The Engineer

The Problem: Every Request Path Is Compromised

NGINX, Traefik, and Argo CD all shipped critical CVEs the same week, and the chain matters more than any single bug. Realistic attack paths connect them end to end.

The 18-year-old unauthenticated RCE in NGINX's rewrite module fires before the request reaches the app. Application auth is irrelevant. The request is already handled.

NGINX RCE: the rewrite module ships in roughly 90%+ of production deployments. Anyone who wrote rewrite ^/old-path /new-path permanent; is affected. 18 years to discovery means vendored copies and appliance images pinned to 2014 NGINX are in scope. Check the binaries, not just the package manager. Public PoC on GitHub inside a week.

Traefik CVSS 10.0 (CVE-2026-35051, CVE-2026-39858): ForwardAuth, BasicAuth, and every auth middleware config are decorative until patched. Services behind Traefik that assume authentication happened upstream are wrong right now. This is a design flaw in middleware chain evaluation, not a buffer overflow.

Argo CD Plaintext Secrets (CVE-2026-42880, CVSS 9.6): versions 3.2.0–3.2.11 and 3.3.0–3.3.9 let any authenticated user read plaintext Kubernetes secrets. Argo CD typically holds cluster-admin RBAC. That includes TLS private keys and cloud credentials, reachable by a junior dev with read access.

The Compound Chain

One realistic path: Traefik bypass to internal service access to Spring Cloud Config traversal (CVSS 9.1, reads cloud credentials) to data lake access to Apache Polaris credential-broadening to data exfil. Shorter path: Traefik bypass to internal Argo CD API to extracted K8s secrets to cluster ownership. Add the Linux kernel LPE (Copy Fail, invisible to file integrity tools) and any foothold escalates to root without triggering AIDE, Tripwire, or dm-verity.

AI Infrastructure Is Now Tier-1 Attack Surface

LiteLLM (CVE-2026-42208) is on CISA KEV. Exploitation was observed in the wild within 4 hours of disclosure. Platform teams running LiteLLM to fan prompts across providers should assume stored API keys and prompt logs are gone. Ollama's GGUF heap OOB read adds a second path via malicious model files. Treat AI tooling like a database: put it behind network isolation and turn on audit logs.

Cross-Source Analysis

Independent sources converge on the same number. The window between CVE disclosure and active exploitation has compressed to single-digit hours for internet-facing services. PraisonAI auth bypass went from disclosure to exploitation in 4 hours. LiteLLM hit CISA KEV on the same timeline. A patching SLA measured in weeks is an order of magnitude too slow.

Patch Order

1. NGINX: remote, unauthenticated, internet-facing, largest surface area.
2. Traefik: same reasoning, smaller install base.
3. Argo CD: usually internal. If exposed to the public internet, move to position 1.
4. LiteLLM: if running 1.81.16–1.83.7, patch now and rotate all LLM provider API keys.
5. Kernel (Copy Fail): requires local access. Prioritize CI runners and multi-tenant hosts.

What Changed

Anthropic moved Claude's programmatic usage to dollar-equivalent API credits. The $200/month plan now buys $200 of API credit. That's it. Heavy users on the old subscription were extracting $700–$2,000+ of API-equivalent value per month. The arbitrage is closed.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost.

Teams running Claude through Cline, OpenCode, Zed, or custom SDK harnesses were paying 10-30% of API rates. The subsidy was never a published SKU. It was a side effect of how native clients were billed, and third-party harnesses rode the same rail. The rail is gone. Effective cost snaps back to list API pricing with zero code change on the client.

Separately: Opus 4.7 Tripled Vision Costs

Per-image token accounting changed. Anything that fans out across a batch now pays 3x for the same bytes. If vision is on the hot path, last quarter's pipeline math is wrong. This shipped in the release notes, near the bottom.

Why It Happened

Two readings. One is margin over growth: Anthropic cleaning up unit economics for public market investors by October. The other is capacity triage: planned for 10x growth, got 80x. The behavior is the same under both. The response is the same under both.

Evidence for capacity: Claude Code degraded silently, corporate accounts were banned without warning, and a 7-day trial was attached to paid plans without disclosure. The 220K GPU Colossus 1 lease from xAI should help. The precedent is set regardless: when demand exceeds supply, the product degrades without disclosure.

OpenAI's Counter-Play

Sam Altman put up two months of free Codex for any enterprise that switches within 30 days. Deadline July 13. Ramp data shows Anthropic at 34.4% of businesses versus OpenAI at 32.3%. That is the first lead change. OpenAI is trying to flip it before it sets.

ServiceNow's Cautionary Tale

ServiceNow burned through its entire annual Anthropic budget by May. The CDIO assigned dedicated headcount to watch Claude usage through external tooling they wrote themselves. Anthropic ships no per-user telemetry, no per-feature telemetry, no SLAs, and raises prices on an unpredictable cadence. If ServiceNow's controls did not catch this, neither will the average finance team's.

The Provider-Agnostic Imperative

Six independent sources this week point to the same conclusion. Single-provider lock-in is a measurable financial risk. Market share is 34.4% vs 32.3%, effectively split. Build the abstraction layer.

The Capability Jump

UK AISI confirmed Anthropic's Mythos completed both of their hardest hacking challenges with full network takeover in controlled tests. OpenAI's GPT-5.5-cyber completed one. Both took the standard tests. The prior generation topped out at 'advanced persistence': foothold without domain control. That ceiling is gone.

AISI is now developing harder benchmarks because the current suite is being saturated. The capability curve hasn't plateaued.

Persistence and takeover are not adjacent points on a curve. They are different categories of incident. Mythos navigates the full chain without a human in the loop: reconnaissance, vulnerability discovery, exploit chaining, lateral movement, privilege escalation.

Cross-Source Validation

This is not one benchmark. Four independent signals converge:

• Mozilla: 271 real Firefox bugs found by Mythos Preview, including previously-unknown vulnerabilities in multiprocess browser engine code
• Palo Alto Networks: dozens of serious vulnerabilities across 130+ products using AI scanning
• DepthFirst: 12 memory corruption bugs in FFmpeg for $1K of compute. Mythos missed them at $10K. The harness beat the model
• Google: confirmed hackers using AI to build cybercrime tools in the wild

The Foxconn Case Study

Nitrogen exfiltrated 8TB from Foxconn's North American manufacturing operations. 8TB implies weeks of dwell time and enough egress bandwidth that nothing flagged it. Detection missed it. Segmentation didn't contain it. DLP didn't fire. If one node reaches 8TB without an alert, the architecture is the bug.

What This Means for Defense

Most threat models assume 30–90 days from CVE publication to widespread exploitation. For anything an AI can chain, the window is hours to days. Machine-speed adversary, machine-speed loop. Anything else is decoration.

One nuance from the DepthFirst result is worth holding onto: the harness matters more than the model. DepthFirst found bugs for $1K that Mythos missed at $10K because their target-specific infrastructure was better. The defensive analogue is the same. Well-instrumented code with real fuzzing coverage resists AI scanning better than poorly-instrumented code wrapped in expensive detection tools.

NSA vs. CISA Access

NSA is getting Mythos access over CISA. The government is treating frontier cyber models as offensive/intelligence tools first, defensive second. Undisclosed 0-days found by Mythos-class tooling will exist in the stack you operate. Architect for containment, not prevention.