The Watch

The Multi-Front Emergency

Three critical perimeter vulnerabilities disclosed in the same window exceed the emergency change capacity of most shops. This is a class of failure across the entire edge layer, not a single-vendor problem.

The Lineup

The PraisonAI 4-hour figure is the tempo to internalize. Disclosure to working exploit inside a single shift is the new baseline for AI-adjacent infrastructure, driven by automated disclosure-to-exploit pipelines. Monthly patch cycles do not survive contact with that threat model.

Why This Cycle Is Different

The common thread across all five is authentication bypass. The bug class is access control, not memory corruption or races. EDR will not catch these because there is no malicious binary to flag; the ingress said yes when it should have said no. The follow-on:

• Traefik bypass exposes every downstream service that delegated auth to the ingress.
• MOVEit's 2023 Cl0p campaign ran for months before victims noticed. Same product line, same bug class.
• Argo CD's flaw lets any user with 'read' access extract plaintext Kubernetes Secrets, with no EDR signature available.
• NGINX has been edge-facing and pre-auth for eighteen years with no detection layer behind it.

Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The Windows Zero-Day Complication

Two unpatched Windows zero-days from the same anonymous researcher add pressure: a BitLocker bypass that defeats full-disk encryption on patched Windows, and a CTFMON LPE. There are no patches and no vendor timeline. Every SOC 2, HIPAA, and GDPR narrative that says "data at rest is encrypted via BitLocker" now carries an asterisk. Compensating controls only.

The Capability Statement

The UK AI Security Institute has empirically confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber complete full network takeover chains autonomously. This is a government evaluator's finding, not a vendor claim. Mythos cleared both of AISI's hardest tests. GPT-5.5-cyber cleared one. The prior generation topped out at "advanced persistence." AISI is already building harder evaluations because current benchmarks are saturating.

Separately, Microsoft's MDASH — a 100-plus agent system that scans code, debates exploitability, and constructs proof-of-concept attacks — now outperforms Mythos on the CyberGym benchmark. And Google TAG confirmed a threat actor using AI to build a functional cybercrime tool. That is the first public validation that AI-assisted malware development is operational, not theoretical.

What This Changes Operationally

The convergence is the story. AISI validates the offensive ceiling. MDASH demonstrates defender-side tooling at the same tier. Google TAG confirms threat actors are already shipping it. Three independent sources, one direction: AI-speed exploitation is production-ready on both sides of the fence.

Congress is steering Mythos access toward NSA over CISA, signaling offensive/intelligence prioritization over civilian defensive distribution. If NSA is the priority recipient, civilian critical-infrastructure uplift is delayed. Budget as if no government help arrives at AI parity.

The Detection Gap

Full network takeover chains compress the attacker tempo most SOC playbooks assume. SIEM correlation windows built for hours of dwell time will miss minutes-long chains. Identity primitives — Kerberoasting, token theft, consent phishing — are what agentic chains exploit faster, not smarter. The gap is temporal, not technical. Velocity-based analytics tuned against human operators produce false negatives against machine-speed adversaries.

Mozilla's deployment of Mythos Preview against Firefox surfaced 271 previously-unknown bugs, including sandbox escapes and UAFs. The offensive capability translates to real codebases, not just CTF ranges. The researchers noted that harness design matters more than model choice. Defenders can pilot without paying for the top-tier model.

The Numbers That Define the Surface

Agentic workloads now account for 59% of all AI token volume. This is the majority surface, not an emerging one. The first real destructive incident is on the board: an agent framework, OpenClaw, wiped a user's entire email archive without human approval. Classic confused deputy. The agent held a legitimate OAuth grant with modify and delete scope and either misread its instructions or took someone else's. Both readings end at the same archive.

This week's shipped capabilities move the floor lower:

• Claude Code /goal + Auto Mode: Anthropic shipped fully autonomous multi-turn coding sessions with no token cap and no per-tool human approval. The agent picks what to invoke and when to stop. A non-human developer identity with commit rights, running unattended.
• x402 payments inside AWS Bedrock: machine-to-machine payments are now a default capability of Bedrock agents. A successful prompt injection now moves funds, not just data. Blast radius equals whatever wallet the agent holds at the moment it is persuaded.
• Gemini Intelligence on Android: starting summer 2026, the Samsung Galaxy S26 and Pixel 10 ship an on-device agent that reads screens, navigates apps, autofills forms, and completes purchases. Every item on that list maps to a classic RAT objective. The difference is it ships by default, signed by the OEM.

Where Controls Break

Agents act with user OAuth tokens. Downstream systems see legitimate users. Every detection tuned to human behavioral baselines will produce false negatives against agent traffic operating at machine speed with human identity.

The Pricing Change Is a Security Event

Anthropic now bundles $200 of API credits inside a $200 subscription, usable via Agent SDK, claude-p, and GitHub Actions. A developer on a personal plan can run autonomous agents against company code through a personal GitHub Actions runner with zero enterprise telemetry. Entra ID conditional access, CASB, and DLP need signatures for these CLI and SDK fingerprints. The shadow-AI surface is now subsidized.

Claude for Small Business ships pre-built connectors into QuickBooks, PayPal, HubSpot, Google Workspace, and Microsoft 365. SMB vendors in the supply chain will turn this on without telling anyone upstream. Purchase orders and contracts then move through Anthropic as an undisclosed subprocessor.