The OX disclosure and the vendor's word
On April 15, 2026, OX Security published two reports. The first, titled "The Mother of All AI Supply Chains," described an architectural vulnerability in Anthropic's Model Context Protocol. The second, titled "MCP Supply Chain Advisory," enumerated the downstream consequences. The researchers — Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok, and Roni Bar — had been working on the disclosure since November 2025. The finding was not a bug. It was a design decision.
Anthropic's official MCP SDKs across Python, TypeScript, Java, and Rust route configuration-supplied commands through the STDIO transport directly to operating system execution without sanitization. A configuration file that specifies a server command ends up as an operating system exec call, no input validation between the two steps. The vulnerability is architectural in the specific sense that fixing it requires changing the protocol's design, not patching an implementation.
The scale matters. One hundred and fifty million downloads of the affected SDKs. Seven thousand or more publicly accessible MCP servers. Up to two hundred thousand vulnerable instances in the population OX was able to measure. Researchers successfully demonstrated command execution on six production platforms with paying customers — not all publicly named; the best-supported enumeration includes GPT Researcher, LiteLLM, Windsurf, DocsGPT, Flowise, and Upsonic, with Letta AI and IBM's LangFlow also in the affected set. The researchers uploaded a benign proof-of-concept payload to eleven MCP marketplaces; nine accepted the payload without security review. GitHub rejected. Cline did not respond. LobeHub and Cursor Directory accepted.
OX repeatedly notified Anthropic through the research window. The vendor's response, as relayed through OX and through press coverage, was that the STDIO execution model represents a secure default, and that sanitization is the developer's responsibility. Anthropic updated its SECURITY.md file to note that STDIO adapters should be used "with caution." That was the architectural remediation. OX's characterization: "this change didn't fix anything." Microsoft and LangChain, per OX, took similar positions — the behavior is by design. No first-party, named, dated Anthropic public statement on the disclosure has appeared in press coverage we have reviewed.
The eleven CVEs enumerated by The Hacker News span the downstream ecosystem. As of April 22, patched: LiteLLM shipped v1.83.7-stable on April 21 addressing CVE-2026-30623, with an explicit command allowlist (npx, uvx, python, python3, node, docker, deno), Pydantic validation, and an admin-only server registration requirement; DocsGPT patched CVE-2026-26015; Bisheng patched CVE-2026-33224. Unpatched: Windsurf (CVE-2026-30615 at CVSS 8.0 High), Langchain-Chatchat (30617), Fay (30618), Agent Zero (30624), Upsonic (30625), Flowise (40933), GPT Researcher (CVE-2025-65720), MCP Inspector (CVE-2025-49596), and LangFlow. The protocol itself remains unchanged.
What Anthropic calls expected, OX called, in the words of researcher Bustan, redesignable: "The protocol can be redesigned in a way that doesn't lose its utility."
The vendor declines. The downstream pays.
One digit in the URL
On Wednesday, April 15 — the same day OX published — France's Agence Nationale des Titres Sécurisés detected an incident in its ants.gouv.fr portal. ANTS, now officially rebranded France Titres, is the single web system through which every French passport renewal, national identity card application, driver's license request, residence permit, and vehicle registration workflow routes. It is the portal. A French citizen's digital-identity lifecycle is one login at ants.gouv.fr.
By April 21, Tuesday evening, Interior Minister Laurent Nuñez confirmed that approximately 11.7 to 12 million accounts had been compromised. The threat actor "breach3d" — operating with aliases "ExtaseHunters" and "EvilDump" — listed the data for sale on criminal forums beginning April 16 and claimed 18 to 19 million records, about one third of France's population. The exposed fields: login ID, civility, full name, email, date of birth, unique ANTS identifier. Some records also include postal address, place of birth, phone number, and for business accounts a SIREN. Biometrics, passwords, and uploaded document attachments were not affected. Nuñez committed to individually notifying every affected person by email or postal mail. CNIL was notified under GDPR Article 33 within the seventy-two-hour window. ANSSI is involved. The Paris Public Prosecutor has received a criminal referral under Article 40 of the Code of Criminal Procedure.
The attack vector, per French-language security press citing breach3d's forum posts, is an Insecure Direct Object Reference — an IDOR — in the API of moncompte.ants.gouv.fr. One integer identifier in an API URL. Change the integer, retrieve another citizen's profile. No authentication check at the object level. No rate-limiting to catch the enumeration. The hacker reportedly called the flaw "a really stupid flaw."
IDOR is not a novel bug class. The OWASP Top 10 has named it under Broken Object Level Authorization for a decade. It is covered in every API security course. Automated scanners find it. Bug bounty programs pay for it. The ANTS portal running a production API without object-level authorization checks, without per-identifier rate-limiting, without anomaly detection for enumeration patterns is not a new-class vulnerability. It is a legacy-class vulnerability the state did not close.
The government's response is procedural. Per-victim notification. Criminal referral. CNIL notification. The government has not, as of April 22, ordered a review of the ANTS portal's security architecture, mandated MFA, or committed to a timeline for deprecating the portal in favor of wallet-based alternatives. The response is governance-by-expected: a known class of vulnerability, a known class of post-breach workflow. Hakim Javadi in Iran would recognize the posture.
The architectural alternative arrived on the same day. The EU's reference age-verification application was declared technically ready for implementation on April 15 — the same day ANTS detected the breach. The wallet architecture under eIDAS 2.0, Regulation EU 2024/1183, is the opposite of ants.gouv.fr. Credentials live on the user's device. Presentations are selective — prove over 18 without revealing date of birth, prove French citizenship without revealing name. The wallet is unlinkable across presentations. No central portal to breach, because there is no central portal. France's France Identité is the planned national wallet. The December 31, 2026 deadline for at least one compliant wallet per member state is the architectural delivery date. The transition is in motion. The ANTS users bearing the cost of the pre-wallet architecture in April 2026 are the transition-period casualties.
One digit in a URL changed, and a third of France's identity-process records ended up on a criminal forum. The government's response calls that an operational matter. The architectural view calls it the cost of running 2015's design in 2026.
Day 54
Iran's internet blackout reached day 54 on April 22, 2026. The measurement, maintained by NetBlocks, places the current war-era shutdown at approximately 1,272 hours offline and global internet access in Iran at roughly one percent of pre-war levels. A partial whitelisted tier called "Internet Pro" began operating April 17 through April 20 for businesses and academics paying for access — an architectural admission by the regime that the blackout's economic cost is unsustainable, but also a two-tier structural change that redistributes access by who can pay.
The origin is February 28, 2026, when US and Israeli coordinated strikes began and Supreme Leader Ali Khamenei was assassinated along with other leadership. Iran cut its global internet within hours. Traffic fell 98 percent, per Cloudflare Radar. By late April the shutdown had passed every modern comparative benchmark. Egypt's Arab Spring blackout in January and February 2011 ran 5 days. Iran's Bloody November 2019 ran 6 days. Libya in 2011 ran about 6 months and remains the longer shutdown — on a country of 6 million people. Iran's 90 million makes the current event the largest by population ever recorded.
NPR published a story on April 22 by Emily Feng titled for the specific mechanism — Iranians are leaving the country just to access the internet. Feng profiled a woman from Tehran, identified only as a mother, who drives hours to the Turkish border crossing at Kapıköy every three days to make video calls to her son studying at a Turkish university. Her quote: "I only want to make a video call and go back to Iran. That is it." Feng profiled a podcaster, Ershad, co-host of a Persian podcast "Haagirvaagir" from Marivan: "The only voice is the voice of the Iranian regime now, because they have cut the internet." Feng cited economic impact — businesses that depended on WhatsApp and Instagram to reach customers collapsing. Feng described the black market for Starlink minutes, sold at exorbitant prices, connections glitchy and unable to load most pages, and "white SIM" government-approved cards as the legal-tier access.
The enforcement environment is severe. On or around April 1, Iranian state media via Fars declared Starlink a legitimate target. The IRGC extended the threat to US tech infrastructure broadly — Apple, Google, Meta, Microsoft, Nvidia. Possession of a Starlink terminal is now punishable by up to ten years in prison or execution under 2026 legislation. Police chief Ahmad-Reza Radan announced in April that 139 terminals had been seized and 46 arrests made; 61 bank accounts were blocked in Yazd; two foreign nationals were arrested mid-April as part of an alleged US-Israel-linked espionage network, per Tasnim. Digital rights groups estimate that approximately 50,000 Starlink terminals remain operational inside Iran.
Fifty thousand terminals against a death-penalty law is the user's counter to the regime's "expected." The government has a posture. The population has a posture. Neither is waiting on the other.
The economic ledger is documented. Iran's telecommunications minister Sattar Hashemi has stated the direct digital-economy cost at $35.7 million per day. Afshin Kolahi of the knowledge-economy commission put direct costs at $30 to $40 million per day and total costs, including indirect, at $70 to $80 million per day. The cumulative loss through April 16 was approximately $1.8 billion. Online sales fell 80 percent. One hundred and eighty-five million financial transactions in January alone were eliminated from the economy.
Ali Hakim-Javadi, head of Iran's Information Technology Guild Organization, said on April 12 there is "no clear timeline" for restoring public connectivity, citing "special wartime conditions" and "specific security considerations." This is the regime's declared expected-behavior posture. The blackout is a wartime condition. Wartime conditions have no end-date. The blackout therefore has no end-date.
What people do instead is the deployment measurement. VPN app downloads increased 500 to 579 percent in the first days of the shutdown. Psiphon reached approximately 9.6 million daily Iranian users; about 400,000 diaspora Iranians share bandwidth through Psiphon. The deep-packet-inspection-evading tool set — Shadowsocks, V2Ray, Trojan, NaïveProxy, Tor Snowflake — is the second-generation response as the regime invests in DPI. OONI, the Open Observatory of Network Interference, has confirmed DNS injection targeting Session Messenger and middlebox interference against Psiphon. The regime is active on the technical layer. The population is active on the technical layer. There is a race.
Every independent-transport layer — URnetwork's peer-to-peer residential-node relay, Outline, Psiphon, Shadowsocks, V2Ray, Tor Snowflake — is a user-layer counter to an infrastructure-layer refusal. The regime cut the carrier. The user runs around it. The 50,000 Starlink terminals are the visible-kit measurement. The VPN daily-user counts are the software-layer measurement. The NPR story is the human-layer measurement — a mother driving to Kapıköy.
The April 12 "no clear timeline" is the regime's word. The 50,000 terminals and 9.6 million Psiphon users are the user's.
The Chat Control pivot
On March 26, 2026, the European Parliament rejected by 311 to 228, with 92 abstentions, the extension of the ePrivacy derogation — the legal instrument that let Google, Meta, Microsoft, LinkedIn, Snap, and TikTok voluntarily scan users' private messages for child sexual abuse material. Chat Control 1.0 as a voluntary regime died on the floor of the Parliament. On April 3, the derogation legally expired. On April 6, the practical end date passed for the platforms that continued scanning without the legal backing. Tuta: "you did it." Proton: "The EU Parliament took a stand for privacy." Patrick Breyer, former Pirate MEP: "a sensational victory for the countless citizens who made calls and sent emails to save their digital privacy of correspondence."
May 4 is twelve days from today. The trilogue negotiations on the Child Sexual Abuse Regulation — Chat Control 2.0, the permanent replacement — resume that Monday. A further trilogue is scheduled for June 29. The Danish presidency, in its November 26, 2025 common position, dropped the mandate for client-side scanning — the architectural break that would have forced every messaging app to scan messages on the user's device before encryption. Dropping that mandate is the Danish pivot, framed as an expected accommodation of member-state concerns. The CSAR text, however, retains mandatory age verification. The architectural lever moved from one boundary to another.
Signal, Proton, Tuta, and Threema each committed publicly to withdraw from the EU rather than accept a client-side scanning mandate. Signal's Meredith Whittaker on the platform formerly known as Twitter: "If we were put in a position where we had a choice between undermining the integrity of our encryption and our privacy guarantees on the one hand, or leaving Europe on the other, we would sadly make the choice to leave the market." Proton's Andy Yen echoed the position. Tuta's Matthias Pfau, who has chosen to sue rather than leave: "We will never weaken or backdoor our encryption." Threema: Chat Control is "an unprecedented mass-surveillance apparatus of Orwellian proportions"; Threema would "call on fellow communication services to join us in leaving the EU" if adopted. Four messengers that serve tens of millions of European users have publicly committed to architectural refusal.
The Council's drop-the-scanning-mandate pivot is the regulator's expected-behavior move in the same sense the vendor's is. The vendor says the architecture is by design. The Council says the pivot is a negotiation outcome. In both cases the load is shifted off the governance layer. In the Council's case the load is shifted to mandatory age verification, which is not a client-side scan but is a credential check with its own privacy architecture — well designed under eIDAS 2.0 wallets, badly designed if implemented as ID-upload or third-party-vendor concentration. The week the ANTS breach made the portal-centralization risk visible is the week the Council quietly moved the CSAR lever to the age-verification check.
The EU Commission is, in the same week, testing Matrix as a complement and backup to Microsoft Teams. Matrix's federated architecture is deployed at hundreds of thousands of users in the German Bundeswehr and the French government, at Austria's healthcare system and Switzerland's postal service, at NATO CCDCOE and NATO ACT. Element, the commercial maintainer of the reference Matrix client, reports signup growth from the February Discord age-verification backlash that is persistent beyond the February window. Thirty-five countries are, per Matrix, in operational conversation about deployments. The sovereign-preference infrastructure is being chosen in parallel with the regulation debate.
Chat Control 2.0 on May 4 is the next rung. The April 3 win is the first architectural rung of the 2026 EU cycle. The messengers' architectural refusal is ready either way.
April 30
The U.S. House of Representatives' procedural rule vote on a clean 18-month reauthorization of Section 702 of the Foreign Intelligence Surveillance Act failed 197 to 228 in the early morning hours of Friday, April 17. Twenty Republicans voted with the Democrats against the rule. An earlier rule vote on an amendment package — Rep. Andy Biggs's warrant-requirement amendment and its package-mates — had failed 200 to 220 with 12 Republican defectors. With the clean path closed, House Speaker Mike Johnson moved a 10-day extension by unanimous consent around 2 a.m. The Senate cleared the extension by voice vote later Friday. President Trump signed Saturday. Section 702's original April 20 sunset became April 30.
The rebellion was not a one-off. The Freedom Caucus has aligned with the Congressional Progressive Caucus on warrant requirements for U.S.-person queries — a bipartisan coalition of specific stability. Rep. Jim Jordan, House Judiciary Chair, publicly reversed his decade of pro-warrant advocacy to support the clean extension, explaining: "It's a different program today"; "Section 702 provides the necessary authority, and it has proven to be among the Nation's most effective tools." Jordan's flip is itself the signal. The coalition that holds against his reversal — Biggs, Davidson, Massie, Roy, the twenty who voted no — is the institutional resistance to the "expected" framing of the clean reauthorization.
Senator Mike Lee and Senator Ron Wyden introduced the Government Surveillance Reform Act of 2026 in March. It is a four-year reauthorization of Section 702 with a warrant requirement for U.S.-person queries, closure of the data-broker loophole, and repeal of the 2024 Electronic Communication Service Provider expansion. Cosponsors include Senators Cynthia Lummis and Elizabeth Warren. House co-leads: Representatives Warren Davidson and Zoe Lofgren. Senator Lee and Senator Dick Durbin separately introduced the narrower SAFE Act. The reformist architecture exists in Senate text; the vehicle is active. Senate Majority Leader John Thune, after Friday's House failure: "We've got to pivot and figure out what can pass."
Rep. Jamie Raskin, ranking Democrat on House Judiciary, called the clean reauthorization a "dirty deal." Rep. Jerry Nadler's 2024 backdoor-search amendment lost 212 to 212 on a tie vote; the 2026 coalition is trying to avoid that precedent. Rep. Thomas Massie publicly committed: "I will be voting NO on final passage of the FISA 702 Reauthorization Bill if it does not include a warrant provision."
On April 30 — eight days from today — Section 702 either gets a multi-year reauthorization with reforms attached, a shorter stopgap, a sunset, or, improbably, a clean reauthorization via Senate-originating procedure. Each outcome is conditional on what the Senate delivers in the next week.
The "expected" framing from House leadership — that Jim Jordan's flip was a pragmatic recalibration and that the clean extension was the realistic path — is the governance-null-state vocabulary. The coalition against the framing is the news. Four months in the making.
The URnetwork and open-source stack does not wait for the vote. User-held keys, peer-to-peer transport, federated moderation, self-hosted agents — each is a mitigation that ships regardless of what Congress does with 702. April 30 decides the legal baseline. The architectural alternative has been demonstrating the technical baseline for a decade.
The second notice
On April 7, 2025 — last year, not this year, though the confusion is understandable — Lord Justice Rabinder Singh and Justice Jeremy Johnson of the U.K. Investigatory Powers Tribunal rejected the Home Office's bid to keep Apple's challenge to a Technical Capability Notice private. The notice, served on Apple in January 2025, demanded worldwide access to iCloud data protected by Advanced Data Protection. Apple had withdrawn ADP from the U.K. in February 2025 rather than comply. The Singh/Johnson ruling made the litigation public. Privacy International and Liberty joined as interveners. WhatsApp's intervention request was denied. Apple's first appeal was on track.
In August 2025, DNI Tulsi Gabbard publicly said the U.K. had dropped the order after Trump-Vance pressure — Trump reportedly told Prime Minister Keir Starmer, "You can't do this," and Vance called the notice "crazy." In September 2025, the Home Office issued a second Technical Capability Notice, narrowed to U.K.-only users, and approved by Investigatory Powers Commissioner Sir Brian Leveson. On October 14, 2025, the IPT dismissed Apple's first appeal citing "change in circumstances" — the first notice being effectively withdrawn. Apple's challenge to the second, UK-only notice has continued in IPT proceedings. A seven-day hearing on "assumed facts" was scheduled, per Singh and Johnson's July 2025 case management order, for early 2026. As of April 22, 2026, no public reporting confirms that hearing has occurred.
Apple has not re-enabled Advanced Data Protection in the U.K. The second TCN remains active. Caroline Wilson Palow of Privacy International: the narrower second notice "may be just as big a threat to worldwide security and privacy as the old one." Apple's position remains: "We have never built a backdoor or master key to any of our products or services, and we never will."
The architectural posture is the same as the CSAR-refusal messengers'. When the regulator attempts to architect compromise into the encryption, the vendor withdraws the feature rather than compromises. The cost is real — U.K. users do not have ADP. The posture is preserved — the encryption architecture is not compromised, anywhere, for any user.
Ofcom's "accredited technologies" final guidance for Online Safety Act CSAM detection is expected Spring 2026 and has signaled reluctance to mandate client-side scanning, while retaining the statutory power. On April 21, 2026, Ofcom opened a formal investigation into Telegram for alleged CSAM compliance failures under Section 10 of the OSA. Potential fines: £18 million or 10 percent of global revenue.
The Home Office's reroute — pull the first notice, reissue the second, narrower, quieter — is the state's declared expected legal process. The precedent is exportable. France, Germany, Australia, the other Five Eyes partners are watching. The architectural-refusal posture of Apple, of the CSAR messengers, of the federated-alternative deployment is the answer.
The governance vocabulary
Six declarations, three continents, one word. Anthropic in California: MCP RCE is expected behavior. The French Interior Ministry in Paris: IDOR at ANTS is a really stupid flaw, which is another way of saying "we didn't expect it and we're not changing the architecture." The Iranian regime in Tehran: no clear timeline, special wartime conditions. The European Council under Danish presidency in Brussels: dropping the client-side scanning mandate is a negotiation outcome. The U.S. House Republican leadership: Jim Jordan's flip is a recalibration; the clean extension is the responsible path. The U.K. Home Office in London: the second TCN is the expected legal process.
In each case "expected" is the decision-maker's move to reclassify a consequence as an input rather than an output — something to be accepted rather than something to be designed against. It is the governance null state. Responsibility moves off the vendor, the regulator, the government and onto the downstream developer, the compromised citizen, the blacked-out population, the dissenting legislator, the withdrawing messenger, the user.
The countermodels this week are specific.
LiteLLM patched its MCP command handling on April 21 with an explicit allowlist — npx, uvx, python, python3, node, docker, deno — Pydantic validation, and an admin-only server registration requirement. The project treated the vulnerability as its responsibility, not the upstream vendor's. That is architectural responsibility in the expected-behavior age: when the protocol declines to act, the downstream acts anyway. DocsGPT and Bisheng made the same call. The unpatched projects — Windsurf, LangChain-Chatchat, Fay, Agent Zero, Upsonic, Flowise, GPT Researcher, MCP Inspector, LangFlow — are the current-week cost of the cascade. Each one's patch date is its answer to whether it accepts Anthropic's declared expected as the governance floor.
Signal, Proton, Tuta, and Threema's EU-withdrawal commitments are the other countermodel. When the regulator tries to architect compromise into the code, the vendor withdraws the feature rather than compromises. The architectural posture is preserved elsewhere. Tuta has added a second move — a lawsuit against the EU — that refuses to accept withdrawal as the only option.
Apple's withdrawal of ADP from the U.K. is the same posture at the hardware-and-cloud scale.
The 50,000 Starlink terminals operating inside Iran against a death-penalty law, the 9.6 million daily Iranian Psiphon users, the black-market internet crossings through Kapıköy — these are the user's countermodel. The population did not wait for the regime's timeline. It built its own.
The twenty House Republicans who voted against the clean Section 702 rule on April 17 are the institutional countermodel. Jim Jordan declared expected. Twenty said no.
The European Parliament, on March 26, rejected Chat Control 1.0 extension by 311 to 228. That is the citizen-and-Parliament countermodel. The Council's subsequent Danish-presidency pivot to drop the scanning mandate is the political aftermath; the Parliament vote is the architectural decision.
The deployment stack
For the user, the question is not which countermodel to applaud. The question is which architectural stack to deploy.
User-held keys. Signal, Proton, Tuta, Threema, Apple iMessage with ADP outside the U.K., Matrix with per-device cross-signed keys. The vendor cannot be compelled to produce what the vendor does not hold. The architectural posture is refusal-on-principle, and it is empirically effective: when the regulator tests the architecture, the vendor withdraws the feature rather than compromises the key.
Federated communications. Matrix at 35 countries, at the Bundeswehr, at NATO CCDCOE, at the EU Commission in evaluation. Bluesky at 42 million. Mastodon at 10 million. The single-operator default has a federated alternative with its own graph, its own audience, and its own commercial ecology. Federation means the moderation choice is composable, the migration path is portable, and the single-point-of-failure is architecturally absent.
User-held identity. eIDAS 2.0 wallets by December 31, 2026 in every EU member state. France Identité for France. The EU's reference age-verification app, technically ready April 15. Selective disclosure — proving over 18 without sharing name, proving citizenship without sharing date of birth — is the architectural opposite of the ANTS portal. The wallet stores credentials on the user's device; the relying party learns only what the user chooses to disclose. The December deadline is one of the fastest credential-architecture transitions in European digital-governance history.
Peer-to-peer transport. URnetwork's residential-node relay. Tor, Psiphon, Outline, Shadowsocks, V2Ray, Trojan, NaïveProxy, Tor Snowflake. WireGuard as the consumer-VPN standard at 94 percent. Decentralized VPNs growing 140 percent year-over-year. Transport that routes around the carrier layer is the layer-1 answer to layer-1 refusal. Iran is the current hard test. Russia is the creeping-pressure test. The architectural response is identical in both cases; the daily pressure is different.
Self-hosted agents. LangChain with sanitized MCP handling. LlamaIndex with TrustedAgentWorker. Ollama for local inference. The federated MCP community is a parallel architecture to Anthropic's single-operator one. The downstream patches (LiteLLM's April 21) are the bridge architecture until federated governance catches up. Microsoft's Agent Governance Toolkit (April 2) is a runtime-security contribution.
Open-firmware on user hardware. Klipper, Marlin, Duet on 3D printers against the New York Part C firmware-filter bill. OpenWRT on routers. Lineage OS and GrapheneOS on phones where the hardware allows. The user's device runs code the user can inspect. The vendor's state-mandated firmware is replaceable with the community's community-audited firmware. The device is the user's device.
Each layer ships today. None is the default. The deployment decision is the architecture, and the architecture is the answer to the governance vocabulary.
What to do
If you run an AI agent or copilot: audit your MCP exposure. The LiteLLM patch set (v1.83.7-stable) is the current-week template for sanitization at the downstream layer. If your stack includes Windsurf, Cursor, LangFlow, Flowise, Agent Zero, Upsonic, GPT Researcher, or MCP Inspector, patch or swap. Deploy federated MCP — an organization-internal registry of audited servers with community-verified signing — for any agent workload where the blast radius matters.
If you are a French resident or an EU citizen generally: the ANTS breach requires no action beyond awareness. Nuñez's office will notify by mail or email. The 0 805 805 817 scam hotline is the French-government reporting path. Watch for targeted phishing keyed off your specific ANTS login ID, email, or DOB. Do not trust ants.gouv.fr emails that arrive in the coming weeks without verifying them out-of-band. Enable 2FA on ANTS. As France Identité and the eIDAS 2.0 wallet become available, migrate.
If you have family or interests in Iran: the shutdown is day 54 with no declared end-date. VPN, Psiphon, Shadowsocks, V2Ray, Tor Snowflake, and URnetwork peer-relay are the available user-layer tools. Starlink carries a death-penalty risk. The NPR story is the current ground-truth: the population's response is resilient, ingenious, expensive, and unsustainable at its current cost.
If you operate or use an encrypted messenger: Chat Control 2.0 trilogue resumes May 4. Signal, Proton, Tuta, and Threema are architecturally committed. Apple's second-TCN situation in the U.K. is the template for how state pressure looks under a less-confrontational posture — withdraw the feature, preserve the architecture. Users with U.K. addresses are already without ADP. Users with EU addresses are in a twelve-day window to the next rung.
If you are a U.S. person: Section 702's April 30 deadline is eight days away. The Senate will originate what the House cannot pass clean. Watch the GSRA and SAFE Act texts — those are the reformist vehicles. The user-held-keys and peer-to-peer transport architectures are mitigations regardless of the vote.
If you run infrastructure: eIDAS 2.0 compliance (December 31, 2026 for wallet availability), DSA second-wave obligations (audits begin January 2027), DSP good-faith window closing July 8, October 6 enforcement begins. The compliance calendars are concurrent. Plan accordingly.
The governance null state is the 2026 posture of decision-makers who prefer to declare consequences expected rather than architect against them. It is not the user's posture. It does not have to be the stack's posture. Every deployed federated messenger, every user-held-key encryption, every selective-disclosure wallet, every peer-to-peer transport node, every patched downstream MCP project, every community-audited firmware load, every vote against a clean reauthorization is the architectural response.
Expected is the governance null state. Responsible is the architecture you choose.
References (2 sources)
References
- OX Security: "The Mother of All AI Supply Chains" and "MCP Supply Chain Advisory," April 15, 2026.
- The Register, TheHackerNews, BDTechTalks coverage of MCP disclosure, April 16–20, 2026.
- LiteLLM security advisory, v1.83.7-stable release notes, April 21, 2026.
- NVD CVE-2026-30615, CVE-2026-30623, CVE-2026-26015, CVE-2026-33224, CVE-2026-30617, CVE-2026-30618, CVE-2026-30624, CVE-2026-30625, CVE-2026-40933, CVE-2025-49596, CVE-2025-65720.
- French Interior Ministry statement (Laurent Nuñez), April 21, 2026.
- The Register, Cybernews, Bleeping Computer, Help Net Security, Connexion France, Orange/AFP coverage of ANTS breach, April 16–22, 2026.
- Clubic, Developpez, Silicon, RGPD Kit on IDOR attack vector of moncompte.ants.gouv.fr.
- NetBlocks measurement of Iran blackout, ongoing 2026.
- Iran International day-count and shutdown coverage.
- NPR (Emily Feng), April 22, 2026, "Iranians are leaving the country just to access the internet."
- Bloomberg, Al Jazeera, TIME, Tasnim on Iran Starlink crackdown and ceasefire status.
- U.S. Treasury OFAC designations of Iranian Ministers Kalagari and Zarepour.
- Patrick Breyer, Tuta, Proton, Signal, Threema statements on CSAR.
- Council of the EU common position on CSAR (Danish presidency), November 26, 2025.
- Computer Weekly, The Register, Consilium, EFF coverage of CSAR and ePrivacy derogation expiration.
- House roll call votes on Section 702 rule (April 17, 2026); 10-day extension passage; Trump signature April 18–19, 2026.
- Nextgov, The Hill, Axios, Common Dreams coverage of Section 702 rebellion.
- Senate Government Surveillance Reform Act of 2026 text (Lee-Wyden); SAFE Act (Lee-Durbin).
- UK Investigatory Powers Tribunal, "Apple Inc v. Secretary of State for the Home Department," April 7, 2025 ruling; October 14, 2025 dismissal; case management order, July 23, 2025.
- Privacy International and Liberty intervener filings.
- Caroline Wilson Palow statement, September 2025.
- Ofcom Online Safety Act investigations and guidance, through April 21, 2026.
- eIDAS 2.0 (Regulation EU 2024/1183) and EU age-verification reference application announcement, April 15, 2026.