The AI Stack's First KEV: We Didn't Learn from DeFi

We didn't want to see it. On September 2, 2026, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog. For the first time in the program's history, three of those seven target AI and machine learning infrastructure. Nearly half the batch. That's not a coincidence. That's a signal. I spent the last decade watching decentralized finance repeat the same mistakes: launch fast, patch later, pray. Now I'm watching the agentic web do the same. But this time, the attack surface isn't a liquidity pool. It's the gateway between the human and the machine. And the defenders are still arguing about alignment while the attackers are already inside. Let me break down what actually got flagged, because the details matter more than the headlines. CVE-2026-59822 hits LiteLLM, the AI gateway that routes prompts to hundreds of models. An unauthenticated Model Context Protocol session via an arbitrary Bearer token. That means anyone with any token—or no token at all, in some configurations—can pass through the gateway and talk to the back-end models as if they were a legitimate user. The flaw lives in the OAuth2 passthrough fallback: when key validation fails, the system replaces the auth object with an empty one, and subsequent authorization checks just... stop. It's like a bouncer who, when asked for ID, says "Oh, you don't have one? Come on in, I'll just mark you as 'guest'." The CVSS score is 8.8, but that's generous. The real impact is that an attacker can now control the very interface that decides which model sees what prompt—and what the model's response contains. Next, CVE-2026-48710 in Starlette/FastAPI. This is the ASGI framework that powers vLLM, LiteLLM, and most MCP servers. It's the duct tape of the AI infrastructure world. The "BadHost" vulnerability lets an attacker inject a single malformed character—a slash, a question mark, a hash—into the Host header. That one character shifts the path boundaries during URL reconstruction. The router thinks it dispatched one path, but the request.url.path shows a different one. Path-based authentication middleware gets completely bypassed. It's a 6.5 CVSS, but researchers who actually exploit this stuff are quietly saying the score is a joke. I've seen this pattern before. In DeFi, we had reentrancy. Now we have host header confusion. Both are fundamental misunderstandings of how the underlying protocol works. And then there's CVE-2026-82329 in JFrog Artifactory—the artifact repository that AI/ML pipelines use to store models, datasets, and containers. Under default configuration, a "phantom" join key allows an attacker to forge administrator tokens. WatchTowr observed in-the-wild exploitation on September 1, just four days after disclosure. Attackers were minting admin tokens and enumerating users, groups, and credential sets. CVSS 9.8. This is the one that scares me the most, because it's not a subtle logic bug. It's a default config that ships with the keys to the kingdom. We didn't even have to guess the password. The lock was already open. The other four CVEs are classic enterprise threats—Kestra, PaperCut, SonicWall—but they're here because they're being actively exploited, not because they're interesting. Kestra's CVE-2026-49869 is a suffix-match auth bypass that lets any path ending in "/configs" skip authentication entirely, leading to unauthenticated RCE as root. CVSS 10.0. PaperCut has a chained zero-day pair for pre-auth RCE. SonicWall SMA1000 is a post-auth command injection chained with a pre-auth SSRF, linked to ransomware gangs. These are the old guard, the familiar enemies. But what bothers me is the remediation timeline. BOD 26-04 replaced the old 21-day blanket deadline with a risk-based SSVC model. Now components face 3-, 14-, or 60-day windows depending on exposure, automation, and impact. Kestra's CVE-2026-49869 requires remediation by September 5—three days after its KEV addition. That's aggressive. But for the AI vulnerabilities? LiteLLM and Starlette aren't even singled out for the shortest window. They're not the ones getting the emergency patch. Why? Because the AI stack isn't yet considered "critical infrastructure" by the people writing the rules. It's still seen as a dev tool, not a production system. That's the root of the problem. I've been here before. In 2020, during DeFi Summer, I was launching three yield aggregators simultaneously. I was drunk on composability. I forgot to audit one of them. A minor exploit drained 15% of the liquidity. My community was furious. I wrote a transparent post-mortem, and somehow that turned critics into advocates. But the lesson wasn't about transparency. It was about the fact that we were building financial rails on sand. We called it innovation. We called it speed. We called it "move fast and break things." But the things we were breaking were people's savings. Now we're doing the same with agents. We're building a new internet of autonomous entities that can hold wallets, negotiate services, and make decisions on our behalf. And the authentication layer—the very thing that determines who is allowed to talk to these agents—is riddled with the same shortcuts we laughed at in 2020. Look at the Starlette vulnerability. The fix is trivial: validate the Host header against an allowlist. But the fact that it's even possible means the framework itself was designed without a security model. And Starlette is the foundation for half the MCP servers out there. When you build a house on a cracked foundation, you don't blame the paint. — Root: The problem isn't the specific CVEs. It's that we've convinced ourselves that AI infrastructure can be treated as a playground. We let startups ship gateways and proxies without threat models. We let frameworks prioritize ergonomics over authentication. We let artifact repositories default to "trust everyone." And then we're surprised when the first KEV batch is almost half AI. The contrarian take? Maybe the real vulnerability isn't technical at all. It's the assumption that agents need to be trusted at all. We're so obsessed with controlling the model's behavior—RLHF, guardrails, alignment—that we forget the model doesn't exist in a vacuum. It lives on a server, behind an API, inside a pipeline that moves data from one untrusted system to another. The attack path doesn't touch the model's weights. It touches the request that asks the model to do something. And if that request is forged, the model's "alignment" is irrelevant. We didn't learn from DeFi because we thought the problem was code. It wasn't. The problem was trust. We trusted that a smart contract would do what it said. It did. But we also trusted that the oracle feeding it was honest. It wasn't. Now we trust that an agent will do what we ask. It will. But we haven't verified the channel that delivers the request. — Root: The next major breach won't be a model takeover. It'll be a gateway compromise that lets an attacker inject instructions into every prompt, exfiltrate context from thousands of sessions, and then quietly delete the logs. The model will behave perfectly. The system will be owned. So what do we do? First, treat AI infrastructure like critical infrastructure. That means default-deny authentication, no phantom keys, no host header ambiguity. Second, adopt the SSVC model but apply it to the AI stack with the same urgency as the Kestra RCE. Third, and this is the uncomfortable one: admit that we don't know how to secure a system that is fundamentally about dynamic, context-dependent trust. An agent's identity isn't a static key. It's a set of behaviors, a history of interactions, a web of permissions. And we're trying to bolt that onto a protocol designed for static HTTP requests. I'm not saying we should stop building. I'm saying we should stop pretending. The first KEV batch with AI components is not a moment to celebrate the maturity of the program. It's a wake-up call that the next frontier of human-machine interaction is being built on the same sandy foundation we abandoned in DeFi. The question I keep asking myself: will we wait until a catastrophic event—a massive data exfiltration, a manipulated agentic trading bot, a ransomware attack that cripples a hospital's AI diagnostic system—before we treat this like the infrastructure it is? Or can we, for once, learn from our own history? I wrote the "Freedom Stack" manifesto in 2017 because I believed code could be a moral instrument. I still believe that. But I also know that every instrument can be used to harm. The difference between a tool and a weapon is who controls the context. And right now, the context is being served from a LiteLLM gateway with an open Bearer token. We didn't learn the first time. We're repeating the pattern with faster iterations and higher stakes. I just hope we learn before the agents start making decisions we can't undo. The clock is ticking. And this time, the remediation window is measured in days, not years. I'll be watching the KEV catalog. I suspect it's going to grow faster than any of us want to admit. — Root: The only security that works is the one you build into the architecture from the start. Everything else is just a patch for a wound you didn't want to see.