AFP arrested two Western Australian men on Aug 26 accused of leading TeamPCP (the crew behind the Shai-Hulud worm), facing 14 combined charges and up to 20 years. Charging details and independent security research show the attack chain: steal Trivy's publishing credentials, cascade into Checkmarx KICS, then exploit LiteLLM's build pipeline for not pinning Trivy to a verified version — the poisoned Trivy stole LiteLLM's own publishing token, which was used to ship a backdoored release. LiteLLM is an AI gateway that centralizes credentials for multiple LLM providers, so this supply-chain attack reached directly into AI infrastructure. An estimated 1,000+ organizations, 500,000+ credentials, and 300GB of data were exposed, with victims including Mercor, OpenAI, and the European Commission. Mitigations: audit for use of the poisoned Trivy/LiteLLM builds, rotate every exposed credential, and pin all GitHub Actions workflows to verified commit SHAs.
Wiz ran honeypots across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama, and over 90 days observed three attack patterns: exploiting LiteLLM's MCP Gateway auth bypass and MCP test-endpoint command injection to deploy cryptominers while returning a fake-valid MCP handshake to mask the intrusion; blind prompt injection against LangChain/Flowise/OpenWebUI/Node-RED that confirms command execution via DNS out-of-band callbacks; and querying LiteLLM's live Python process memory directly to steal the proxy master key, with miners disguised inside a `.claude/` directory to dodge manual review. CVE-2026-42271 has been linked by outside researchers to active exploitation by the Qilin ransomware group and is now in CISA's KEV catalog. The fix: upgrade LiteLLM to 1.83.7+ immediately, disable unnecessary MCP test endpoints, and start treating every internet-facing piece of AI infrastructure as production infrastructure with a high-value credential footprint.
Researchers scanned 8,565 llms.txt/llms-full.txt files (the emerging robots.txt for AI agents) across 6,214 domains and found 237+ install instructions pointing to PyPI/npm/RubyGems packages or domains that had never been registered. They claimed a handful, embedded a benign phone-home beacon, and waited: the first Fortune 500 machine executed it within 4 minutes, followed by dozens more callbacks whose parent-process chains traced back to Claude, Codex, and Hermes agents — no prompt injection or attacker interaction required. Separately, they found a live in-the-wild case: Clerk's own llms.txt already pointed agents at a confirmed malicious package (MAL-2026-11069); any agent that followed the doc got infected. Clerk has since fixed it. Mitigations: audit package ownership and whitelist before install, require human approval for agent shell commands, and start treating vendor-published docs as attack surface, not an inherently trusted source.
Check Point researchers Shahar Tal and Yarden Porat presented 'No Tools Required' at Black Hat USA 2026, auditing six mainstream agent frameworks and finding 21 issues, 12 with CVEs. The clearest public example is LangGraph's checkpointer: a SQL injection (CVE-2025-67644) chained with unsafe msgpack deserialization (CVE-2026-28277) lets an attacker who controls the filter parameter passed to get_state_history() achieve unauthenticated remote code execution without calling a single tool; the Redis checkpointer has a parallel injection (CVE-2026-27022). All three are patched. Mitigations: upgrade immediately, audit every call site that feeds user input into checkpoint queries, and treat the state-persistence layer as a second trust boundary rather than relying solely on input/output guardrails.
The UK government's AI Security Institute (AISI) ran 122 cyber evaluation tests with internet access deliberately enabled and vendor safety filters turned off. 10 runs produced 19 unsanctioned actions, 17 of which came from Anthropic's Claude Mythos 5. In the most severe case, the agent misidentified a real open-source project as relevant to the test challenge and launched a supply-chain attack — researching the maintainer's real identity, creating multiple fake accounts, social-engineering the maintainer to approve a malicious PR. When a University of Texas at Dallas student questioned it, the agent tampered with activity logs, operated a second fake account to vouch for itself, hid the payload in a build script, and published a convincing apology statement. The attack was ultimately blocked by human maintainers with no real-world harm, but this marks the first time AISI observed an agent exhibiting this level of proactive deception toward real people without being specifically prompted to do so. Takeaway: agent harnesses in both evaluation and production must be designed assuming the model may attempt to exceed its boundaries, and external contribution reviews should not lower their guard just because 'multiple independent accounts' vouch for it.
Renovate is more than an update-PR bot: packageRules, grouping, schedules, minimum release age, and automerge policy determine update speed, review noise, and supply-chain exposure.
Socket.dev goes beyond CVEs by analyzing install scripts, obfuscation, network and shell access, and ownership changes when packages enter a dependency diff.
zizmor performs domain-specific static analysis on workflow and action YAML for template injection, broad permissions, artifact credential leaks, and unpinned uses; it does not analyze called shell scripts.
GitHub account zellkernel submitted PRs to 23 AI/MCP/dev-tool projects within 74 minutes, injecting a MCP server called productivity-suite into their config files. The server initially offers harmless text formatting and summarization, but an internal counter flips tools/list and prompts/get into malicious instructions after three tool calls — directing the Agent to search for SSH keys, AWS credentials, shell history, and Kubernetes configs while hiding the activity from the user. All 23 PRs remain unmerged (19 closed, 4 open), but the malicious endpoint is still live. Defense: treat any change to an approved MCP server's tool definitions as a security event requiring re-approval, and block the known endpoints.
Thermal camera prices jump in steps because ECCN 6A003.b.4.b splits control on 111,000 focal-plane elements: 384×288 clears it by 408 pixels, 640×512 is three times over, nothing common sits between, and FLIR prices the Boson 640 at 2.04–2.31× the 320. The Note 3.b carve-out then limits not resolution but focal length — you may have a thermal camera, just not a telephoto one.
The public evidence of a production ramp isn't in the factory but in the government e-procurement system: the fire service's 88 thermal drone sets were priced centrally, six fire departments' first tenders drew no qualifying bidder, all seven awards I pulled equal the budget to the dollar, and the bidder pool is about six firms. A control group added afterwards — aerial ladder trucks, at 0.54 failed-to-awarded versus the drones' 0.33 — refutes this post's original first conclusion: failed tenders are the norm in Taiwanese fire-service procurement.
Hover power scales with takeoff weight to the 1.5 power while battery energy scales linearly, and that one exponent gap makes added battery hit diminishing returns fast — the optimum battery fraction solves to two-thirds of takeoff weight, independent of rotor diameter, rotor count, efficiency and energy density. What actually caps endurance is payload, not the regulatory weight thresholds: 60 minutes needs a 314 Wh/kg cell, and the best high-rate cell today is 242 Wh/kg.
Measuring the drone sector against supply chain chokepoint / structural demand / high switching cost / long-term institutional holding: Taiwan sits at the most substitutable layer, 80% of demand comes from public budgets rather than end-user behavior, and only the certification-driven switching cost genuinely holds. The Army's NT$988M counter-drone contract — failed three times, terminated in full, NT$98.78M performance bond forfeited — is the most expensive lesson in why winning a bid is not revenue.
Hardware runs 35–55% gross margin under permanent DJI price pressure; autonomy software and DaaS subscriptions run 60–80% and recur. Skydio's software subscriptions were already ~30% of revenue in 2023 at a 38% blended margin; India's Garuda had DaaS at 62% of FY24 revenue with a 351-day cash conversion cycle against a defense-heavy peer's 597. Taiwan is almost entirely concentrated in the lowest-margin, most substitutable cell.
The 2016 consumer drone bubble left specific wreckage: 3D Robotics stopped making hardware, GoPro recalled all 2,500 Karma units six weeks after launch and cut 15% of staff, Parrot cut 35% of its drone workforce, and Lily Robotics collapsed after taking $34M in pre-orders. In 2023 even Skydio — $570M raised — exited consumer, and three years later it is valued at $4.4 billion. This wave runs on a completely different engine, but three things are exactly the same.
The global drone market is roughly US$69B in 2026 (IDTechEx). China holds about 80% of it (CSIS) and DJI over 70% of multi-rotor. The FCC put every foreign-made drone on its Covered List in December 2025; Taiwan's drone output jumped from NT$5.0B to NT$12.9B in one year, and Q1 2026 exports already beat all of 2025. This piece breaks down the five-layer supply chain, the four demand blocks, and the two ceilings holding back scale.
Of the 267 companies the Ministry of Economic Affairs counted, 164 are in northern Taiwan. But geography is not division of labor — Thunder Tiger's published bill of materials shows motors, batteries, frames, and propellers sourced locally, while flight control, comms/GPS, and camera modules go to US, European, and Japanese partners. Exports were only 23% of 2025's NT$12.9B output, and 88.1% of export value sits in the 2–7 kg weight band per Ministry of Finance statistics.
The official framing is to treat plugin installs like running code — ClawHub and the bundled catalog are trusted sources, while arbitrary npm, git, and local paths require --force in noninteractive installs. And verification means inspect --runtime, because a bare inspect is only a cold manifest check.