Executive Summary

Attack the Glass (ATG) is a supply-chain injection vulnerability that targets client-side rendering, the step in which a platform assembles what the user sees on the user's own device. It is unmitigated and underappreciated, and attacks that exploit it reach modern technology platforms in every nation, across every industry, and across every type of network, from the open internet to classified systems. These attacks can be used for both large-scale campaigns and precise targeting. They can be deployed from millions of positions across the global digital supply chain with a traffic pattern indistinguishable from legitimate operation, and they leave no forensic evidence in the backend systems, network logs, and audit trails that existing security frameworks monitor. The gap they exploit is client-side rendering itself, and it is present even in platforms built on Zero-Trust architecture.

Client-Side Rendering (CSR) is the technique by which modern technology platforms assemble what the user sees at runtime, on the user's own device. The pattern is universal across the deployed landscape: web browsers, mobile applications, desktop application shells, smart appliances, vehicle infotainment systems, AR and VR runtimes, productivity-tool extensions, and the broader landscape of CSR-capable platforms all build their user interfaces this way. The runtime fetches dozens or hundreds of components from across the digital supply chain, executes the code those components return, and renders the result on the screen. This is where the person meets the system, and it is the step that matters most: everything the user comes to know about the system, and every decision the user makes from it, comes from what appears here. That surface, the last thing standing between the software and the user's eyes, is the Glass. These vulnerabilities attack this moment, the last few milliseconds in which client-side rendering produces what informs the user's understanding and drives the user's decisions. An attack that exploits that moment is an ATG attack.

ATG is not an unprecedented exploit. What is new is the connection between problems the field has so far handled as scattered, unrelated point problems. Its parts are individually familiar: client-side supply-chain security and client-side attack-surface management address third-party script risk; the Magecart intrusions have skimmed data from the rendering layer for a decade; and cloaking, serving one response to a scanner and a different response to a victim, is long established in malvertising and search abuse. What ATG adds is one account that covers all of it. It unifies these into a single supply-chain-injection model, extends that model from the browser across the full landscape of Client Runtimes (mobile, desktop, operational-technology and vehicle interfaces, AR and VR, and productivity and AI runtimes), and names what the point defenses miss: the gap between where a file is checked and where it runs. ATG is not a single new bug. It is one problem that current defenses meet one surface at a time.

No adequate, complete defense against ATG currently exists; the partial measures deployed today (CSP, SRI, client-side monitoring, Trusted Types) each check what loads, and ATG acts after the load. The cybersecurity frameworks deployed across the internet today are not poorly designed. They were built for a different threat environment: the threat of malicious code making its way into systems where it does not belong. Checking a delivered file against a known hash, network controls, supply-chain attestation (the signed record of how a component was built and by whom), and Zero-Trust architecture each address that threat well. ATG operates in the rendering layer, between the last point those frameworks monitor and the first point that has any consequence for the human at the screen. The most sophisticated form of ATG defeats file-hash checking by design, because the file it arrives in is genuinely unmodified. Behavioral monitoring at the rendering layer would catch it. That defense does not exist at scale.

Defenders are unprepared to respond to and recover from a wide-scale ATG campaign. The damage an ATG-enabled influence operation can do is not confined to the systems it runs on. A well-executed operation could undermine public trust in institutions across nearly every industry, government, and critical system. The same techniques could equally be used to hijack trust and persuade a population to believe and support a chosen narrative. Used at scale, ATG can create widespread distrust, erode public confidence, undermine market integrity, and significantly diminish governmental authority.

Operations targeting public trust at scale are already running. The Doppelganger campaign, Russia-attributed cloned versions of major Western news outlets distributing disinformation across multiple countries since 2022, demonstrates the demand and the scale. Doppelganger relies on visible infrastructure such as spoof domains and separate distribution channels that defenders can sometimes detect and users can sometimes notice. ATG removes that scaffolding. The same effects can be produced through the legitimate trusted sources themselves, with no separate infrastructure for defenders to find or for users to recognize as suspect.

ATG is, on its own, a serious and unmitigated vulnerability. ATG is also a delivery mechanism: it can inject any content, at scale and with precision, into the most trusted technology platforms on Earth. A Doppelganger-class operation running on that infrastructure, paired with AI-generated content tailored per target, becomes a weapon of a different magnitude entirely. The result is a new class of adversarial influence: weapons of mass deception.

The Vulnerability

Modern client applications are not delivered as fixed products. They are assembled at runtime on the user's device from dozens to hundreds of externally sourced components. When a Client Runtime loads a page, an application, an interface, or a screen, it makes network requests to CDN operators, analytics providers, advertising networks, customer-support tools, payment processors, identity providers, AI inference endpoints (an inference endpoint is the address an application calls to get an answer from a model), and a wide range of commercial service integrations, executing whatever code those sources return with the full permissions of the application context. This pattern of runtime assembly is Integration on the Glass (IOTG). It is the industry standard for every significant client application in the world, and it is permanent: the cost pressures and engineering pressures that produced it are built into how modern software is made.

A device trusts a source because of the address it fetched from, not because of what came back. Once a device is configured to trust a domain, it will execute whatever that domain returns, and it never checks whether today's response matches yesterday's, or matches what that domain returns to anyone else making the identical request. The content returned in response to a URL call is determined entirely by the server receiving the request. That server can return different content to different requesters based on any attribute of the incoming request: the requesting device's IP address, the User-Agent string, the referring page, the time of the request, the geographic location of the device, the network through which it connects, or any combination of these attributes. This capability is the legitimate foundation of personalization, A/B testing, and geographic content variation. It is also the technical mechanism through which ATG attacks are delivered.

The device is not choosing. The application author decides which third parties the device will trust, encodes that decision in the code it ships, and the device executes it. The person in front of the screen is not shown that list, is not asked to agree to it, and cannot decline any entry on it without losing the application. The application chooses, and the choice runs on the user's device.

An adversary who controls any component in the digital supply chain of a target application can use this mechanism to deliver substituted content to specific requesters while delivering legitimate content to everyone else. By reading those request attributes, an adversary can aim at the full user population of a global application, at a country or language community, at a segment defined by behavior or demographics, or at one device operated by one named individual, and can serve different content to several of those groups in the same session window. The substituted content can be any type the runtime processes: executable scripts, stylesheets, images, data payloads, model weights, prompt content. The substitution is delivered through a trusted channel, executed by the runtime without verification, displayed on the Glass without any indication that it differs from what anyone else sees, and leaves no evidence in any backend system, any network log, or any audit trail any existing security framework monitors. The structural condition any ATG operation requires is Adversarial Placement and Access (APA): a party hostile to the dependent systems holding a position somewhere along that supply chain. APA does not come from breaching the target. It comes from holding something the target depends on, often something the target does not know it depends on.

ATG's most sophisticated form is the Two-Stage Attack. A script that is entirely legitimate, verifiably unmodified, and hash-valid carries the attack not through its own code but through the runtime data it fetches at the moment of execution from a data endpoint the adversary holds. The script passes every static integrity check. The attack is in what the script does with the data it receives. This defeats every defense built on checking the delivered file: the file really is clean. The weapon is in the data, not the code.

ATG is not limited to the public internet. Classified networks, military intranets, air-gapped operational technology environments, and private enterprise networks are built from components sourced from the same digital supply chain. A component can be compromised in the supply chain before anyone installs it inside the isolated environment. Isolation applied afterward does nothing about code that was already inside when the isolation began. No network is structurally immune to ATG by isolation alone.

The Threat

The D5 effects framework names the spectrum of outcomes ATG attacks can produce: Deceive, Disrupt, Degrade, Deny, and Destroy. These five effects are not separate attack types, and they are not five degrees of one thing. Each is fully capable alone. They are capabilities of a single weapons framework, applied individually or combined, layered, and sequenced to produce strategic consequences far exceeding the technical complexity of any one effect.

Deceive is the capability at the center of the framework: causing a consumer to accept as true something the system did not intend to show. That consumer is usually a person, manipulated through what they see on the Glass in ways they have no reason to question. It can equally be an automated one. A machine does not judge whether its input is true; it acts on what it is given, which is why falsifying a process value can stop an alarm evaluation from ever escalating, and why a model trained or prompted on a corpus of lies will state those lies as fact. Where the manipulation is delivered to selected recipients, everyone else continues to see the original content, fact-checkers examining the same source see the accurate version, and the target has no basis for suspecting that their experience differs from anyone else's.

Generative AI extends Deceive into dynamic, contextually adaptive deception. Substituted content is generated in real time from what the target is viewing, producing manipulations that are more convincing, better fitted to the moment, and harder to detect than any pre-prepared substitution. Deepfake video and audio injected into web-based conference platforms, AI-generated modifications to news articles and research documents, and AI-generated alterations tailored to the source materials a targeted journalist or analyst is reviewing are all within the technical scope of an AI-equipped ATG operation. The Hong Kong $25 million video-conference fraud in early 2024 shows this deepfake capability at eight-figure stakes; in that case no conferencing platform was compromised, so it illustrates the payload an ATG operation would carry rather than the supply-chain injection mechanism itself. We call this capability Tailored Deception.

Deceive is also where the gravest cases sit. An operator who executes a switching action based on a false grid-state display, a financial officer who executes a transaction based on a false position summary, a system administrator who follows a false security alert's remediation procedure: each is an authorized user taking an authorized action in response to information they had every reason to trust. The manipulation was in the information. The damage that follows is its consequence, and recording it that way keeps the mechanism visible: what failed was not the system, but what the system was believed to have said.

Disrupt interferes with an intended function: the capability is still present and does not do what it is for. A password reset that completes and sends nothing, an alarm control that fires and reaches no one, a report that submits into a queue nobody works. Degrade reduces volume, speed, and scale: everything works, and works worse. Deny removes reach at the Glass: the control is gone, the route does not resolve, the returned set is truncated, and every backend system stays healthy throughout. Destroy is the only one of the five that leaves the Glass: adversary-controlled code reaches through the rendering layer into a backend or a connected system and damages it, so that it cannot function until it is restored or rebuilt. Deny acts on the Glass and Destroy goes through it, and where a person was deceived into taking the damaging action the effect is Deceive with the damage as its consequence, not Destroy.

Each of the four can be aimed at an entire user base, at a country or language community, at a segment defined by behavior or demographics, or at one device, and different groups can be served different content at the same moment. Reach is a property of how an operation is delivered, not of which effect it produces.

The press is the most consequential ATG target. It is the mechanism through which democratic societies form shared understanding, evaluate institutions, and exercise informed judgment. Doppelganger's targeting of major Western news outlets confirms that adversaries already act on that priority. An adversary who can manipulate what journalists see when researching a story, what editors see when reviewing it, and what readers see when consuming it from a trusted platform has achieved precision control over the most influential participants in the information production and distribution chain.

Government and national-security platforms carry the same supply-chain dependencies as every other client application, and legislators, intelligence analysts, election administrators, diplomats, law-enforcement officers, and emergency-management officials decide from what those platforms put on the screen. Defense-industrial-base systems, military command interfaces, and allied coordination platforms carry the same exposure into the most sensitive operational environments on Earth.

Critical-infrastructure operator interfaces, the screens through which human operators monitor and command the physical systems populations depend on for survival, are assembled from the same commercial digital supply chain as every consumer application. Well-run industrial control environments narrow what a runtime in that environment is exposed to. URL pinning, mutual TLS, restricted runtime parsing engines, network segmentation, and operator-workstation hardening each constrain what reaches the rendering layer of an HMI, the human-machine interface an operator watches and acts through, compared with what reaches a commercial browser. None of those measures reach back to the sources the components come from. None of them establishes that a permitted resource returned what the interface expected, and an operator interface exists precisely to render live data it fetches while running. The runtime libraries, framework dependencies, telemetry agents, visualization components, and update channels reach the HMI through the same upstream supply chain that reaches every other client application, and a compromise introduced before the HMI's hardened perimeter is in place is irrelevant to the perimeter that follows. The glass that shows an energy-grid operator the state of the grid they manage is hardened where a social-media feed is not and structurally exposed at the sources its components come from, which the perimeter cannot reach.

The pattern is not confined to a few sectors. It runs across energy and industrial control, healthcare, financial services, transportation, and government and election systems, and it reaches the defense industrial base, communications, and emergency services on the same terms. The common factor is not the sector. It is that each of them puts a person in front of a client-side rendered screen and asks them to decide.

The most strategically significant ATG threat is the compound, long-horizon operation. No single event marks it. Consequences accumulate through individually unremarkable micro-manipulations over weeks, months, or years, gradually corrupting the information environments of the most consequential decision-makers. Those decision-makers never have reason to suspect that what they see differs from what anyone else sees.

The Defense Gap

Existing frameworks are structurally blind to ATG. The allowlist assumption, the foundational premise of network security that trusted addresses return trusted content, is false at the rendering layer. It conflates source authentication, which HTTPS provides, with content integrity, which no deployed framework provides. Zero-Trust Architecture ends at the point of load, before the rendering layer begins. Subresource Integrity verifies the delivered file, not the data that file fetches and acts on while it runs. Adoption has been further limited because keeping those hashes current conflicts with continuous delivery, where the files change on every release. Content Security Policy evaluates sources, not substance. Network monitoring cannot see inside encrypted connections to permitted destinations. Backend integrity monitoring cannot see the gap between accurate data and false display. The CVE framework has no category for attacks that exploit no software flaw.

Runtime code injection is the most demanding dimension of the defense challenge. Pathways include dynamic code evaluation, dynamic script element injection, WebAssembly instantiation from runtime data, Service Worker persistence, AI inference response interpretation, and the data-as-payload Two-Stage Attack. Each requires behavioral observation, not static analysis, for accurate detection. The classification problem is harder still: telling adversarial behavior from legitimate behavior requires knowing both what the code does and what it was supposed to do, and no application publishes a description of its intended runtime behavior in any standard form.

These limits converge because ATG is inherent to client-side rendering: the vulnerability comes from the architecture, and it appears on its own in every runtime that uses the pattern. That is the Endemic Flaw. Defensive maturity is concentrated in the browser; outside the browser, the rendering layer is mostly undefended. The defense must be built where ATG operates: inside the Client Runtime itself, at the rendering layer, in every platform that builds its interface at runtime from the supply chain. Browser extensions and external tools cannot see far enough inside the runtime to detect it.

ATG is real and operational: Polyfill.io, Magecart, XZ Utils, the state-run Great Cannon, and the nine ATG-class event categories documented in the public record establish that. The full scale today cannot be measured: deception, by design, leaves no signal signature-based detection can find. The architectural conditions for nation-state and other-resourced operations are present, and the prudent posture is to assume the capability is in use.

Closing the gap means reclassifying what counts as malicious. Existing defenses look for malicious code from malicious sources; ATG operates through code and sources no existing test would flag. The behavioral defense that follows does not yet exist. Building it is the work that determines whether the weapons-of-mass-deception scenario remains theoretical or becomes the defining strategic surprise of the next decade.