What do recent incidents such as MOVEit, the Salesforce/Drift token theft and JLR show about product security today?

Products keep failing through the same old weaknesses (injection, unpatched known vulnerabilities, stolen tokens from integrations), and attackers now use AI too.

• MOVEit Transfer, 2023: one SQL injection in a file transfer product was used to steal data from over 2000 organisations. A single product flaw spreads to every customer.
• Jaguar Land Rover, 2025: an unpatched SAP NetWeaver vulnerability contributed to an attack that halted production for weeks. Patching third-party components is product and supply chain security.
• Salesforce, 2025: attackers stole OAuth tokens from a vulnerable AI chatbot integration (Salesloft Drift) and used them to read customers' Salesforce data. An integration is attack surface.
• Claude Code, 2025: attackers jailbroke an AI coding agent and used it to automate intrusions against about 30 organisations.
• FortiGate, 2026: misconfigured firewalls were found and broken into with LLM assistance. Even security products fail through bad defaults.

The lesson from both incident timelines is the same. The classes of bug are well known. What keeps changing is the scale at which one weak product hurts everyone who bought it.

Go deeper:

• Hadrian — MOVEit breach timeline — how one SQL injection spread to thousands of organisations
• Google Threat Intelligence — Data theft from Salesforce instances via Salesloft Drift — the integration-token attack in detail
• Anthropic — Disrupting an AI-orchestrated cyber espionage campaign — the Claude Code jailbreak case from the vendor
• The Hacker News — AI-assisted threat actor compromises 600+ FortiGate devices — the 2026 firewall campaign