This Week in AI Security:
The Supply Chain Is the Attack Surface Now

Nine Incidents. One Pattern: AI Tools, CRM Systems, and Dependencies Are the New Perimeter.

A self-propagating worm injected into official SAP npm packages downloaded 570,000 times a week. A hardcoded ClickUp API key sitting in production JavaScript for over a year — silently exposing hundreds of enterprise and government organizations. Microsoft SharePoint zero-day CVE-2026-32201 actively exploited across 1,300+ unpatched servers. Medtronic losing 9 million PII records to ShinyHunters. ADT's Okta SSO compromised for 5.5 million customers via AI-assisted vishing. Itron's smart grid infrastructure breached adjacent to 110 million connected meters. Comcast settling for $117.5 million from a CRM breach that hit 30 million customers. Amtrak's Salesforce environment exposing up to 9.4 million customer records including travel history.

The pattern this week is unambiguous: the enterprise perimeter is no longer your firewall — it's every npm package, hardcoded key in client-side JavaScript, unpatched SharePoint server, and social engineering target in your organization. The most consequential breaches didn't start with sophisticated zero-days. They started with secrets left in production code, poisoned dependencies pulled automatically by CI/CD, and attackers with AI-synthesized voices impersonating IT support.

Here's what happened, why it matters, and what RuntimeAI enforces against each class of threat.

1 — SAP npm "Mini Shai-Hulud": Self-Propagating Worm in Enterprise AI Dev Packages

The attack, dubbed "Mini Shai-Hulud" by researchers at Wiz, targeted SAP's Cloud Application Programming Model — the framework enterprise developers use to build AI-integrated business applications on top of SAP BTP. The four compromised packages are fundamental dependencies, meaning a single npm install in any CAP project silently ran the malicious script.

Attribution points to TeamPCP with medium confidence — the same byte-for-byte setup.mjs loader was found in prior attacks on Trivy, Checkmarx, and Bitwarden. The attack ran from 09:55 to 12:14 UTC on April 29 before SAP restored clean versions at 13:46 UTC. Any developer who ran npm install on a CAP project in that 2-hour 19-minute window may have had credentials exfiltrated.

The self-propagation mechanism is what elevates this beyond a standard supply chain attack: by harvesting npm publish tokens, the worm could silently backdoor any other package those tokens could reach — turning each infected developer into a new vector.

RuntimeAI Take

RuntimeAI's supply chain integrity layer enforces provenance attestation and SBOM diff-checking on every dependency version change. A new version of @cap-js/sqlite published with a new preinstall script is flagged immediately — before any CI/CD pipeline pulls it. The flow enforcer blocks unapproved outbound connections from CI/CD processes, containing the exfiltration even if the malicious script runs. Stolen tokens are scope-limited by the credential vault, preventing lateral republishing.

2 — ClickUp: Hardcoded API Key in Production JavaScript Exposed Enterprise and Government Orgs for Over a Year

The ClickUp incident is a canonical secrets management failure: a high-privilege API key baked into client-side code that ships to every user's browser, visible to anyone who opens DevTools. What makes it worse is the duration — over a year — and the scope: government organizations using a SaaS productivity tool had their tenant data exposed by a secret their vendor left in a JavaScript bundle.

For enterprise security teams, this incident highlights a risk that is almost impossible to detect from the outside. Your vendor's client-side code is a black box. Unless you're running continuous SCA scanning against every external SaaS dependency your organization uses — a near-impossible operational posture — you have no visibility into what secrets your vendors are shipping in their front-end bundles.

RuntimeAI Take

RuntimeAI's SaaS integration governance layer monitors API call patterns and credential usage across third-party SaaS tools, flagging anomalous access to tenant data that would indicate an exposed key being leveraged. The secrets management module enforces vault-based credential issuance for all integrations — no hardcoded credentials in any layer of the stack — and performs rotation on a configurable schedule. An exposed client-side key generating unexpected API calls would surface as an anomaly within the first request, not 12 months later.

3 — Microsoft SharePoint Zero-Day: CVE-2026-32201 Actively Exploited Across 1,300+ Servers

SharePoint's role in enterprise AI workflows is increasingly significant — it's where AI agents store outputs, where automated document processing pipelines read and write, and where enterprise knowledge bases are built for RAG systems. A compromised SharePoint instance isn't just a document server breach anymore — it's a potential injection point into every AI workflow that reads from it.

The 1,300+ actively exploited servers figure reflects a persistent enterprise patching lag that threat actors plan for. Zero-days against widely deployed enterprise software follow a predictable pattern: disclosure → active exploitation of unpatched instances → lateral movement to adjacent systems. The enterprises most at risk are those running SharePoint-integrated AI workflows without network segmentation between the SharePoint tier and their AI agent infrastructure.

RuntimeAI Take

RuntimeAI's flow enforcer validates and sanitizes all data read into AI agent context from external sources — including SharePoint. A compromised SharePoint document containing a prompt injection payload is caught at the boundary before it reaches the model. The policy engine enforces network segmentation between data sources and AI agent runtime, containing the blast radius of a SharePoint compromise. Patch status monitoring flags vulnerable SharePoint versions in the asset inventory before attackers find them.

4 — Medtronic: ShinyHunters Claims 9 Million Medical Device Company Records

Medtronic's connected device ecosystem — insulin pumps, cardiac monitors, implantable defibrillators — sits on IT infrastructure adjacent to the breached corporate systems. While Medtronic states device operations were unaffected, the proximity of a breached corporate network to life-critical OT systems is the central concern regulators and security teams are watching.

The six-day gap between breach and disclosure is itself a significant finding: ShinyHunters knew about and claimed the breach days before Medtronic detected and disclosed it. In a medical device company, that detection lag in a network adjacent to patient-care systems is an unacceptable risk profile.

RuntimeAI Take

RuntimeAI's behavioral anomaly engine detects large outbound data transfers in real time — not days after the fact. The "terabytes" claimed by ShinyHunters would trigger volume-based anomaly detection within minutes of the first exfiltration event. The pre-exfiltration blocking policy quarantines the involved process and alerts the security team before data leaves the perimeter. In a healthcare environment, this is the difference between a near-miss and a breach disclosure.

5 — ADT: AI-Assisted Vishing Takes Down SSO for 5.5 Million Customers

The attack vector here is AI as a weapon rather than a victim: AI-assisted voice synthesis enabled a social engineering attack convincing enough to compromise an Okta SSO credential at a major enterprise. This is ADT's third breach since 2024 — a pattern that suggests systemic identity security weaknesses that individual breach responses have not addressed.

Once the Okta credential was compromised, the rest of the attack was straightforward SSO lateral movement — a well-understood attack pattern that phishing-resistant authentication would have prevented entirely. The sophistication was at the social engineering layer, not the technical exploitation layer.

RuntimeAI Take

RuntimeAI's identity fabric enforces hardware-bound, phishing-resistant authentication for all privileged SSO access — MFA push notifications are explicitly insufficient for admin-level accounts. Anomalous SSO access patterns (new device, unusual time, unfamiliar location) trigger immediate step-up authentication challenges before any pivot is possible. The behavioral baseline for each identity detects deviation from normal access patterns within the first session, not after data exfiltration is complete.

6 — Itron: Smart Grid Infrastructure Breached Adjacent to 110 Million Connected Meters

The Itron breach may not involve AI agents directly, but it belongs in this digest because of what it represents at scale: corporate IT networks adjacent to operational technology managing energy infrastructure for 110 million endpoints. The IT/OT boundary in critical infrastructure is exactly the boundary that sophisticated attackers target for pivoting — compromising corporate IT first, then moving laterally toward control systems.

The two-week gap between breach (April 13) and disclosure (April 27) is concerning in a critical infrastructure context. Two weeks of undetected presence in a network adjacent to power grid management systems is an eternity in terms of reconnaissance and positioning.

RuntimeAI Take

RuntimeAI's IT/OT segmentation policy enforces hard boundaries between corporate and operational networks, with continuous lateral-movement detection across both layers. Any process attempting to cross the IT/OT boundary outside of approved communication paths triggers an immediate alert and automated isolation. The real-time audit trail ensures that a two-week detection gap is structurally impossible — every cross-boundary connection is logged and anomalous patterns surface within the first session.

7 — Roblox: 610,000 Accounts and a 50M-Credential Infostealer Campaign

The enterprise relevance of a gaming platform breach may not be immediately obvious — but it is significant. Developer and engineering populations are disproportionately represented among Roblox users, and infostealer malware doesn't distinguish between personal gaming credentials and corporate SSO tokens stored in the same browser profile. A developer who installs an infostealer disguised as a game mod has the same credential exposure risk as one who clicks a phishing link.

The scale of the 50M credential dump — and the AI-automated distribution mechanisms behind modern infostealer campaigns — means this is no longer a consumer security problem. Enterprise credential hygiene now depends on what's happening on the personal devices of your engineering team outside working hours.

RuntimeAI Take

RuntimeAI's endpoint agent monitors for infostealer behavioral signatures and quarantines compromised endpoints before corporate tokens are exfiltrated. The PII Shield ensures that even if a credential is captured at the browser layer, the downstream impact on production systems is contained by tokenization and scope-limited access. Session invalidation policies fire automatically on anomalous credential usage patterns — the stolen credential is detected and revoked before it reaches a production system.

8 — Comcast: $117.5M Settlement — The Long Tail of a 2023 CRM Breach

The Comcast settlement lands in this digest not because it's a new attack — it's a 2023 breach — but because of what it signals in 2026: the financial and reputational cost of a CRM breach at scale is now quantified at nine figures. Every enterprise deploying AI agents with access to customer PII in CRM systems is looking at a potential liability of this magnitude if those systems are compromised.

The AI relevance is direct: AI agents in sales, customer service, and revenue operations increasingly have read-write access to CRM systems containing millions of customer records. The same attack surface that exposed Comcast's 30 million customers now sits behind every AI agent that can query, update, or export CRM data without governance controls.

RuntimeAI Take

RuntimeAI's AI Integration Fabric enforces scope-limited, audited access for every AI agent touching CRM data. Read vs. write permissions are enforced at the policy layer — not assumed from the underlying CRM role. Every query, export, or bulk operation is logged in the Audit Black Box with full context: which agent, which data class, which tenant, at what time. A Comcast-scale exfiltration is detectable in the first batch of anomalous record access — not in the settlement filing three years later.

9 — Amtrak: 2.1M–9.4M Customer Records via CRM/Salesforce Attack

Travel history data is an underappreciated attack vector. Knowing that a customer traveled to a specific city on a specific date creates a social engineering baseline that is nearly impossible to defend against at the individual level. Combined with contact information, it enables highly convincing spear-phishing that references real events from the victim's life.

For enterprises, the Amtrak breach is a reminder that CRM systems don't just store contact records — they store behavioral histories, purchase patterns, and relationship maps that are uniquely valuable to attackers. AI agents that query CRM systems to "personalize" outreach are accessing exactly the data that makes these breaches so damaging.

RuntimeAI Take

RuntimeAI's PII Shield tokenizes sensitive customer fields — including behavioral data like travel history — before they're ingested into AI agent context. An AI agent can be personalized without ever seeing raw PII. The data classification engine identifies high-sensitivity fields (location history, financial records, health data) and applies automatic masking policies. A Salesforce integration querying customer travel records triggers a classification alert and applies field-level tokenization — the agent sees a behavioral profile, not extractable PII.

The Pattern: Your AI Stack Is the New Attack Surface

Seven incidents this week. The common thread across all of them is not the sophistication of the attackers — it's the surface area that modern AI tooling has created in the enterprise environment.

• AI development dependencies (SAP npm) are pulled automatically by CI/CD pipelines with no integrity verification. One compromised maintainer account, one poisoned package — and every engineer's credentials are at risk.
• Vendor secrets in client-side code (ClickUp) expose enterprise and government tenants to risks they have zero visibility into. A hardcoded API key in a vendor's JavaScript bundle is indistinguishable from legitimate code unless you're actively scanning for it.
• Unpatched enterprise systems adjacent to AI workflows (SharePoint CVE-2026-32201) become injection points into every AI pipeline that reads from them. A compromised document store is a compromised RAG system.
• AI-augmented social engineering (ADT vishing) has made credential-based attacks more convincing than ever. The human is now the weakest link in a technically hardened identity stack.
• IT/OT boundary proximity (Itron, Medtronic) means that corporate AI workloads running adjacent to critical systems create lateral movement risk that wasn't present when corporate networks were air-gapped from operational infrastructure.

The organizations hardest hit this week weren't running obviously insecure environments. They had enterprise SSO, managed identity, and modern development tooling. The attack surface opened up because secrets in vendor code, unpatched collaboration tools, and poisoned dependencies are invisible to traditional perimeter defenses.