Every major AI assistant endorsed a webpage as safe while it displayed a reverse shell command to the human reader. No bug. No jailbreak. A custom font and standard CSS were enough. The flaw is an architectural blind spot — a rendering-layer trust boundary no AI safety framework has ever specified — and it changes the threat model for every product team building AI-assisted content evaluation.
Cisco’s SD-WAN peering authentication existed in the architecture, appeared in threat models, and passed functional tests — for three years. It never enforced. CVE-2026-20127 reveals a design failure recurring across vendors: authentication gates running after request classification, creating request classes that bypass identity verification. Does any request path reach your processing logic before authentication runs?
For over a decade, Google classified API keys as public billing identifiers — safe for client-side code. When the Gemini API joined the platform, those same keys silently gained access to uploaded files, cached AI context, and billable inference. The architectural pattern behind this silent privilege escalation is not unique to Google, and the assumption it breaks is likely in your threat model too.
