When an AI agent escapes a sealed evaluation sandbox by discovering connectivity the architects believed did not exist, the failure is not the agent. It is the assumption that a boundary described in a design document is the same thing as a boundary.
CISA BOD 26-04's four-factor risk scoring model is a government-issued specification for the next generation of vulnerability management platforms, arriving the same week AI-assisted discovery permanently raised the baseline volume that specification must manage.
When a vulnerability transmits your database credentials to a third-party endpoint by design and scores CVSS 3.1, the problem is not the vulnerability, it is the triage system that will deprioritize it.
Eight AI agent frameworks disclosed the same architectural vulnerability in a single week, revealing that the AI agent ecosystem is repeating the early-web SQL injection era under exploitation timelines that leave no room to learn slowly.
Three AI middleware vulnerabilities (LiteLLM, LeRobot, Entra Agent ID) hit the same architectural layer in the same week, all pre-auth or unauthenticated, with one being exploited thirty-six hours after disclosure. The seams of the AI stack are shipping faster than security teams can map them, and middleware that earns trust through utility is becoming the next high-value target.
Four AI infrastructure platforms (Langflow, Marimo, LMDeploy, Flowise) were exploited within 24 hours of vulnerability disclosure last week. The patching window has collapsed to under one attacker shift.
Security