Anthropic's Project Glasswing found 1,596 vulnerabilities across 281 open-source projects using an unreleased model. An independent follow-up found only 1.3% were ever exploited in the wild — matching the human-discovery baseline. The headline number and the load-bearing number aren't the same one.
A real 2026 staging-PII leak: a junior engineer restored the wrong S3 backup after a pipeline failure. The lesson isn't "add a masking tool" — it's removing the human-bypassable manual path entirely.
CVE-2025-55182 (React2Shell) got RCE from JavaScript quietly calling toString on an attacker-controlled object. Tool-calling frameworks do the same kind of implicit trust with LLM-generated JSON — here's the transferable lesson, not a claim we've shipped a fix for it.
Automating a manual Ed25519 license-signing step across Python and JavaScript surfaced a WebCrypto spec quirk and a quiet json.dumps/JSON.stringify disagreement that would have silently broken verification for any non-ASCII customer name.
Capital One lost 100 million records to one SSRF request against a cloud metadata endpoint. What a decoy IMDS endpoint actually needs to fake convincingly — including the real IMDSv2 handshake AWS added because of incidents like that one.
Two CVSS-10-class bugs in the same workflow-automation platform, a few weeks apart, and why the pattern matters more once AI agents are wired into the pipeline.