The Watch

The Compound Exposure

Four pre-auth criticals against edge infrastructure, dropped on the same cycle. Exploitation tempo has collapsed. NGINX's rewrite module RCE sat undetected for 18 years and affects NGINX Plus and Open Source both. That covers ingress controllers, API gateways, reverse proxies, and the long tail of appliances that ship NGINX inside. Traefik CVE-2026-35051/CVE-2026-39858 is CVSS 10.0. Complete auth bypass. Every downstream service is exposed as if the ingress were not there. MOVEit Automation CVE-2026-4670 is a 9.8 auth bypass and pattern-matches the 2023 Cl0p campaign, which ran for months before most victims noticed. Argo CD CVE-2026-42880 is a 9.6 that lets read-only users extract plaintext Kubernetes Secrets. EDR will not see it. This is missing authorization, not memory corruption.

Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The Exploitation Timeline Problem

PraisonAI CVE-2026-44338 anchors the tempo. Four hours from disclosure to working exploit in the wild. Treat that as the new baseline for AI/ML supply-chain targets, not an outlier. LLMjacking honeypot research lines up: exposed AI endpoints get fingerprinted by Shodan within three hours and absorb 175 attack attempts per week. The 30-day patch window is dead for anything internet-facing.

Priority Triage Matrix

What Makes This Cycle Different

The common thread across Traefik, MOVEit, Argo CD, and PraisonAI is authentication bypass. Not memory corruption. Access-control layer failures. EDR will not catch these. File integrity monitoring will not catch these. Patching and authorization auditing will. Anything that delegated auth to Traefik middleware needs an inventory pass, and app-layer auth is now required for anything sensitive, patched or not.

On MOVEit: Progress Software's repeat-offender pattern is a documented vendor-risk data point now. The 2023 campaign hit hundreds of organizations. If MOVEit is still in the environment, the board-level conversation about product replacement is overdue.

The Capability Threshold

Three confirmations this week, from three independent bodies, settle the question of whether AI-driven autonomous offense is operational. UK AISI confirmed that Anthropic's Mythos executed full network takeover chains, initial access through objective, in both of its hardest simulated ranges. Microsoft's MDASH, a system of more than 100 specialized agents, beat Mythos on the CyberGym benchmark for reproducing real-world vulnerabilities. Google TAG publicly attributed an AI-built cybercrime tool to a tracked threat actor. That last one is the first public attribution of AI-assisted malware development to a named group.

AISI just empirically confirmed that frontier AI can now execute full network takeover autonomously; gated access buys us months, not years, to rebuild detection around machine-speed adversaries.

What Changed From Last Week

Tuesday's briefing logged 81% autonomous success rates. This week the same capability is reclassified as government-validated operational capability. AISI is building harder evaluations because current tests are saturated. A newer Mythos version cleared 6/10 vs. 3/10 baseline ranges. That is an intra-generation doubling. Capability is compounding between versions, not just between releases.

The second development is architectural. MDASH's pipeline is now public: scan → adversarial debate → PoC construction. The pipeline is reusable. Multi-agent architectures outperform monolithic models on vulnerability work, and adversarial clones will surface in criminal marketplaces before year-end. Treat that as forecast, not fact.

Defensive Assumptions That No Longer Hold

The Policy Dimension

Congress is routing Mythos access toward NSA over CISA. The signal is offensive and intelligence prioritization over civilian defensive distribution. If NSA is the priority recipient, civilian critical infrastructure uplift is delayed. Plan as if no federal help arrives at AI parity with adversaries. Separately: CAISI pulled down voluntary model-testing agreements under White House pressure, while ODNI is pushing an IC-led assessment center. Compliance direction is frozen for 6 to 12 months.

The Operational Reality

Agentic AI is now the majority workload, not an emerging one. Vercel production telemetry across 200,000+ teams puts 59% of all AI token volume as agentic. That is a measured rate on live infrastructure, not a forecast. Three shipments this week pin the attack surface in place:

• Claude Code /goal: Anthropic shipped fully autonomous, multi-turn coding sessions. No token budget cap. No per-tool human approval. The agent picks tools and decides when to stop. The only check is a Haiku model reading the conversation transcript.
• Gemini Intelligence: From summer 2026 on Galaxy S26 and Pixel 10, Android ships an on-device agent that reads screens, navigates apps, autofills forms, and completes purchases. The capability list maps one-to-one to a Remote Access Trojan objective list.
• x402 in AWS Bedrock: Coinbase's agent-to-agent payment protocol is now default in AgentCore. Prompt injection against an agent with payment authority is not data leakage. It is a withdrawal.

Agents are the majority AI workload and they act with user credentials. If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

The Confused Deputy Is No Longer Theoretical

An OpenClaw agent wiped a user's entire email archive without human approval. Apple is publicly racing to sandbox agents inside the App Store because static review cannot cover agents that spin up sub-applications at runtime. If the strictest review process in tech cannot resolve agent authorization, enterprise deployments are under-governed by default.

AI agents bypass legacy bot detection in 81% of tests. CAPTCHA, user-agent heuristics, and behavioral fingerprinting are statistically useless against determined automation. The LLM-Scanner tool updated mid-experiment to defeat honeypots. That is shared, actively maintained adversary tooling, not a one-off.

Agent Security Architecture: Procurement Baseline

The Claude Code /goal Specifics

The Haiku evaluator only reads the conversation transcript. It cannot independently verify file state, test results, or system reality. CLAUDE.md auto-loads every turn, which makes it a high-value prompt-injection target through malicious PRs or compromised dependencies. The enterprise control is narrow: allowManagedHooksOnly in managed settings, pushed via MDM. Without it, /goal is one flag away from autonomous code modification on every developer endpoint.

The Shift

Anthropic is now the largest enterprise AI vendor by paying-customer share: 34.4% vs 32.3% against OpenAI per Ramp, with revenue quadrupling year-over-year to a $30B run rate. The vendor most shadow-AI policies do not name is now the majority vendor. At the same time, 80x demand against 10x capacity has forced Anthropic onto a hosting arrangement that puts Claude inference on Colossus 1, a 220,000+ GPU cluster owned by the merged SpaceX/xAI entity, whose CEO has publicly called Anthropic "evil."

Prompts and code sent to Claude now transit infrastructure operated by a direct competitor with stated hostility toward the vendor. The trust boundary moved. The data-flow diagram did not.

Observable Operational Impacts

The capacity squeeze is producing observed, not theoretical, behavior: Claude Code silently revoked from paying customers, corporate accounts banned without warning, and A/B experiments run on access revocation itself. This is documented current conduct by a vendor most enterprises now depend on for production workloads.

The telemetry gap compounds it. Anthropic ships without per-user usage telemetry or SLAs by default. ServiceNow exhausted its full-year Anthropic budget. National Life Group's CIO said it is "great for consumer usage but not great for companies." Standard detection scenarios fail:

The Sub-Processor Problem

Under GDPR Article 28, the Colossus 1 arrangement likely requires sub-processor notification to customers. Most DPAs signed before May 2026 are stale. The vendor's sub-processor list needs verification against the current reality. The open fourth-party question is whether xAI or SpaceX personnel have any logical or physical access path to inference workloads. Nobody outside Anthropic can answer that today.

Adjacent signal worth weighting: AI labs are routinely banning each other from their APIs to block distillation. Anthropic banned xAI developers in January 2026. Any org running fine-tuning or synthetic data generation against commercial APIs is one ToS enforcement action away from losing access and facing an IP claim.