The Engineer

The Capability Jump Is Real and Quantified

Six independent sources converge on the same conclusion this week: AI-driven vulnerability discovery has crossed a capability threshold that changes your operational risk calculus. The most concrete data point: Claude discovered and built a working exploit for a 13-year-old remote code execution vulnerability in Apache ActiveMQ Classic — in minutes, not weeks. Separately, Anthropic's restricted Mythos model is reportedly finding thousands of critical, unpatched vulnerabilities per year where human security teams find approximately 100. That's not incremental improvement; it's an order-of-magnitude shift.

The cost of finding exploits in legacy code just went from 'expensive, nation-state level' to 'nearly free, commodity level.' Your patch SLA is now your security posture.

The Government Response Tells You the Signal-to-Noise Ratio

Treasury Secretary Bessent and Fed Chair Powell convened an emergency meeting with the CEOs of Citigroup, Bank of America, Morgan Stanley, Wells Fargo, and Goldman Sachs — specifically about AI-driven cyberattack risk. Federal officials reportedly believe Mythos could debilitate Fortune 100 companies and take down large portions of the internet. The critical nuance most coverage misses: only ~40 organizations currently have defensive access to Mythos. This creates a dangerous asymmetry window. The capability exists; the defense distribution doesn't. Expect this asymmetry to last 12-18 months as competing models ship similar capabilities.

Your Legacy Stack Is the Target

The ActiveMQ finding is a canary. ActiveMQ Classic has been in maintenance mode since Apache shifted focus to Artemis — minimal security attention for years against a codebase embedded in countless Java enterprise applications, ESBs, and integration layers. A 13-year-old RCE suggests more are waiting. The same logic applies to every component in your infrastructure that is 5-15 years old and has never been audited with modern tooling. AI just made comprehensive auditing feasible — and your adversaries have access to the same capability.

What Makes This Different From Previous AI Security Hype

Previous AI security tools (AFL, Semgrep, CodeQL) amplified human researchers. Mythos apparently removes the human from the loop entirely, operating at scale and speed that changes the economics fundamentally. The key unanswered question: what's the false positive rate? Finding thousands of 'critical flaws' means nothing if 90% are unexploitable. The fact that classified-briefing-level officials are convening emergency meetings suggests the signal-to-noise ratio is high enough to worry people with access to the full threat picture.

The Defensive Playbook

The response isn't just 'patch faster.' It's a three-layer shift:

1. Know what you're running: Inventory all legacy middleware — ActiveMQ, RabbitMQ, older Kafka versions, ESBs, SOAP gateways. Include components hiding in legacy integrations that nobody owns.
2. Isolate what you can't patch: Network segmentation, default-deny NetworkPolicies, and zero-trust traffic enforcement beyond just mTLS. Your identity layer tells you WHO; your traffic layer controls WHERE requests can flow.
3. Use the same tools offensively: Evaluate AI-assisted code auditing (Semgrep with LLM integration, direct LLM-based auditing) against your oldest, scariest codebases. Find your vulnerabilities before someone else does.

Your current p95 time-to-patch for critical vulnerabilities: if it's measured in weeks, you need it in days. Invest in automated patching pipelines, canary deployments, and rollback infrastructure as first-class security controls.

The Docker AuthZ Bypass You Already Patched Is Back

A 10-year-old Docker Engine authorization bypass has resurfaced despite being previously patched. This isn't a new vulnerability — it's a regression, meaning a fix that was applied in a previous release was silently undone in a subsequent update. The impact: root-level host access for anyone exploiting it. Not a container escape in the academic sense — full privilege escalation to the host.

If you upgraded Docker Engine through a version that reintroduced the bug, your vulnerability scanner marked you clean based on the version number, and your actual security boundary has been missing.

This specifically affects environments using Docker's native AuthZ plugins for security-critical isolation — common in CI/CD systems, shared development environments, and older orchestration setups. This does not affect containerd directly or Podman. The failure mode is insidious: version-based scanning gives you a false clean bill of health. You must functionally test that authorization actually works, not just check version numbers.

Why Cisco Is Paying $350M for Machine Identity Management

In parallel, Cisco is reportedly finalizing a $250M-$350M acquisition of Astrix Security, a Tel Aviv-based startup focused on non-human identity management — API keys, service accounts, OAuth client credentials, machine-to-machine tokens. This is the market validating what the Docker regression demonstrates: machine identity sprawl is now a board-level attack surface concern.

Most engineering teams cannot answer basic questions about their non-human identities:

• How many service accounts exist across all clusters and cloud accounts?
• Which ones have admin-level permissions?
• When was the last credential rotation?
• Who is the human owner of each machine identity?

The Snowflake breach, the Codecov supply chain attack, and numerous other incidents trace directly back to compromised non-human credentials. The Docker regression adds a new failure mode: credentials you thought were protected by an authorization layer that silently stopped working.

Connecting the Dots: Trivy Compromise + Supply Chain

Adding urgency: the Trivy security scanning tool was itself compromised this cycle. If Trivy is in your CI pipeline — and it's one of the most popular container image scanners — you need to verify your pinned versions and check for indicators of compromise. Your security toolchain is now part of your attack surface, not just a defense layer. Consider running a second scanner (Grype or Snyk) as cross-validation for critical image scans.

The Core Trade-Off No One Is Framing Clearly

As AI coding agents proliferate — context windows have gone from 8K to 1M tokens in two years, terminal-first agents are displacing IDE plugins, and pricing ranges from free to $15/1M output tokens — teams face a practical architecture decision: CLI-based agents or MCP-based agents for tool integration. The trade-off is sharper than most realize.

LLMs were trained on billions of CLI examples, making them remarkably good at composing shell commands. A chain like gh | jq | grep executes in a single call. MCP requires the agent to orchestrate each tool call separately — more round trips, more latency, more tokens. But CLI agents inherit a single shared token with no per-user revocation. If you're running 15 engineers with coding agents touching your GitHub org and AWS accounts, this is a real governance gap.

Use CLI inside trust boundaries for composability. Use MCP when crossing trust boundaries where audit and revocation matter. This is a trust boundary pattern, not a tooling preference.

AGENTS.md: The Emerging Discoverability Standard

In parallel, the ecosystem is converging on AGENTS.md — essentially robots.txt for AI agents. It's a declarative file describing what an agent can and can't do with your service. Combined with MCP, it creates a standardized agent-to-service interface. The cost to prototype is trivial: add an AGENTS.md to one of your services and test whether agents can discover and interact with it.

The Machine-Legibility Requirement

Both patterns point to the same infrastructure requirement: your internal docs, runbooks, and service catalogs are now part of your production context layer. When an agent consults your runbook at 3am during an incident, the quality of that Markdown matters as much as your monitoring dashboard. Standardize on Markdown with frontmatter metadata — owner, status, last-reviewed, tags — as your default knowledge format. The failure mode to avoid: the 'AI-native junk drawer' of thousands of unstructured files with no ownership that agents hallucinate from.