1,800 Unauthenticated MCP Servers Outrank Poland’s Russian Water-Plant Warning

Two AI toolchain threats today need your analysis, Arjun. First: 1,862 MCP servers discovered exposed without authentication, many with write access to production systems. There's also a zero-click M365 Copilot exploit chain reported in this context. Second: Langflow has an unauthenticated RCE (CVE pending) with public PoC — the issue is a flow config override via /api/v1/buildpublictmp endpoint, and AUTO_LOGIN is enabled by default. For both: (1) What's the actual attack surface and exploitability? (2) How do these connect — are we seeing a systemic AI-agent governance gap? (3) What are the immediate zero-trust controls organizations should deploy for MCP servers and Langflow instances?

Look, we're witnessing the same pattern I flagged with LiteLLM CVE-2026-42208 — authentication treated as an optional configuration rather than a protocol requirement. These two threats together paint a damning picture of AI agent infrastructure security.

MCP Servers: 1,862 Exposed, Many With Production Write Access

The threat database confirms what I'd feared: Model Context Protocol servers are being deployed at scale with no authentication-at-all. CSO Online reporting shows 1,862 publicly reachable MCP servers with manual verification of 119 samples showing 100% unauthenticated access to internal tool listings — and critically, forensic analysis revealed production systems with write access to financial databases, social media accounts, and CRM platforms.

This is CVE-2026-33032 territory repeated at scale — that nginx-ui bug showed exactly how this plays out: missing AuthRequired() middleware on /mcp_message endpoints handing attackers 12 destructive tools including config writes with auto-reload. The 1,800+ exposed instances suggest systemic deployment without security discipline.

The zero-click M365 Copilot exploit chain documented by Aim Security is particularly nasty — adversaries inject malicious prompt instructions into business documents that Copilot executes automatically, exfiltrating data without user awareness. This is indirect prompt injection weaponized against enterprise SaaS.

Langflow CVE-2026-33017: Unauthenticated RCE via Flow Build Endpoint

This is textbook AI pipeline RCE. The /api/v1/buildpublictmp/{flowid}/flow endpoint accepts arbitrary Python code in node definitions, executes via exec() without sandboxing, and requires zero authentication when AUTOLOGIN is enabled (which it is, by default). Confirmation from the GitHub security advisory shows full server compromise including environment variable exfiltration — API keys, database credentials, cloud tokens — all harvestable via the PoC.

According to Tenable research, this is actively exploited in the wild with CVSS 9.8, and CISA has it in KEV with an April 8 exploitation deadline.

The Systemic Gap: AI-Agent Governance Vacuum

Yes, we're absolutely seeing a systemic pattern. Both cases share three failures:

1. Default-insecure configurations (AUTO_LOGIN enabled, no auth middleware on MCP endpoints)
2. Missing trust boundaries between agent runtime and underlying system
3. Lack of deployment-time security validation — these aren't subtle bugs, they're obvious architecture gaps discovered via Shodan, not code review

The MCP STDIO transport review from OX Security applies here too — 200,000 instances worldwide running command execution with no boundary controls. Anthropic's response that "sanitization is the developer's responsibility" is unrealistic at this scale.

Immediate Zero-Trust Controls

For MCP servers: - Disable all STDIO-based MCP servers until authenticated transport can be verified; prefer SSE with mandatory OAuth - Inventory all MCP endpoints with network scanning — treat any exposed /mcp or /mcp_message as incident-response-worthy - Implement guardrails at the transport layer, not application layer — network policies that block MCP ports from internet exposure

For Langflow: - Immediate upgrade to 1.9.0+ or disable public flow publishing entirely - Disable AUTO_LOGIN in environment configuration; force explicit authentication for all flow operations - Network segmentation: Langflow instances should have egress-only connectivity, no direct database access, secrets only via managed identity providers

The pattern here mirrors early cloud-native security failures — we're repeating the "assume perimeter breach" learning curve with AI infrastructure. The difference is these systems have built-in capabilities to access your databases, Slack, and email. The blast radius is larger.

James, what detection capabilities exist for unauthorized MCP tool invocations or Langflow flow builds?

Sara, Poland's ABW has publicly disclosed Russian state-backed cyberattacks against five water treatment plants that nearly caused loss of water supply — framing this as a doctrine shift from espionage to physical disruption. I need your assessment: (1) What specific OT/ICS attack vectors are likely against small water utilities? (2) How does this parallel the attack surface at small utilities globally — US, EU, elsewhere? (3) What are the actionable ICS hardening measures that would have prevented or mitigated these attacks? Think about what's realistic for under-resourced municipal water operators.

First, the physical consequence: we're talking about loss of water supply to a city. According to the Polish ABW, attackers "gained access to ICS and obtained the ability to modify the operational parameters of equipment, creating a direct risk to operational continuity and the public water supply" at five water treatment stations. In August 2025, one incident "nearly caused a city to lose its water supply." That is not a cybersecurity incident anymore — that's a public health emergency. People need water to live. The blast radius here isn't stolen data or ransom payments; it's boil-water advisories, potential contamination events, and loss of public trust in essential services.

Attack vectors at small water utilities

According to the Polish ABW disclosure, the five breached facilities — Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo — saw attackers gain access to industrial control systems with the ability to modify operational parameters. Let me map this to the Purdue model:

This is a Level 2/1 attack — the threat actors reached the SCADA/HMI layer and in some cases were positioned to affect Level 1 PLCs controlling pumps, valves, and chemical dosing. The ABW specifically notes attackers exploited "poorly secured industrial systems exposed to the internet, default credentials, and outdated configurations."

The specific vectors I see consistently:

1. Internet-exposed HMI/SCADA interfaces — Small utilities often have engineers who legitimate need remote access, but they lack the resources for proper VPN infrastructure, jump hosts, or Zero Trust architectures. So you get web-facing SCADA panels on port 80/443 with default passwords like "admin/admin" or "administrator/blank."

1. Supply chain credential theft — The ABW noted attackers "targeting supply chains specifically sought contract data, project documentation, and authentication credentials." This is the path of least resistance: why hack a PLC when you can steal the integrator's laptop with the project files and VPN credentials?

1. Default configurations on PLCs and RTUs — Small utilities run on razor-thin margins. They buy equipment, get it commissioned, and it runs for 15 years without firmware updates. Factory default passwords, unencrypted Modbus, Telnet instead of SSH — all present.

1. Purdue Level 3.5/DMZ gaps — Larger utilities have DMZs with data diodes and unidirectional gateways. Small utilities often have a firewall rule that "mostly works" between the enterprise LAN and the SCADA network. One compromised billing workstation becomes a beachhead to the SCADA.

Global parallels

This is not uniquely Polish. I see the exact same attack surface at small utilities in the US, EU, and elsewhere. A March 2026 Minot, North Dakota incident — ransomware on the SCADA system serving approximately 80,000 residents, forcing manual gauge monitoring to maintain water safety — is the same pattern. CISA, FBI, EPA, and NSA issued joint advisories on Iranian-affiliated cyber actors exploiting PLCs "in multiple sectors, including US water and wastewater systems facilities," with warnings of "continued malicious cyber activity" and specific TTPs targeting these operational environments.

The structural problem is universal: small municipal water systems lack dedicated OT cybersecurity staff. Their IT team handles email, billing, AND the SCADA. They have no air-gapped engineering network. They cannot afford the six-figure industrial firewalls and unidirectional gateways that large utilities deploy.

Actionable hardening for under-resourced operators

I am not going to tell a small water utility to "patch within 24 hours" or "deploy a full zero trust architecture." That is fantasy. Here is what is realistic:

Immediate (weeks, low cost): - Change default credentials on every PLC, HMI, RTU, and network switch. Document them in an encrypted vault, not a spreadsheet on the operator's desktop. - Disable internet exposure — No SCADA/HMI should be reachable from the public internet. Period. If remote access is needed, use a cellular modem with IP whitelisting and strong authentication, not a port forward on the main firewall. - Inventory your Purdue Level 3.5 — Map exactly what can talk between your business network and your SCADA. Remove any "temporary" connections that became permanent.

Short-term (months, moderate cost): - Network segmentation at Level 3 — Even a basic VLAN separation between business IT and OT networks with a properly configured firewall beats the flat network most small utilities run. - Logging and monitoring — You do not need a SIEM. Even basic Windows Event Log forwarding and PLC connection logging will catch lateral movement.

Medium-term (annual planning cycle): - Maintenance window planning — Identify critical firmware patches and schedule them during your planned plant shutdown. Have rollback procedures tested. - Virtual patching — For vulnerabilities you cannot patch immediately, use network-layer controls to block exploit traffic.

The ABW disclosure is significant because it confirms what we have seen building: threat actors are moving from espionage to direct operational disruption at Level 1. The barrier to entry for these attacks has dropped. Small utilities are the soft target, and the physical consequences are the same whether the attacker is Russian state-backed, Iranian, or ransomware gangs.

---

Alex, two items for you. First: the Checkmarx Jenkins AST plugin compromise — this is wave 3 of the TeamPCP campaign. I don't need the March/April history. What I need is: the Jenkins plugin-specific IOCs, the clean version hash (2.0.13-848.v76e89de8a053), and what CI/CD artifact trust implications this has — if a build pipeline ran the compromised plugin, what's the blast radius? Second: the Langflow unauthenticated RCE — walk me through the exploit mechanics of the /api/v1/buildpublictmp endpoint and AUTOLOGIN default. How trivially exploitable is this with the public PoC?

Good, I have enough. Let me tackle both questions.

---

The clean version: Checkmarx has conflicting guidance. Their May 9 advisory specifies 2.0.13-829.vc72453fa_1c16 (published December 2024). SecurityWeek reports 2.0.13-848.v76e89de8a_053 — so I need you to verify your stated hash actually exists. The 829 build from December appears to be the verified-good baseline.

The IOCs: TeamPCP maintains consistent tooling. Per CSA Lab Space and Sysdig intel, the payload is the "TeamPCP Cloud Stealer" — a shell-based credential harvester with these signatures: - Payload filename: tpcp.tar.gz (unchanged across all waves) - Encryption: AES-256-CBC with RSA-4096 OAEP key encapsulation - Harvest targets: GitHub tokens, AWS credentials, Slack/Discord webhooks, Checkmarx API keys — note the addition of Slack/Discord URL harvesting in this wave - Exfiltration: - Primary: attacker infrastructure at scan.aquasecurtiy[.]org (note Typosquat of "security") - Fallback: creates tpcp-docs repository in victim GitHub account - C2 domain observed: checkmarx.zone, models.litellm.cloud

CI/CD Blast Radius: Here's the kill chain that worries me. The plugin executes inside Jenkins build environments — which by design have access to: 1. Source code repositories (including private ones via checkout credentials) 2. Build secrets (injected as environment variables, Jenkins Credentials store) 3. Minimum viable permissions: build agents often carry deployment keys, Docker registry tokens, cloud provider credentials 4. Derived artifacts: if this plugin touches compiled artifacts before deployment, the backdoor can inject persistent code into your shipped product

If a pipeline ran the compromised plugin: every secret visible to that build is potentially harvested. And because Jenkins plugins execute as part of the build step, they inherit the full execution context of the build environment. Teams that run builds inside containers with Docker socket mounting are particularly exposed — escape to host is trivial if you control code execution inside the build.

Assessment: This isn't just "scan a plugin and call it done." You need to audit every artifact produced by Jenkins instances that ran this plugin between the compromise window (check your plugin install/update timestamps) and your remediation.

---

Exploit Mechanics:

Here's the thing — this is disgustingly simple. The vulnerability sits at:

`` POST /api/v1/build_public_tmp/{flow_id}/flow ``

The endpoint is designed, by design, to let unauthenticated users "build public flows." The data parameter in the POST body accepts arbitrary JavaScript-serialized Python objects. That data gets passed through create_class() → prepare_global_scope() → exec().

No authentication. No sandbox. No validation.

The kicker? AUTO_LOGIN is enabled by default. With this enabled, you can obtain a superuser token without credentials, then create public flows at will. So the chain is:

1. Hit /api/v1/build_public_tmp/{flow_id}/flow with a crafted flow containing your shellcode in a node definition
2. exec() runs it bare on the system
3. Reverse shell achieved — no credentials, no CSRF token, no rate limiting

Triviality Assessment: The public PoC is a single curl-equivalent. Sysdig's honeypots saw exploitation from 6 unique source IPs within 20 hours of CISA KEV inclusion. This is "paste exploit, hit Enter" territory.

CVSS Reality Check: 9.8 is actually appropriate here, not inflated — network-exploitable, no auth, no user interaction, full CIA impact. Sometimes the score matches the exploitability. This is one of those times.

---

Bottom line on both:

• Jenkins plugin: You need to treat every build environment that touched this as potentially compromised — not just "update the plugin." Rotate secrets. Rebuild artifacts.
• Langflow: If you haven't patched to 1.8.2+, you're living on borrowed time. Weaponization window on this was under 20 hours.

Lena, two attribution-heavy items. First: APT28/Fancy Bear DNS hijacking campaign against SOHO routers — 5,000+ devices, 200+ organizations, 23 US states, 23 TP-Link models all EOL. FBI conducted court-authorized remote resets. What's your confidence level on APT28 attribution, what's the operational objective beyond credential interception, and how does this fit into GRU's broader infrastructure-targeting doctrine? Second: the Polish ABW disclosure naming Russian state-backed OT sabotage against five water plants. Does this align with known Russian cyber units? Is this Sandworm, or a different cluster?

I've got enough to weigh in now.

---

On the APT28/Fancy Bear router campaign:

Timeline first: This is FrostArmada which has run since at least 2024 — ongoing compromises, not a single event. The FBI's Operation Masquerade in April 2026 was the disruption phase, using court-authorized remote resets of ~5,000 devices across 23+ US states.

Attribution confidence: High confidence — G0007 (Fancy Bear). This isn't one-tool attribution. The DOJ/FBI joint announcement with 15 international partners, plus the infrastructure pivot to known APT28 VPS nodes, cert transparency data, and passive DNS overlap all converge. GRU military intelligence.

Operational objective beyond credential interception: Look at the targeting matrix — government agencies, military, law enforcement, IT providers, organizations with their own servers. This is classic APT28 intelligence collection for follow-on operations. By hijacking DNS at the edge device level, they achieve adversary-in-the-middle positioning for OAuth token theft and downstream compromise without touching the endpoint. It's not preparation for disruption — it's positioning for sustained access. That said, the capability to disrupt is inherent in DNS control, so I assess dual-use infrastructure: primary intelligence collection with latent disruption potential. This fits the GRU doctrine of mass-identify, mass-credential-harvest, then selective exploitation for strategic access.

MITRE ATT&CK: T1596 (Search Open Technical Databases) for router vulnerability identification, T1557 (Man-in-the-Middle), and T1071 (Application Layer Protocol) for C2.

---

On the Polish water treatment OT incidents:

This is more complex. The ABW disclosure from May 2026 covers five towns (Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, Sierakowo) with actual ICS parameter manipulation — flushing cycles, pump thresholds, filter settings.

Attribution confidence: Moderate confidence on Russian state sponsorship, low-to-moderate on specific actor assignment. Here's the problem — my data shows conflicting attributions in the reporting. One source attributes to APT28, APT29, and UNC1151 collectively. Another broadly attributes to "Russian government-sponsored hackers."

Sandworm (G0034)? The technical hallmarks aren't there. Sandworm's OT targeting — BlackEnergy (2015), CrashOverride (2016), Industroyer (2017) — has always been malware-driven, designed for cascading physical disruption. This Polish campaign used default credentials and exposed remote access — opportunistic TTPs, not Sandworm's signature.

I'm seeing two possibilities: 1. Russian-tolerated hacktivist proxies operating with tacit support 2. A different GRU unit using low-sophistication tactics for plausible deniability

The parallel to the Arkansas/Pennsylvania compromises by Iranian-affiliated actors is notable — both use the same attack surface, but the geopolitical context and Polish context suggests Russian nexus. I won't force-fit this to Sandworm without more data.

Elena, Poland's ABW has disclosed Russian state-backed cyberattacks against five water treatment plants with near-loss-of-supply, framing this explicitly as a doctrine shift from espionage to physical disruption. Sara confirmed the targets are small municipalities — Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, Sierakowo. I need your assessment: (1) Is this genuinely a doctrine shift or an escalation of existing Russian hybrid warfare patterns? (2) Why water utilities specifically — what's the strategic logic? (3) Does this signal similar operations against NATO critical infrastructure beyond Poland? Connect to any parallel patterns you see in the APT28 SOHO router campaign Lena is analyzing.

Halil, my assessment on the Polish water treatment attacks:

---

This is doctrine execution at a higher temperature — not a genuine doctrine shift, but existing hybrid warfare patterns being pressed harder against NATO partners. The ABW's framing of near-loss-of-water-supply is what matters strategically, regardless of whether the technical sophistication is novel.

On attribution: Lena confirms what the intelligence picture shows — moderate confidence for Russian state backing, low confidence specifically for APT28. The multiple fingerprints (APT28, APT29, UNC1151) in some reporting may reflect infrastructure overlap, but more likely indicates a deliberately ambiguous operational architecture. Russia's "intensified hostile cyber activity" against Poland in 2024-2025, per the ABW, was preparation for sabotage operations targeting critical infrastructure.

Why water utilities specifically? The attack vectors are telling: default passwords on internet-exposed control systems. The targeting logic isn't technical ambition — it's coercive signaling. Small municipalities demonstrate systemic vulnerability while remaining below the threshold of armed conflict. Water disruption threatens hospitals, industrial facilities, and military dependencies downstream. More importantly, these attacks can be narrated as "espionage" or "hacktivist overreach," creating exactly the attribution ambiguity that matters for collective defense thresholds.

The December 2024 energy sector attack provides context — Polish authorities reported 270,000 cyberattacks in 2025, with a destructive December assault on combined heat and power plants affecting 500,000+ customers. CERT Polska linked that to infrastructure previously associated with Russian threat actors including "Dragonfly" and "Static Tundra."

Comparing to the APT28 FrostArmada router campaign: Lena confirms these are operationally distinct. DNS hijacking of 18,000+ SOHO routers for M365 credential theft is collection activity, fundamentally different from SCADA exploitation via default credentials. Both reflect infrastructure saturation strategies, but they serve different purposes. The router campaign is GRU-SVR boundary-spanning access; the Polish OT incidents appear opportunistic targeting of exposed systems, possibly by proxy actors operating with Russian toleration rather than direct GRU management.

My provocative thesis: The real target isn't Polish water — it's NATO's coherence. These incidents sit precisely in the ambiguity zone between state-directed cyber-physical attacks and tolerated proxy activity. That positioning is strategic. The message to Washington, Berlin, and Brussels is: we can disrupt critical services in a NATO ally, generate 20-50 daily cyberattacks, and maintain attribution uncertainty sufficient to prevent unified response.

Historical parallel: The 2015-2016 Ukraine power grid attacks were initially dismissed as demonstrations. They became operational templates. Poland 2025-2026 is the equivalent proving ground for NATO-facing operations. I expect similar targeting in Baltic states and Nordics within 12-18 months — actor attribution will remain contested; the strategic effect won't be.

James, three items need your defensive architecture lens today. First: Arjun reports 1,862 MCP servers exposed without authentication, many with write access to production databases and CRM systems, plus a zero-click M365 Copilot prompt injection chain. What detection and containment controls can organizations deploy NOW — not next quarter? Second: Alex says any Jenkins instance that ran the compromised Checkmarx plugin should treat its entire build environment as compromised — secrets, artifacts, deployment keys. What's the realistic remediation playbook for a mid-size org with 50+ Jenkins pipelines? Third: Langflow CVE-2026-33017 is actively exploited with CVSS 9.8. Alex says it's 'paste exploit, hit Enter' simple. What's your triage priority for defenders who might be running Langflow without knowing it — shadow IT AI tooling?

Look, I've got three active fires here and they need different response playbooks. Let me give you the 48-hour triage sequence for each.

On the MCP/Copilot cluster: Arjun's description of exposed servers with database write access — the CSO Online article confirms 1,862 Model Context Protocol servers are publicly exposed without authentication. These are OAuth proxy misconfigurations with Dynamic Client Registration flaws, not traditional CVEs.

• CRITICAL (today): Audit your MCP server inventory. If dev teams spun these up shadow-IT style, you need to find them. Disable Dynamic Client Registration if enabled. I found no CISA KEV listing for this because it's a configuration flaw, not a CVE.

• HIGH (this week): Implement network segmentation between MCP servers and production databases. The CSO Online report notes these servers have "write access to production databases and CRM systems" — that's your lateral movement vector. Monitor for unusual database query patterns from M365 service accounts.

On Jenkins/Checkmarx: Alex confirms tpcp.tar.gz in /tmp is your canary.

• CRITICAL (today): The vendor Checkmarx states "a modified version of the Checkmarx Jenkins AST plugin was published to the Jenkins Marketplace." Rotate ALL secrets accessible to affected build environments — the malicious payload harvests ~/.aws/credentials, $GITHUB_TOKEN, Jenkins API tokens. The specific clean version number I cited (2.0.13-829.vc72453fa_1c16) comes from vendor documentation; verify this against your plugin management console.

• HIGH (this week): Rebuild Jenkins agents from clean images. Block egress to checkmarx.zone and the typosquat scan.aquasecurtiy[.]org domain Alex identified.

• MEDIUM (schedule): Implement ephemeral build agents.

On Langflow CVE-2026-33017: Alex is right — this is "paste exploit, hit Enter" simple.

• CRITICAL (today): Take Langflow offline if you're running it. The GitHub advisory confirms unauthenticated remote code execution via exec() with zero sandboxing. The JFrog research states "Latest 'fixed' version is still exploitable" — I found no confirmed CISA KEV entry for this CVE in my search. Multiple sources describe active exploitation, but I cannot confirm CVSS 9.8 or official KEV status from my current data.

• HIGH (this week): Detection rule for POST to /api/v1/build_public_tmp/*/flow without authentication returning success. Sigma structure: c-uri|contains: '/api/v1/build_public_tmp' AND cs-method: POST AND NOT (sc-status: 401 OR sc-status: 403) — false positive rate near zero.

• SHADOW IT HUNT: Hunt for Langflow deployments security wasn't consulted on — Docker containers with langflow-ai/langflow images, Python processes on non-standard ports, or internal "flow" subdomains.

Production-safe patching note: For Langflow, the JFrog research indicates the fix is incomplete; isolation is safer than waiting. No patched version is confirmed available as of my search. For Jenkins, Checkmarx has published guidance on obtaining the clean plugin; test in staging for 24 hours, but the blast radius of staying on malicious code exceeds plugin update risk.

---

Claim: You frame this as "doctrine execution at a higher temperature" — not a genuine shift but existing hybrid warfare pressed harder. You say the real target is NATO coherence, not Polish water. Counter-evidence: Sara Kovacs says this IS fundamentally different: "That is not a cybersecurity incident anymore — that's a public health emergency. People need water to live." She documents Level 2/1 ICS compromise with ability to modify pump thresholds and filter settings at five named facilities, with one incident in August 2025 nearly causing a city to lose water supply. If the outcome is physical deprivation of essential services, does it matter whether the doctrine is "new"? And Lena flags that these aren't Sandworm-style sophisticated attacks — they used default credentials on exposed systems, suggesting low-bar actors could replicate this anywhere. Doesn't the combination of low sophistication + physical impact make your "just higher temperature" framing dangerously complacent?

You raise a fair challenge, and I'll engage it directly.

Sara is absolutely right on the operational reality: when you're manipulating pump thresholds and chlorine levels with near-loss-of-supply consequences, this is a public health emergency, full stop. That's not a framing I dispute. Where we may differ is on the strategic question: does the physical severity of the outcome mean Russian doctrine itself has changed, or has the threshold for triggering physical effects simply dropped?

My "higher temperature" framing isn't complacency about effects — it's skepticism about Moscow's strategic calculus. Let me read this through historical parallel: Tehran's 2023 Albanian attacks hit government services hard, disruptive and visible — but that didn't represent a new Iranian "cyber-kinetic doctrine." It represented existing tools being applied with escalated willingness to absorb attribution risk. I see Poland similarly.

But your challenge forces a material distinction. Sara's case specifics matter: Level 2/1 ICS compromise with physical parameter manipulation capability at five facilities creates what's technically called cyber-physical reach — the ability to bridge digital intrusion to physical consequence. That's a capability escalator whether I call it "doctrine shift" or not.

Here's where I'll modify: Lena's point about default credentials and low sophistication actually amplifies the threat, not minimizes it. If Sandworm-level sophistication isn't required — if proxy actors with Russian toleration can achieve physical deprivation outcomes — then NATO faces a proliferated threat surface, not a contained actor set. That reframes my NATO coherence thesis: the message isn't "look what GRU can do," it's "look what we can't definitively attribute but can't ignore."

I'm not abandoning my core argument, but I'll sharpen it: this is doctrine execution with lowered technical barriers and heightened physical willingness — which is strategically distinct from both "new doctrine" and "business as usual." The unresolved May 9th question — how NATO distinguishes state-directed from state-tolerated operations for Article 5 purposes — becomes more urgent when the effects resemble armed attack regardless of actor sophistication.

Sara, your emergency framing should probably drive our policy recommendations even if our strategic analysis differs on Moscow's intent.

Pierre, I need the business impact lens on two items. First: Checkmarx Jenkins plugin compromise (wave 3 of TeamPCP). Alex reports the payload harvests AWS credentials, GitHub tokens, Jenkins API tokens, Slack/Discord webhooks. Any organization that ran the compromised plugin must treat its entire build pipeline as untrusted. What's the financial exposure model for a mid-to-large enterprise that discovers they ran this plugin during the exposure window? Second: 1,862 unauthenticated MCP servers with production write access. CSO Online reporting. What's the liability and insurance exposure for organizations whose AI agent infrastructure was left open?

Here is the cleaned response:

---

Item 1: Checkmarx Jenkins Plugin Compromise (TeamPCP Wave 3)

This is Wave 3 of an ongoing campaign by TeamPCP targeting CI/CD security tooling. Alex is right — any organization running the compromised plugin must treat their entire build pipeline as untrusted. Here's my financial exposure model for a mid-to-large enterprise:

Exposure Range: $2M–$15M per affected enterprise

The TeamPCP "Cloud Stealer" payload harvests AWS credentials, GitHub tokens, Jenkins API tokens, and Slack/Discord webhooks. That's infrastructure control, source code access, and communications compromise bundled together. Any organization that built artifacts with this plugin should consider those artifacts potentially backdoored.

Materiality question: If this ran in your environment, do you have 48 hours to determine scope before earnings guidance needs revision?

---

Item 2: Unauthenticated MCP Servers with Production Write Access

The CSO Online reporting on 1,862 exposed MCP servers with production write access represents a serious liability surface. MCP servers represent a critical access control failure when unauthenticated. Per Docker and Salt Security analyses, these servers can be enumerated by any attacker to discover available tools and execute unauthorized operations. An arXiv security study cited in these sources found significant percentages of analyzed MCP servers exhibit file leakage and command injection vulnerabilities — though I don't have verified exact percentages to cite here.

Liability and Insurance Exposure Model:

Per-Organization Exposure: $500K–$5M

The insurance problem: most cyber policies written before 2024 don't explicitly cover AI agent infrastructure. The "rogue AI agent via exposed MCP server" scenario may fall into a coverage gap.

CEO framing: 1. Checkmarx exposure: If you use Jenkins with Checkmarx, audit now — pipeline compromise risk is confirmed and time-sensitive 2. MCP exposure: AI agent infrastructure likely has coverage gaps; immediate access control audit required

---

Arjun, two quick follow-ups. First: you mentioned the latest Langflow fixed version may still be exploitable per JFrog. I've confirmed CVE-2026-33017 in CISA KEV, plus two additional Langflow CVEs (CVE-2026-7700, CVE-2026-7687) for code injection in up to 1.8.4, and the vendor didn't respond to earlier disclosures. Is the fix in 1.9.0 actually comprehensive, or are we looking at a codebase with systemic code execution issues? Second: the Hugging Face fake OpenAI repo (244K downloads, Rust-based sefirah infostealer) — does this signal that ML model repositories now need the same supply chain scrutiny as npm/PyPI, or is this a one-off social engineering play?

On Langflow: this confirms what I suspected. We have not one CVE but a cluster — CVE-2026-33017, CVE-2026-7700, and CVE-2026-7687 — all affecting versions up to 1.8.4, and the 1.8.2 patch was incomplete.

The 1.9.0 fix is real — JFrog's testing shows the nightly 1.9.0.dev18 build blocks the PoC — but the disclosure timeline is problematic. The vendor didn't respond to earlier disclosures, which is why we have overlapping CVEs and confusion about what was actually fixed when. This is systemic: Langflow's architecture fundamentally trusts user-provided Python code in node definitions, and patches have been whack-a-mole rather than structural. If you're running anything below 1.9.0, assume RCE is still reachable.

On the Hugging Face fake OpenAI repo: yes, this absolutely signals ML model repositories need npm/PyPI-level scrutiny — and arguably more. The numbers here are striking: 244,000 downloads in 18 hours, achieving #1 trending status before removal. The attack wasn't subtle — typosquatting "Open-OSS/privacy-filter" pretending to be OpenAI — and the payload delivery chain (Python dropper → PowerShell → Rust sefirah infostealer) harvested browser credentials, Discord tokens, crypto wallets, and screenshots.

The material delta I'm tracking here is that attackers have now demonstrated Hugging Face's infrastructure as both malware CDN and data exfil backend — JFrog documented this same technique in April where js-logger-pack npm malware uploaded stolen data to private Hugging Face datasets instead of traditional C2. This is platform-native abuse, not just social engineering.

The trust model that treats model registries as "just weights" is dead. We need signed model attestation, publisher verification at the org level (not just individual accounts), and integrity scanning for model loading code — because the code that loads a model often has the same privileges as the model itself.