starting with a single grep of your CI YAML files. New episodes every Tuesday.

This episode covers OX Security's April 2026 advisory exposing a design-level remote code execution flaw in Anthropic's MCP STDIO interface, affecting an estimated 200,000 servers and 150 million SDK downloads with no patch issued.

• The four exploitation families identified by OX Security, including CVE-2026-30615, a zero-click Windsurf vulnerability requiring no user interaction, and registry poisoning across 9 of 11 MCP marketplaces tested
• CVE-2026-26118, an SSRF flaw in Azure MCP Server patched by Microsoft in a single cycle, contrasted against Anthropic's decision to classify the comparable STDIO flaw as expected behavior
• CVE-2026-27944 and CVE-2026-33032, the two-CVE MCPwn chain targeting nginx-ui with active exploitation confirmed by Recorded Future in March 2026 across 2,600 exposed instances
• Grasshopper Bank and Meow Technologies as the first U.S. banking deployments running on unpatched MCP infrastructure

Listeners leave with four concrete actions, including patching Azure MCP Server Tools to 2.0.0-beta.17, auditing MCP command parameters for untrusted input, and using vulnerablemcp.info to vet servers before installation.

This episode examines the structural security gap between what enterprise teams believe about their AI agent deployments and what is actually running, anchored by the n8n supply chain attack tracked as CVE-2026-21858 and GHSA-77g5-qpc3-x24r.

• Shadow agent risk: Why OAuth-connected autonomous agents operating under employee identities are harder to detect than traditional shadow SaaS
• n8n kill chain: How malicious npm packages disguised as community nodes silently exfiltrate OAuth tokens from no-code automation stacks
• Microsoft Agent 365: What the May 1 GA release actually covers at $15 per user, and the personal-account blind spot it cannot address
• Governance debt: The zombie agent accumulation problem created when only 21% of organizations have a formal decommissioning process

Listeners leave with two concrete detection queries: an Entra ID app consent report filtered for high-privilege OAuth scopes granted in the last 90 days, and a DNS and proxy log hunt for outbound LLM API traffic from unapproved automation hosts.