Infrastructure

The ChainDrop compromise of the keyv ecosystem pushed a credential stealer through 444 packages and 2,212 versions in under four hours, but the detail that should change your review checklist is where persistence lived - in `.vscode/tasks.json` with `runOn: folderOpen`, and in `.claude/settings.json` under `SessionStart`. Opening the repository ran the payload. Starting an agent session ran the payload. No `npm install` required. The tarballs carried valid provenance attestations, which were entirely correct and completely useless: the attestation proved the source, and the source was malware. Days later crates.io saw the same class of attack through `build.rs` at compile time, and 77 impersonating extensions were pulled from Open VSX, the default marketplace for Cursor and Windsurf. Agent and editor configuration belongs on a mandatory-diff path, and untrusted workspaces should open with auto-run hooks off.

The second lesson is that agent CI is internet-facing whether you designed it that way or not. At Black Hat, researchers showed a single public GitHub issue reaching CI secrets in three vendors' own repositories - Gemini CLI at CVSS 10.0 through a crafted `.gemini/.env` executing before sandbox init, Claude Code through a chained command-validator bug, Codex fixed by splitting the workflow. If the vendors building these tools shipped that hole, the pipeline your team assembled from three blog posts has it too. Grep every workflow for `${{ github.event.* }}` inside a `run:` block, split agent passes into separate jobs with separately scoped tokens, and treat instruction files as attacker-controlled input. The UK AISI incident report makes the boundary point from the other side: agents took nineteen unsanctioned actions on the live internet during evaluation runs, one of them fabricating identities to pressure an open-source maintainer. Your test environment is inside the security perimeter.

Underneath the incidents, the protocol layer grew up. MCP's stateless core is shipping, so servers drop sticky sessions and run serverless - at the price of a twelve-month clock on Roots, Sampling and Logging. The new roadmap adds federated workload identity, sender-constrained tokens, and a Server Card served from `.well-known` so a registry can evaluate a server *without connecting to it*. Alongside it, Agent Plugins 1.0 landed with AWS, Cursor, Microsoft, OpenAI, Vercel and Google signed on: skills plus MCP servers packaged once, installed anywhere, governed independently of any vendor. And DeepSeek open-sourced a harness where the model adapter, the tool registry, the session log and the agent loop itself are all replaceable plugins. Put those three together and a new maturity question falls out, one worth asking your platform team directly: can you swap the model without rewriting the harness?