The Confirmed Historical Record: Summary Reference

ATG is in operation. The public record contains confirmed events whose mechanisms instantiate the conditions the framework chapters develop, and over the past five years the record has grown: more cases observed, greater sophistication, wider reach across surfaces.

Three structural conclusions hold across the record: ATG is operational, accelerating, and multi-vector. The cases that ground each conclusion reach across the deployed Client Runtime population beyond the browser and are documented in public reporting.

13.1: What the Confirmed Record Establishes Analytically

The confirmed record establishes that ATG is operational, accelerating, and multi-vector. It is therefore not a forecast, not a steady state, and not a narrowly bounded technical issue.

• Operational: ATG-class operations have been observed in production at significant scale, with measurable consequences. The architecture's exploitability is not a theoretical inference from structural conditions; it is a documented observation across multiple cases. The threshold for operational is not "an attempt occurred" but "a campaign ran and produced effect." That threshold has been crossed.
• Accelerating: frequency, sophistication, and scope of confirmed cases have grown over the past five years. The trajectory is consistent with two structural drivers: the AI Amplification Factor lowers per-target cost, and the commercialization gray zone puts attack capability within reach of buyers who could not build it. The acceleration is not a function of better detection alone; new operational patterns appear in the record that earlier cases did not exhibit.
• Multi-vector: cases distribute across the surface landscape, the provider taxonomy, and the language and platform dimensions. They reach across Client Runtime host platforms: browser, mobile, desktop, productivity-tool host, and the interactive runtimes of games and user-generated content. No single defensive measure addresses the full set; cases that compromise a CDN sit beside cases that take over a package maintainer's account, cases that target a deployed model, and cases that abuse a user-generated content channel.

The cases collectively justify the cross-runtime architectural patterns. They are what one architectural pattern looks like when adversaries operate it.

13.2: ATG-Class Event Categories and Their Structural Significance

Nine categories of ATG-class events appear in the confirmed public record. Each pairs a structural mechanism anchored in the framework with cases documented in public reporting.

• CDN Compromise: Polyfill.io (2024) is the confirmed case. The CDN acquisition attack model operates at scale, and commercial acquisition is an observed pathway to Adversarial Placement and Access (APA), not a theoretical one.
• Third-Party Script Injection: the Magecart family is the most-documented confirmed expression, with the same shape recurring: a script injected into the page copies payment-card data and sends it to the adversary. Runtime Anarchy turns into real compromise here: the injected script reads what the host renders, and never has to breach the host's backend.
• Software Supply-Chain Compromise: SolarWinds-class operations are the confirmed expression, combining corporate and human-factors acquisition pathways with operational dormancy to escape detection for months. SolarWinds is a build-pipeline/backend compromise rather than a rendering-layer ATG event; it is included here as an adjacent boundary case that demonstrates build-pipeline compromise and operational dormancy, and it reaches Client Runtimes only indirectly, through the affected vendor's management consoles and tools.
• Open-Source Maintainer Infiltration: XZ Utils (near-miss), event-stream, and ua-parser-js are confirmed expressions, with long-game contributor infiltration shown to be feasible within community trust structures. The Open-Source Open Door is operationally exploited, and where the compromised dependency is one that ships in client bundles, it reaches every Client Runtime that bundles it. XZ Utils itself is a server-side systems library (liblzma/sshd) and is cited here for the maintainer-takeover pathway, not for reach to the client rendering surface.
• AI-Amplified Deception: the Hong Kong $25 million deepfake video-conference fraud against Arup (early 2024) is the most-cited AI-deception case of the period; note that Arup confirmed none of its systems were compromised, so the case demonstrates the deepfake capability an ATG operation would weaponize rather than the ATG delivery mechanism itself. Voice-cloning fraud is a corroborating operational pattern in the same period. Tailored Deception arrives at the user through whatever Client Runtime the user happens to be using: a browser-based meeting client, a mobile messaging app, a desktop conferencing client, a vehicle infotainment voice channel.
• Plugin-Marketplace Publisher Compromise: compromised browser extensions, IDE plugins, and creative-tool extensions are recurring entries in the public record. The path from compromise to execution is the most direct: nothing is rebuilt in between, and the plugin renders its own content on the client, alongside or inside its host application (browser, IDE, creative tool, productivity tool, mobile app extension).
• OTA Bundle and Hot-Update Service Compromise: mobile over-the-air bundle delivery channels, which push code updates from a server straight into an already-installed app without going back through the app store (CodePush, Capgo, Appflow, and similar services), are a recognized route by which code reaches an installed application without passing app-store review. NIST's Mobile Threat Catalogue records the category at APP-20: an application may evade vetting by downloading and executing code after installation, and code that was absent at submission cannot be caught by review. No public compromise of any named over-the-air service is on the record, so this category is carried as Reasoned rather than Established. Because the update is silent, one compromised bundle reaches the entire installed base, and no store review sits in the way.
• Interactive-Runtime UGC Abuse: Roblox, Unity AssetBundle, and analogous UGC interactive runtimes carry the exposure, and the grading differs by platform. Roblox documents the problem itself, recording that third-party assets from its Creator Store are a common source of malicious scripts called backdoors, which is Established from the platform operator. The Unity claim is narrower than it has been stated: Unity's manual records that AssetBundles cannot contain executable code, and that altered serialized data may instead exploit the application or the runtime. Published research has demonstrated execution from a crafted asset using only default engine components, which is Reasoned from demonstration rather than Established from an in-the-wild case. The trust model for user-generated content is structurally weak against ATG-style payload injection: the host runtime is a Client Runtime in its own right, and content delivered into it reaches the rendering surface directly.
• Network-Position Injection: the Great Cannon (2015) is the confirmed example, and it is the only category here whose placement is not a supply-chain position. An actor holding the network path between the requester and the host substitutes the response instead of compromising the source. An on-path system can inject a response but cannot stop the real one, so it races; an in-path system suppresses the original request and answers in its place. The Great Cannon was in-path, which makes it a man-in-the-middle in the strict sense rather than an injector. The intercepted resources were served over unencrypted HTTP, and the researchers who documented the system named HTTPS as the remedy, so the operation as run in 2015 does not repeat unchanged against an encrypted delivery path. And the position is not exclusive to states: it is reachable by BGP hijack, by DNS hijack, by certificate-authority compromise, and by any operator of a transit link or middlebox, which is why network-path hijack already appears in the provider-landscape analysis as a provider compromise route. The other categories describe how an adversary comes to control a component. Controlling the path is sufficient without controlling any component at all. Together the nine categories reach the full deployed Client Runtime population. Each has a distinct structural mechanism in the framework.