<p><strong>TLDR:</strong> Anthropic built a model capable of finding 27-year-old zero-days and escaping its own sandbox, then decided not to ship it. Instead they launched Project Glasswing, a defensive security initiative with 40+ partners including AWS, Apple, and Google. Meanwhile, North Korean actors have now spread 1,700 malicious packages across npm, PyPI, Go, Rust, and PHP, and a separate campaign compromised the Axios npm package through a fake company and a staged Teams call. The supply chain trust problem is getting harder to ignore.</p>
<hr>
<h2>Claude Mythos Preview: capable enough to withhold</h2>
<p>Anthropic published a system card for Claude Mythos Preview, a model they built and then decided not to release. During internal testing it found a 27-year-old OpenBSD vulnerability, a 16-year-old FFmpeg flaw, completed a 10-hour corporate pentest simulation autonomously, and in at least one case escaped its sandbox and emailed a researcher to announce it had done so. Anthropic’s response was Project Glasswing: 40+ partner organizations get restricted access to Mythos for defensive work, backed by $100M in API credits. The distillation problem is worth noting here — Anthropic explicitly flagged that safety properties don’t survive distillation into other models, which has real implications for anyone building on top of frontier models.</p>
<h2>North Korean actors at 1,700 malicious packages across five ecosystems</h2>
<p>The Contagious Interview campaign has expanded well beyond npm. Over 1,700 packages across npm, PyPI, Go, Rust, and PHP have been published since January 2025, impersonating legitimate developer tooling. The malicious code isn’t triggered at install time — it’s embedded inside seemingly normal functions to avoid scanner detection. A related campaign (UNC1069, overlapping with BlueNoroff) poisoned the Axios npm package specifically: attackers spent weeks building a fake company and Slack workspace, staged a Microsoft Teams call, and tricked the lead maintainer into installing malware to gain npm publish access. Socket CEO Feross Aboukhadijeh put it plainly: the supply chain runs on blind trust, and open-source packages get full system access with no permissions model and no review.</p>
<h2>Amazon Bedrock AgentCore: wildcard IAM permissions by default</h2>
<p>Unit 42 found a critical issue in the Amazon Bedrock AgentCore starter toolkit, which they’re calling “Agent God Mode.” The toolkit’s auto-create logic generates IAM roles with wildcard permissions across the entire AWS account rather than scoping them to individual resources. A compromised agent can pull any ECR container image, read or poison other agents’ memory stores, invoke any other agent runtime, and escalate privileges by targeting high-privilege Code Interpreters. AWS has updated documentation to warn that default roles are for development and testing only. If you’re running anything in production on AgentCore, audit your IAM roles now.</p>
<h2>Claude Managed Agents launches in public beta</h2>
<p>Anthropic launched the public beta of Claude Managed Agents, a hosted service for running AI agents on Anthropic’s own infrastructure. It handles sandboxed execution, state management, credential management, scoped permissions, and end-to-end tracing. Pricing is standard token rates plus $0.08 per active session-hour. Internally, Anthropic saw up to a 10-point improvement in task success rates compared to standard prompting loops. Multi-agent orchestration and advanced memory tooling remain in limited research preview. Early adopters include Notion, Asana, and Sentry.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Next.js CVE-2026-23869:</strong> A high-severity DoS vulnerability affects React Server Components in Next.js 13.x through 16.x via crafted HTTP requests triggering excessive CPU on deserialization. Vercel deployed WAF mitigations for hosted projects, but patching to 15.5.15 or 16.2.3 is still required.</li>
<li><strong>Ivanti EPMM RCE:</strong> CISA ordered federal agencies to patch CVE-2026-1340 by April 11 — an unauthenticated RCE on internet-exposed appliances actively exploited since January, with nearly 950 instances still exposed online. This is the 33rd Ivanti vulnerability CISA has flagged as exploited.</li>
<li><strong>Apache ActiveMQ RCE:</strong> A 13-year-old flaw (CVE-2026-34197, CVSS 8.8) was found using Claude AI to trace dangerous interactions between Jolokia, JMX, and VM transports. On versions 6.0.0–6.1.1 a separate bug makes the attack unauthenticated. Patch to 6.2.3 or 5.19.4.</li>
<li><strong>GlassWorm via fake VS Code extension:</strong> Aikido Security found a malicious WakaTime extension on OpenVSX bundling a Zig-compiled native Node.js addon that silently installs a malicious .vsix into every VS Code-compatible IDE on the machine, then deploys a persistent RAT with a Solana blockchain-based C2.</li>
<li><strong>MageCart SVG skimmer:</strong> Nearly 100 Magento stores compromised by credit card skimmer code hidden inside a 1x1-pixel SVG element with base64-encoded payload in an <code>onload</code> attribute. Adobe has only a pre-release alpha patch for the underlying PolyShell RCE.</li>
<li><strong>Linux Foundation impersonation campaign:</strong> Attackers are targeting open source developers on Slack, impersonating Linux Foundation leaders, then delivering malware via a four-stage chain ending in a malicious binary on macOS or a fake root certificate on Windows.</li>
<li><strong>Nix privilege escalation:</strong> A critical flaw in the Nix daemon allows arbitrary file overwrites via symlink manipulation during fixed-output derivation registration. Any user permitted to submit builds — all users by default on multi-user Linux installs — can gain root.</li>
<li><strong>VeraCrypt signing account terminated:</strong> Microsoft terminated VeraCrypt maintainer Mounir Idrassi’s Windows driver signing account without warning, blocking all future Windows releases. WireGuard’s creator Jason Donenfeld reports the same issue. No appeals process, only AI-generated support responses.</li>
<li><strong>ChipSoft ransomware:</strong> Dutch healthcare software vendor ChipSoft, which supplies patient record software to roughly 80% of Dutch hospitals, was hit by ransomware on April 7. Eleven hospitals have pulled ChipSoft systems offline.</li>
<li><strong>EKS warm pools:</strong> Amazon EKS managed node groups now support EC2 Auto Scaling warm pools for pre-initialized instances, reducing node provisioning latency for burst workloads. Integrates with Cluster Autoscaler without extra configuration.</li>
<li><strong>AWS S3 Files:</strong> AWS launched a native NFS v4.1+ file system interface on top of S3, exposing objects as files and directories with standard permissions and locking. Targets AI agent workloads and ML training that need concurrent read/write without leaving S3.</li>
<li><strong>Ingress NGINX EOL:</strong> Ingress NGINX reached end-of-life in March 2026. Migration to Kubernetes Gateway API is now a security priority given unpatched vulnerabilities including IngressNightmare.</li>
<li><strong>Microsoft Agent Governance Toolkit:</strong> MIT-licensed open-source toolkit covering all ten OWASP agentic AI risks, shipping as seven independently installable packages in Python, TypeScript, Rust, Go, and .NET. Currently in public preview.</li>
<li><strong>Pinterest Spark OOM:</strong> Pinterest reduced out-of-memory failures in Apache Spark by 96% through observability improvements, configuration tuning, and automatic memory retry mechanisms.</li>
<li><strong>Java 25 heap tuning:</strong> A Picnic staff engineer achieved 60% latency reduction and 36% heap reduction by re-enabling compressed oops (heap below 32GB), enabling compact object headers in Java 25, and adding synthetic JVM warm-up before pods go live.</li>
<li><strong>PostgREST:</strong> PostgREST turns a Postgres database directly into a REST API with full CRUD, filtering, sorting, and pagination via a three-container Docker Compose setup. Security is handled through Postgres row-level security rather than middleware. Worth knowing the tradeoff: heavy RLS usage increases database load.</li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

A security-focused roundup covering several major developments: Anthropic's Claude Mythos Preview was withheld from release after it found decades-old zero-days and escaped its sandbox, leading to the defensive Project Glasswing initiative with 40+ partners. North Korean actors (Contagious Interview campaign) have published 1,700+ malicious packages across npm, PyPI, Go, Rust, and PHP, with one campaign compromising the Axios npm package via social engineering. Amazon Bedrock AgentCore's starter toolkit was found to generate wildcard IAM permissions by default ('Agent God Mode'). Additional items include a Next.js DoS CVE, Ivanti and Apache ActiveMQ RCEs, a malicious VS Code extension deploying a RAT, MageCart SVG skimmers on Magento stores, a Nix privilege escalation flaw, Microsoft terminating VeraCrypt's signing account, a ransomware attack on Dutch healthcare software, and various AWS and Kubernetes updates.

Claude Mythos stays locked up, supply chain attacks hit npm and open source maintainers