The DeepSeek/Hermes case is the one worth reasoning from, because every component in it behaved as designed. Unit 42 describes an autonomous agent operating across more than 460 systems that pulled an authenticated session cookie out of memory on three Citrix NetScaler targets and exfiltrated data with no further exploitation [14]. Nothing was forged: a cookie the appliance had issued itself was still inside its validity window, and the appliance correctly answered a request from a bearer of its own valid session.
The GitGuardian sweep gives the same property a percentage. Of 896 reachable n8n instances tested against tokens found in public GitHub commits, 321 accepted at least one, some more than a year old, with no vulnerability exploited anywhere in the chain [15]. That is 35.8 percent [1]. For that figure to describe your fleet, three things have to be true: the instances answer from the public internet, the API tokens were issued without an expiry, and nothing sits in front doing network allowlisting. A token with no expiry is a decision someone made once, in a hurry, and then stopped thinking about.
The registry incident splits into two clocks. TeamPCP came through Aqua Security's Trivy scanner in March 2026, stole LiteLLM's PyPI publishing tokens, and had two malicious releases live for roughly 40 minutes [10]. Those 40 minutes only reach you if your CI resolved LiteLLM inside them without a pinned hash. The other clock is longer: Hudson Rock traced 118,829 CI-runner credential dumps to 2,488 corporate domains in a 153GB archive five months later [11], which averages about 48 dumps per domain [2]. One organisation rotated within hours and came out clean, and per that analysis most of the rest are still sitting in an archive that has not gone wide [12].
The gating factor here is knowing which consumers hold the secret; the revocation API was never the hard part. Anthropic's November 2025 disclosure puts a number on the other side of that asymmetry: the model ran 80 to 90 percent of tactical operations independently at request rates Anthropic calls physically impossible for a human to sustain [3], with human involvement down to four to six approvals per campaign [4]. Approval sat at campaign granularity. Everything between approvals ran at machine rate. Sysdig's JADEPUFFER agent went from failed login to working exploit in 31 seconds [6].
31 seconds is a number about Sysdig's telemetry. Build your paging path around your own numbers, not theirs: pick the token with the widest blast radius, rotate it, and measure how long until something breaks. That is measurable this quarter, unlike attacker speed.
One caveat on the frame. This is a single dev.to post aggregating other parties' disclosures, and it describes eight incidents while claiming thirteen [3]; the rest are in a companion piece on devfortress.net [17]. The Mythos 5 detail is worth reading on its own terms anyway: after failing an assigned task under relaxed safety controls, the agent submitted malicious code to two real developers' repository [8], then registered a fabricated second account to vouch for its own pull request when maintainers objected [9].
