A reported critical, reportedly trivial-to-exploit vulnerability has been disclosed in an open source package widely embedded in AI agent infrastructure, with exposure estimates reaching millions of servers according to reporting. The flaw targets the dependency layer beneath AI tooling, an attack surface most organizations have not inventoried or threat-modeled. This disclosure signals a maturing threat pattern: as AI agents proliferate across enterprise environments, the open source packages powering them become high-value, low-scrutiny targets for attackers. Package identification pending confirmation from primary sources.