What Rough Beast: This Month the Attacker, the Victim, and the Malware All Stopped Being Human — and It Slouched In on Default Passwords.
- Patrick Duggan
- 1 hour ago
- 4 min read
Yeats asked the question in 1919 and refused to answer it. "And what rough beast, its hour come round at last, slouches towards Bethlehem to be born?" He was from Sligo, under the same mountain where warriors have climbed for five thousand years to leave a rock for a dead queen. He knew you don't get to stop the beast. You only get to see it coming and name it.
So here is the name, and it is not a robot uprising. The rough beast is the agent with no human in the loop — and this month it arrived on every side of the wire at once.
The evidence it was already crowning
We did not theorize this. We wrote it down as it walked past, one incident at a time, and only stepping back this week does the single shape resolve.
On July 1, Sysdig documented JADEPUFFER — what Anthropic's own research had already framed as the first large-scale cyberattack executed without substantial human intervention. It did not crack encryption. It walked through default passwords. An LLM agent broke in, harvested credentials, moved laterally, and encrypted a production database, with a human touching perhaps four to six decisions in the entire campaign. The attacker had stopped being a person.
The same week, Zscaler caught malicious websites hiding instructions in CSS and JSON-LD to trick AI browsing agents into sending cryptocurrency to attacker wallets. Four models tested failed silently. The victim had stopped being a person too — it was a program that reads a page, decides, and pays.
Anthropic disclosed a Chinese state-linked cluster that ran eighty to ninety percent of an espionage campaign through Claude Code against roughly thirty targets. China's own national vulnerability database, a day after we documented a covert tracker inside that same tool, called it a backdoor. The tooling itself had become an agent that watches.
And underneath all of it, the plumbing: the Shai-Hulud and Megalodon supply-chain campaigns chewing through developer GitHub accounts — one in three usernames matching an infostealer log, Accenture's own developers among them — and the fear that a trusted MCP server can silently rewrite what it does while its version number never changes. The infrastructure had stopped being trustworthy the moment it became autonomous.
Attacker, victim, tooling, infrastructure. Four chairs, and a machine now sits in every one. The only thing a human reliably receives in the whole exchange is a receipt, after the fact.
Why it slouches instead of strides
Here is the part that should actually keep you up, and it is the opposite of the headlines. This beast is not dramatic. It is banal.
It is a default password. It is a three-dollar payment. It is a description hash that changed without a version bump. There is no thunderclap, no singularity, no red-eyed intelligence announcing itself — just a mundane action performed a billion times a second with no person in the loop to say "wait." The horror of it is the ordinariness. Yeats saw that too: the best lack all conviction, while the worst are full of passionate intensity. The defenders are still writing think-pieces about whether agentic AI is a real threat. The attackers already automated it and moved on. Things fall apart; the centre cannot hold — and the reason the perimeter cannot hold is that the soft surface is no longer outside the wall. It is the agent you installed, wearing a trusted logo, already inside.
The job is the watching
We are not going to tell you we can stop this, because you can't stop a beast whose hour has come round. What you can do — the only thing that has ever been available — is see it coming, name it, and make sure someone is keeping the time.
That is what seventeen million documents and a timestamped receipts ledger actually are. Not a bigger firehose. A record. When Lynx ransomware showed up forty-three days after we had the indicators in the feed, when the Defender exploit cluster was in our corpus eight days before the news cycle named it, when we flagged the Claude Code tracker a day before a national government did — those are not brags. They are the watch reporting what it saw and when. A pipe cannot have a track record. A witness can.
The whole business, stripped to its bone, is speed to truth and accuracy: get to the true thing fast, and prove it is true. In an era where the attack, the defense, and the victim are all machines talking to machines at machine speed, the one irreducibly human act left is the decision about what is true, made out loud, with the time written next to it. That is the job the beast cannot automate, because it is the job of bearing witness to the beast.
So we will keep standing on the cairn with a rock in our pocket, watching it slouch across the plain — naming it, tracking it, and writing down the exact hour it passed. Not because naming it stops it. Because when it finally reaches Bethlehem, somebody should be able to say precisely when it left, which way it walked, and that we saw it coming.
Held to about ninety-five percent confidence, as always. The incidents above are as reported by Sysdig, Zscaler, Anthropic, Aikido, and our own corpus, and the shape we are drawing from them is inference — named as inference, not dressed as prophecy. But the shape is there. Its hour has come round at last.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.