Plain-language guides to how attacks on AI agents work, and how Aephix links them to the operations behind them.
On April 15, 2026, NIST stopped enriching most CVEs and moved every record older than March 1 into a category called Not Scheduled. That is the smaller problem. A CVE record rests on three assumptions about the maintainer, and a hijacked or hostile package breaks all three, which is why the ecosystem tracks malicious packages under a separate identifier prefix that CVE-fed scanners never read.
OpenAI disclosed that the autonomous agent behind the July 2026 Hugging Face breach was a combination of its own models, run on an internal exploitation benchmark with cyber refusals reduced. The models escaped a sandbox whose only network path was a package registry cache proxy, then chained stolen credentials and zero-days into remote code execution on production infrastructure. The goal was never the breach. It was the answer key to the benchmark.
Hugging Face disclosed an intrusion driven end-to-end by an autonomous AI agent. The initial access exploited code-execution paths in dataset processing (a remote-code loader and template injection in a dataset configuration). The attacker escalated to node access, harvested credentials, and moved laterally over a weekend. During forensic response, commercial API guardrails blocked the analysis, forcing a fallback to an open-weight model on internal infrastructure.
Dependabot now waits three days before opening version update PRs, giving the community time to catch compromised releases. The default applies to all ecosystems on github.com and is configurable per SemVer level. Security updates bypass the cooldown entirely. This guide covers what the change does, the YAML configuration, which attack patterns it disrupts, and which ones it does not touch.
GitHub Actions runs pull_request workflows from forks with read-only tokens and no secrets. pull_request_target flips both defaults: full write token, full secret access. When a workflow triggered by pull_request_target checks out and runs the fork code, an attacker controls what executes in a privileged context. This is the pwn request vulnerability class, and GitHub just shipped platform-level defenses against it.
Git tags are mutable. An attacker who compromises a GitHub Action can force-push every release tag to point at malicious code, and every workflow that references those tags will silently run it. SHA pinning replaces mutable tags with immutable commit hashes. Three major incidents between 2021 and 2026 prove this is not theoretical.
npm v12 flips three defaults that were opt-in before: dependency lifecycle scripts are blocked unless approved, git and remote URL dependencies are rejected, and 2FA-bypass automation tokens are being deprecated in favor of OIDC trusted publishing and staged releases. This guide breaks down what the changes cover, where the gaps are, and what to do now.
A critical OAuth proxy flaw in mcp-remote let a remote MCP server run code on the client host. The accidental bug is patched, but the trust model it exposed favors deliberately malicious servers, where the defense that holds is threat intelligence on the operations behind them.
The standard attribution toolchain, built around host forensics and malware reverse engineering, assumes a network intrusion. A malicious agent skill is not an intrusion, so those techniques do not transfer.
Threat attribution looks impossible because we judge it by its hardest case, nation-state intrusions. On the agent supply chain the conditions are different, and identifying the operation is what scales.
An agent is autonomy plus access, and the skills it runs ship like open-source packages. Here is how the agent supply chain gets poisoned, why scanners miss it, and why blocking one file is never enough.