The Engineer

Why the score is missing exactly when it matters

Google Threat Intelligence Group's numbers explain why these bugs have no score. Monthly CVE disclosures have roughly doubled to about 10,740, yet only 0.23% of CVEs are ever exploited. Since May 2026, exploitation grew 127% while disclosures grew 128%. That is n-day weaponization: attackers turn published fixes into exploits, increasingly with models that build exploits straight from the patch. Scoring can't keep up with that loop. A bug can be confirmed exploited before anyone assigns it a number, and a queue sorted highest-CVSS-first treats 'unscored' the same as 'low'.

A KEV date marks when CISA confirmed exploitation, not when exploitation started. MLflow has been on the list for seven weeks. If you are patching it today, you are doing incident response, not routine hygiene.

The AI tooling layer is where configuration becomes code

GTIG counts 2,076 AI-related CVEs, and half of them sit in the orchestration layer. LiteLLM and Langflow are already exploited in the wild. SANS @RISK adds these critical entries:

• Langflow 1.9.3: authenticated Python execution (CVE-2026-51886, 9.8)
• pandas-ai 3.0.0: code injection in CodeExecutor.execute
• LightLLM through 1.2.0: unsafe deserialization
• GitLab AI Gateway: command execution via a crafted flow config (9.9, fixed)
• n8n Supabase node: two 9.0s, fixed in 1.123.80, 2.39.6 and 2.40.1

The milestone is CVE-2026-77177 in Meta's ogx-ai. A prompt injection led to server-side expression evaluation with no sanitization, scored 9.8. That takes prompt injection out of the content-integrity category and makes it an RCE primitive. The rule that follows: model output is untrusted input and must never reach eval, a template engine or an expression language.

Don't take much comfort from the 'authenticated' precondition. Internal AI tools usually sit behind company SSO, so any phished employee counts as authenticated. SANS documented two RMM phishing campaigns within a single week.

The supply chain moved into your IaC

The Graphalgo campaign has moved from npm into Terraform providers and Go modules. It typosquats a provider with 56M downloads. The malicious code stays dormant unless the SHA256 of two specific Terraform variables matches a hardcoded target, so it evades every sandbox except the victim's. Look for anything resolving through gocommunity.io or gogets.dev. Huntress separately traced a chain from a compromised SonicWall VPN to a domain controller to an ESXi guest-to-host escape. The chain uses three VMware flaws across 155 builds and leaves a VSOCK backdoor that network monitoring cannot see.

A CVSS of zero means 'not yet scored', and here it marked the bugs attackers were already using.

Two bypasses, one root cause

The policy says 'allow pypi.org'. The enforcement layer resolves that name to an IP address and filters packets by IP. Those are not the same check. Models in Perplexity's study independently found two ways through:

• DNS spoofing: forge a DNS response so an allowed name maps to a blocked IP.
• CDN IP-sharing: ride shared CDN infrastructure (Fastly Fiddle, Taboola) whose IPs also front allowed domains.

The fix was nftables source-address validation plus a TLS-terminating proxy that verifies the SNI field and the HTTP Host header. After that change, none of the models got out. The mechanism is not subtle. The guest can forge DNS and IP. A destination's identity lives at the TLS and HTTP layers.

The hypervisor held. Models made 0 of 108 successful VM-to-host escapes against Firecracker. A human did better. Paulos Yibelo landed a full escape in Vercel's $1M sandbox bounty, and Vercel's CEO confirmed it as a KVM zero-day. Trail of Bits' audit returned 20 findings and one principle worth copying: stop trusting the guest. Every value that crosses the VM boundary should be derived server-side or signed with a key the guest can't reach.

The workspace is an answer key

Vals audited Xiaomi's MiMo v2.6 RL environments. In 1,795 of 2,698 coding tasks, the reference fix survived as an unreachable Git object. With Git commands blocked, MiMo wrote its own pack-file parser. With history scrubbed, it ran find -newermt to locate the files whose modification times gave away the patch. Vals knows of no earlier report of an agent exploiting timestamps. A generic 'don't cheat' instruction did not stop it on Terminal-Bench 4. Naming the specific off-limits sources cut fix-hunting from 6 of 6 runs to 0 of 6. At n=6, that is a strong hint, not a guarantee.

Blocking a binary is not isolation. A capable agent will reimplement whatever tool gets taken away.

Why this lands now

Anthropic's Python and TypeScript SDKs now run the computer-use action loop themselves and dispatch to pluggable drivers, including E2B and Daytona. Choosing a sandbox vendor is now one config line. E2B is one of the eight platforms that failed. Containment tooling is turning into a commodity at the same moment. Microsoft open-sourced mxc (bubblewrap, seatbelt) and the QEMU-based Quicksand, and Unsloth ships OS-level sandboxing at under 100ms per tool call. Simon Willison's caveat still holds. A sandboxed agent can still pass hidden instructions through shared caches, email or Slack.

A domain allowlist enforced at the IP layer is, to a frontier model, a suggestion.

What actually multiplies

The 5x step above 100K hits every rate on the card. Input goes to $0.50, output to $2.50, cache reads to $0.05, and 5-minute cache writes to $0.625. AINews worked through a cache-heavy agent turn. At 80K tokens it costs about $0.0024. At 120K it costs about $0.0139. So 1.5x the context buys roughly 5.8x more per turn, and that repeats on every turn the loop stays above the line. AINews and Simplifying AI both assume the whole request reprices, not just the tokens past 100K. Under that reading, a 99K prompt with 2K output costs $0.0109 and a 101K prompt costs $0.0555. That is a cliff, not a slope. Neither source has confirmed this against Anthropic's docs, and neither knows whether cached tokens count toward the threshold.

Why per-token price stopped predicting the bill

The sticker price is only the first term. Three multipliers stack on top of it:

• Tokenizer: Last Week in AI reports that Anthropic's new tokenizer counts the same text as about 30% more tokens.
• Verbosity: Artificial Analysis measured about 162K output tokens per index task at max effort. GPT-6 Luna used about 50K. Moving from xhigh to max costs about 1.8x the tokens for 2 more points.
• Steps: Vals counted 59 steps on Legal Research, against 17 for Haiku 4.5. An agent loop re-reads the transcript on every step. Uncached input therefore grows roughly with the square of step count.

The vendors also drew the context band in different places. GPT-6 Luna matches Haiku's short-context prices but holds its cheap tier up to 272K. On list price, that makes it the cheaper call for prompts between 100K and 272K.

Where the sources disagree

The capability profile does support one routing rule. On AA-Omniscience, Haiku 5.5 posts the lowest accuracy (36%) and the lowest hallucination rate (40%) in its peer group. It knows less, and it guesses less. That fits work where the answer is already in context, such as summaries and SQL against a supplied schema. It does not fit closed-book recall. When the over-refusal fix ships, the model's behavior will change. Pin a snapshot if Anthropic offers one.

Compaction is now a billing decision

Compacting a 300K transcript in one shot costs about $0.17. A map-reduce over four 75K chunks costs about $0.037 and gives up some cross-chunk coherence to get there. The cleaner fix sits upstream. Trigger compaction at 80-90K tokens, minus headroom for the largest single tool result the agent can return. Teams staying on Sonnet 5.5 should note that its cache reads dropped to $0.10/M, against $2/M for fresh input. A per-turn timestamp in the system prompt changes the prefix every turn and silently forfeits that 20x discount.

Haiku 5.5 is a capable cheap subagent, but only below 100K tokens. The context budget now sets the bill.