If you run a marketing site, a mobile app, or a connected-TV experience, you load a substantial amount of code from other companies on every session. Tag managers. Analytics. Ad pixels. Session replay. Chat widgets. SDKs. Cloudflare's 2024 Application Security Report puts the typical enterprise customer at 47 third-party scripts on the page and connections to 50 separate third-party destinations, with retail and travel sites running higher. Each script runs with the same privileges as your own code: it can read the DOM, capture form input, and call external endpoints. Each one also updates on a schedule you do not set, through a CI/CD pipeline you do not see.

This is the digital tracking technology (DTT) layer. It is the most powerful tool available to a modern marketing team, and it is also, increasingly, the lowest-cost route for a malicious actor to reach your customers. We monitor it because few others do, and because the developments of the past twelve months have fundamentally changed the economics of who can attack you, how quickly, and at what cost.

Until recently, weaponizing a known JavaScript or SDK vulnerability was difficult. Skilled human attackers required days to weeks of focused work, and the most valuable resulting exploits traded on public broker price lists for somewhere between $100,000 and $2.5 million. That cost structure placed serious supply-chain attacks against ad-tech, analytics, and tag-manager scripts largely out of reach for all but nation-states and elite criminal groups.

That ceiling is now moving. In April 2026, Anthropic announced Project Glasswing, a defensive cybersecurity initiative built around a new frontier model called Claude Mythos Preview. Anthropic and its partners (AWS, Apple, Microsoft, Google, JPMorganChase, CrowdStrike, Cisco, Palo Alto Networks, NVIDIA, Broadcom, and the Linux Foundation) confirmed that the model is already finding and exploiting vulnerabilities at a level that "surpasses all but the most skilled humans."

Mythos Preview has identified thousands of zero-days across every major operating system and web browser, scored 83.1% on the CyberGym vulnerability-reproduction benchmark, and in some cases discovered flaws that had survived decades of human review and millions of automated tests. Glasswing is structured as a defensive effort. The capability it documents, however, is not confined to good-faith users. As CrowdStrike's CTO observed, "what once took months now happens in minutes."

For supply-chain risk, the relevant takeaway is not the specific benchmark number. It is the trajectory. Finding and weaponizing vulnerabilities was once a scarce specialty; it is becoming routine. Every line of vendor code on your site, including every tag manager script, every analytics SDK, and every chat widget, shares the character of the codebases in which Mythos Preview is finding bugs. The vendor scripts considered "too small to bother with" yesterday will not remain so for long.

The attack surface of digital tracking technology is not theoretical. It is documented in legal filings, GDPR enforcement actions, and SEC disclosures going back nearly a decade. The shape of the attack is consistent: a small change to a piece of trusted, externally-hosted code goes unreviewed, propagates silently to every property loading it, and exfiltrates data for days to months before anyone notices.

The history of web supply-chain attacks reads like a single paragraph rewritten with different victim names. Four examples follow, all pre-Glasswing and executed by skilled humans against high-value targets:

These are pre-Glasswing attacks. The Mythos Preview benchmark indicates that the rate of new discovery, and the speed of moving from "vulnerability known" to "exploit working," is set to accelerate. Targets that were not previously worth a skilled attacker's time will become worth the time of a less-skilled one.

Web is the most closely watched surface, and it is still failing. Mobile and connected TV are barely watched at all, and they are failing more severely.

• SpinOK ad SDK shipped malicious code in 101 Android apps on Google Play, exfiltrating files and clipboard contents to attacker servers. Some 30M users were affected, and 43 of the apps remained live on the Play Store after disclosure.
• SparkCat, identified by Kaspersky as one of the first publicly documented SDK-based crypto-wallet stealers on Apple's App Store, hid inside an SDK distributed across food-delivery, AI-chatbot, crypto, and VPN apps, using ML Kit OCR to scan users' photo galleries for crypto wallet recovery phrases.
• Keenadu, disclosed by Kaspersky's Securelist in February 2026, was embedded directly into the firmware of Android tablets at the manufacturing supply chain stage. The malicious payload was linked into libandroid_runtime.so with a valid digital signature, injected into the Zygote process at boot, and runs in the context of every app on the device. Roughly 13,715 devices were detected infected, and the malicious system components survive factory reset because they reside in the read-only system partition.

The lesson is consistent across platforms: an SDK or script that appears benign at review time can turn malicious in production, following a software update that the app store does not re-review. Mobile ecosystems are full of overpermissive third-party SDKs. Academic work auditing the Google Play SDK Index has found that more than a third of audited SDKs over-collect data relative to their stated privacy policy, and that this rate has not improved meaningfully year over year.

Across the Vault JS customer base, we observe dozens of vendor-script changes each month on a typical enterprise marketing stack. Almost none are reviewed by the customer's security team before going live.

Most enterprises already operate a CMP for consent, a WAF for traffic, an EDR on endpoints, and a CSP header on the page. None of these is designed to monitor how vendor code changes over time:

• CMPs and cookie banners manage user consent. They do not read what the script actually does. A consent-tagged script that begins exfiltrating credit cards remains consent-tagged.
• WAFs and CSPs govern what loads, not what loaded code does. The British Airways attack came from a script the CSP allowed.
• EDR and AppSec watch your code, within your CI/CD pipeline. Vendor code bypasses both, which is the entire point of using a vendor.
• Periodic audits and penetration tests sample a single moment in time. Modern supply-chain attacks are versioned, often geo- or device-targeted, and frequently short-lived, precisely the kind of behavior that point-in-time snapshots are designed to miss.

The gap is specific and well defined: continuous, behavior-level observability of every third-party script and SDK, every time it changes.

Vault JS is an independent, third-party privacy compliance monitoring platform for enterprise web, mobile, and CTV properties. It does not install code on your site, and it does not block, enforce, or proxy traffic. Instead, it observes, continuously, every third-party script and SDK in your environment, every change to each one, and every resulting shift in behavior. We then report exactly what changed, who is responsible, what risk it carries, and what to do about it.

That outside-in stream is large, comprising dozens of vendor changes a month on a typical enterprise stack. A four-layer pipeline narrows it to the few that warrant human review, in order of increasing scrutiny:

The change types we score

In practice, we look for the change types that carry the highest signal for a malicious actor, and we score each one by severity. The scoring runs identically across web, mobile, and CTV; only the telemetry differs, because we score the behavior rather than the platform.

Because we score the behavior at the version where it changes, a malicious mobile or CTV update is caught when it ships, not at an app store's one-time review. This is precisely the SparkCat and Keenadu pattern described in §03.

The case for continuous monitoring of digital tracking technology is not that every vendor will be compromised. It is that some will, that the cost of compromising them is falling, and that detection times remain long. Even shorter incidents, such as Codecov's two months or the weeks-long [24]7.ai chat-widget compromise, represent considerable windows for an attacker copying card numbers, credentials, or session tokens to a server named to resemble analytics traffic.

Find the change first. Tell the security team what changed, where, and how to remediate it. Provide the privacy team with audit-ready evidence of whether the vendor was, or was not, doing what it claimed. That is the work.