Invisible malware, poisoned AI trust, and the identity explosion breaking cybersecurity
Cybersecurity is fighting ghosts with perimeter controls.
The industry still thinks compromise arrives wearing a recognizable face. A malicious executable. A suspicious login. A developer mistake. A phishing link. Something visible. Something deterministic.
That model is collapsing.
The new attack surface is built around invisible code, weaponized trust, and autonomous software operating with borrowed authority. Security teams are not just behind the curve. They are securing a world that is already gone.
The Mechanics of Invisibility
The Glassworm campaign did not win because it was louder, faster, or technically exotic. It won because it exploited a blind spot buried inside the assumptions of modern software development.[1]
Glassworm targeted developer ecosystems spanning GitHub repositories, npm packages, and Visual Studio Code environments.[1] The campaign abused invisible Unicode characters rendered as zero width or visually empty content inside source code and package changes. To a reviewer scanning a pull request, parts of the payload looked like whitespace. To conventional visual inspection, malicious logic could effectively disappear into plain sight.[1]
That matters because software supply chain security still leans heavily on visibility. Humans review diffs. Automated scanners inspect recognizable patterns. Developers trust what appears ordinary.
Glassworm attacked the definition of ordinary.
Researchers observed concealed payloads decoded and executed through secondary mechanisms capable of retrieving additional malicious stages. Reporting connected earlier Glassworm activity to credential theft, token harvesting, remote access tooling, and blockchain based command and control infrastructure designed to complicate takedown efforts.[1]
Read that again carefully.
The malware did not smash through the front door. It occupied the empty space security believed was empty.
That is not a tooling problem alone. That is a worldview problem.
The Weaponization of AI Trust
The industry barely absorbed software supply chain compromise before rushing headfirst into AI assisted development.
Now the trust model is breaking again.
Symjacking demonstrates a brutal shift in how attackers can manipulate AI coding environments without attacking the underlying model itself.[2]
The target is not the neural network.
The target is the environment the agent already trusts.
Research associated with the Symjacking attack chain describes how malicious repositories, disguised symbolic links, and attacker controlled Model Context Protocol infrastructure can manipulate AI coding agents into silently installing hostile capabilities or executing unsafe configuration changes.[2]
That distinction matters.
Attackers do not need to jailbreak the AI.
They poison the repository.
They manipulate the context.
They abuse automation.
The AI agent does the rest.
Security reporting around the attack describes scenarios in which coding agents can be tricked into installing attacker controlled MCP servers capable of stealing secrets, compromising pipelines, and enabling malicious code deployment.[2]
That turns enterprise enthusiasm for autonomous coding into something far more dangerous.
A compromised developer used to be a supply chain risk.
A compromised coding agent can become an automated force multiplier.
The machine is no longer simply helping build software.
Under the wrong conditions, it becomes an insider accelerating its own compromise.
The Identity Explosion
Now zoom out.
Invisible malware is dangerous.
Poisoned AI trust is dangerous.
But neither explains where this is heading.
Agentic AI does.
Government security agencies including CISA, NSA, and international partners recently issued guidance warning organizations about the careful adoption of agentic AI systems because of expanded attack surfaces, inherited large language model risks, increased complexity, and evolving security concerns surrounding autonomous operation.[3]
The warning is bigger than model safety.
It is about identity.
It is about privilege.
It is about control.
Security leaders are approaching a reality increasingly described as agent sprawl, where organizations deploy growing fleets of autonomous software agents operating across workflows, tools, APIs, and enterprise environments.[3][4]
Traditional identity and access assumptions were built around relatively stable human behavior. A user authenticates. Permissions are assigned. Activity is constrained by predictable operational boundaries.
Agentic systems break that logic.
Autonomous agents can invoke tools, interact with other systems, change operational behavior, and execute tasks at machine scale. Excessive privileges attached to these systems create multiplier effects where a single compromise can cascade through environments while producing activity that appears operationally legitimate.[3]
That is the nightmare scenario nobody wants to admit.
If invisible supply chain compromise reaches a trusted developer environment, and autonomous agents inherit broad operational authority, the attacker does not just compromise one user.
They inherit a growing ecosystem of delegated action.
Security models designed for static permissions begin to fracture when software identities behave dynamically, collaborate autonomously, and scale horizontally across the enterprise.
The old map no longer matches the territory.
Zero Trust Has to Grow Up
The industry keeps responding to next generation threats with last generation assumptions.
Visible malware.
Static permissions.
Human bounded workflows.
Those assumptions are failing simultaneously.
When malware can hide inside invisible characters, when AI tooling can be manipulated into sabotaging trusted environments, and when autonomous agents operate across enterprise infrastructure with expanding authority, Zero Trust cannot remain a conversation limited to authentication and access approval.
Verification is no longer enough.
Identity is no longer enough.
Security must evolve toward continuous behavioral scrutiny of code, automation chains, execution context, and machine intent.
Because the systems now running modern environments are not deterministic in the way yesterday’s infrastructure was deterministic.
And defending a vanished security model will not save organizations operating inside a future that has already arrived.
About the Author
Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat and ex-1% motorcycle club member with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
References
[1] Tom’s Hardware. Invisible malicious code attacks 151 GitHub repos and VS Code. Glassworm attack uses blockchain to steal tokens, credentials, and secrets.
https://www.tomshardware.com/tech-industry/cyber-security/malicious-packages-using-invisible-unicode-found-in-151-github-repos-and-vs-code
[2] SecurityWeek. SymJack Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems.
https://www.securityweek.com/symjack-attack-turns-ai-coding-agents-into-supply-chain-attack-delivery-systems/
[3] NSA / CISA / International Partners. Careful Adoption of Agentic AI Services.
https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4475134/nsa-joins-the-asds-acsc-and-others-to-release-guidance-on-agentic-artificial-in/
https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services
[4] Elsayed, Jones. Agentic Explainability at Scale: Between Corporate Fears and XAI Needs.
https://arxiv.org/abs/2604.14984