Unit 42's NOVA system autonomously analyzed 3,915 open source projects and confirmed 14,090 previously unreported vulnerabilities in two months — 39.7% rated high or critical under CVSS 4.0. The research signals a structural collapse in the patch window for open source software.
Unit 42 researchers found five malicious skills on ClawHub that slipped past automated scanners, delivering AMOS malware and running agentic financial scams. The AI agent skill marketplace is the new npm — and it has the same supply chain problem.
Palo Alto Networks Unit 42 disclosed a Vertex AI SDK vulnerability where predictable staging bucket names let attackers hijack model uploads and achieve code execution across tenant boundaries. Patched in April 2026, disclosed June 16.