Three stories that appear in unrelated verticals actually describe the same operational move: taking a closed, high-trust system’s core credential or byproduct and turning it into a liquid, weaponizable input for an entirely different domain. The malicious Sicoob.Sdk NuGet package steals PFX certificates and client IDs to enable direct Pix fraud; Newcleo’s $2.4 B SPAC and Oklo partnership convert surplus plutonium into reactor fuel; OpenAI’s Rosalind initiative and CVE-Bench results show LLM agents being tested on real security patches so they can later be pointed at live infrastructure. In each case the original “waste” or “credential” (stolen certs, reactor-grade plutonium, model weights trained on code) is no longer waste—it is feedstock. The same logic appears in the US Navy’s plan to run a naval base off a carrier’s reactors and in Headway’s forced facial-biometric enrollment for therapy access: civilian or commercial tokens are being reclassified as dual-use reserves. No single vertical noticed that the technical primitive is identical—extract, repackage, redeploy across domains—because each desk still treats certificates, fuel rods, and model checkpoints as separate asset classes.