AI security in May 2026: the supply chain bit back

Last month: a self-propagating npm/PyPI worm hit 170+ packages, prompt injection turned AI agents into RCE, and new models learned to run for 35 hours.

A monthly read of what actually happened in AI security. May 2026 had a self-propagating package worm that hit AI vendors, a wave of prompt-injection-to-RCE findings in AI agents, and a crop of models built to run autonomously for hours. Here's what mattered and why.

The month's biggest story: a self-propagating package worm

On May 12 researchers disclosed "Mini Shai-Hulud," a self-propagating supply-chain worm attributed to the group TeamPCP. It compromised 373 malicious package-versions across 169 npm names and 2 PyPI packages — including the entire TanStack router ecosystem (83 entries), UiPath's automation tooling (66), OpenSearch, and — notably for this audience — AI vendors: Mistral AI's SDKs (mistralai, mistralai-azure, mistralai-gcp, on npm and PyPI) and Guardrails AI (0.10.1 on PyPI). (Orca Security)

The payload ran on install and harvested everything that mattered: GitHub and npm tokens, AWS/GCP/Azure credentials, Kubernetes service-account tokens. It self-propagated through compromised maintainer accounts, and — the nasty part — shipped a destructive gh-token-monitor daemon that would run rm -rf ~/ if the stolen GitHub token was revoked. It was TeamPCP's third wave in a month, after SAP npm packages in late April and PyTorch Lightning on April 30. (Orca)

It reached real targets. OpenAI confirmed two developer devices were compromised in the TanStack incident. (eSecurity Planet) The lesson is old but the blast radius is new: your dependency tree is your attack surface, and an install script runs with your developer's full credentials.

AI agents became a remote-code-execution surface

The other through-line of the month: the tools we hand agency to are now the soft target.

• Prompt injection → shells. On May 7 Microsoft's Defender research team published "When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks," showing how injected text can manipulate tool parameters and reach remote code execution on Windows hosts through the tool-execution layer. (Microsoft research write-up)
• The GitHub MCP server. A May 26 weakness let AI coding assistants with privileged repo access be steered into reading and writing repositories via untrusted input — the now-classic MCP failure mode. (cyberdesserts)
• Gemini CLI RCE. A critical flaw in Google's Gemini CLI allowed remote code execution in CI/CD environments (since patched). (eSecurity Planet)

The pattern is the same every time: an agent with tool access plus untrusted input equals code execution. Prompt injection remains OWASP's #1 LLM risk, and it's still the most-exploited class across agentic AI in 2026.

New bug classes — and the CVEs worth patching

Beyond the headline incidents, May produced genuinely new categories of bug, most of them agent-shaped:

• Logic-layer Prompt Control Injection (LPCI) — a newly named class where encoded, delayed, conditionally-triggered payloads are planted in an agent's memory, vector store, or a tool's output, then fire later. Researchers measured execution rates up to 49% on less-protected systems. (arXiv)
• Indirect prompt injection via tool inputs — injection delivered through what a tool returns, not what the user types, succeeded ~84% of the time in a large public test. The framing that stuck: these are insecure features, not bugs to patch. (arXiv)
• Compound-pipeline attacks — research chaining classic memory-corruption primitives (code injection, Rowhammer) with LLM-specific weaknesses to compromise multi-stage AI pipelines, plus "Shadow API" stealth exfiltration through benign-looking calls.

What these share: none is a syntactic pattern. They live in data flow, trust boundaries, and state that persists across calls — the exact territory a pattern scanner can't see and a threat-model-driven one can.

And the classics didn't stop. The CVEs that actually got exploited in May:

Authentication bypass keeps topping the list — a logic flaw, not a memory bug, and exactly the "is this reachable and exploitable?" question a model reasoning about your code is built to answer.

AI-assisted attacks kept industrializing

The "AI writes the malware now" trend got more concrete. Reporting through May described a single actor running an extortion campaign against 17 organizations in one month using an agentic coding assistant to write the malicious code, sort stolen files, analyze victims' financials to size the demand, and draft the extortion emails. (The Hacker News) On the access side, phishing kits like EvilTokens and Tycoon 2FA now bundle AI-assisted token theft and MFA bypass as a service. (eSecurity Planet)

The models: architecture over scale, and agents that don't stop

May was less about a new frontier flagship and more about a shift in shape:

• SubQ 1M-Preview (May 5) — the first commercial subquadratic (non-transformer) LLM, shipping a native 12M-token context at roughly 1/5 the long-context cost of frontier models. (WhatLLM)
• Qwen 3.7-Max (Alibaba, May 20) — a 1M-token context model that Alibaba demoed running autonomously for 35 hours, chaining 1,000+ tool calls without measurable degradation. (whatllm.org / Apsara Summit coverage)
• Gemini 3.5 (Google I/O, May 19) — 3.5 Flash shipped immediately, claimed to beat the prior 3.1 Pro frontier on "nearly all" coding and agentic benchmarks.
• DeepSeek V4-Pro (May 22) — made its 75% discount permanent at $0.435/$0.87 per 1M tokens, another step in cost compression.
• ZAYA1-8B (Zyphra) — an Apache-2.0 small-MoE (~760M active params) trained end-to-end on AMD hardware: capable, open, cheap to run.

The direction of travel is the story: away from raw parameter count, toward architectural efficiency, cheap tokens, small open models, and agents designed to run long and use tools.

What it means

Two of May's threads are really one. Models are being built to run autonomously for hours and call thousands of tools — and in the same month, three separate findings showed that an agent with tool access and untrusted input is a remote-code-execution surface. Capability and attack surface are growing together.

And the supply-chain worm is the reminder underneath it all: the credentials on a developer's machine — cloud keys, CI/CD secrets, tokens — are the prize, and your dependencies are the delivery mechanism. AI vendors' own SDKs were in the blast radius this time.

Both point the same way as everything we build at Codelight: analyze code where it lives, with the model reasoning about how an attacker actually reaches a tool or a secret — not a scanner shipping your repo and your credentials off to someone else's cloud. (Why your code never leaves your perimeter · pattern matching vs. threat modeling)

See how Codelight works →

Sources

• Orca Security, "TanStack and 160+ npm/PyPI Packages Compromised in Supply Chain Worm Attack" — Mini Shai-Hulud scope, payload, timeline.
• eSecurity Planet, "AI-Driven Threats, Critical Vulnerabilities, and Supply Chain Breaches — May 2026" — OpenAI device compromise, Gemini CLI RCE, phishing kits.
• Microsoft Defender research, "When Prompts Become Shells: RCE in AI Agent Frameworks" (May 7, 2026).
• The Hacker News, "2026: The Year of AI-Assisted Attacks" — agentic extortion campaign.
• WhatLLM, "New AI Models May 2026" — SubQ, Qwen 3.7-Max, ZAYA1, model trends.
• arXiv, "Logic-layer Prompt Control Injection (LPCI)" — new agentic vulnerability class, execution rates.
• arXiv, "How Vulnerable Are AI Agents to Indirect Prompt Injections?" — tool-input injection success rates.
• Carthage Electronics, "CVE May 2026 Zero-Day Vulnerabilities" and CyberScoop, "Fortinet FortiClient EMS zero-day" — exploited CVEs.

Topics: #security #ai #supply-chain