ctipilot.ch

Home · Briefs · CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026)

AI tooling SaaS and developer toolchain

From CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026) · published 2026-05-17

The Mini Shai-Hulud / TeamPCP propagation across @tanstack, @uipath, @mistralai, @opensearch-project, @guardrails-ai, and OpenAI consolidates a sector pattern first surfaced in W19: AI-evaluation, AI-observability, AI-agent-orchestration, and AI-tooling SaaS vendors all sit on architectures that aggregate organisation-level upstream credentials (LLM-provider API keys, GitHub Actions OIDC tokens, package-publish certificates) — and the operator class active this quarter is mining that aggregation pattern systematically. See § 2 for the cross-day chain and § 7 for long-running campaign status.