The Watch

The Perimeter Collapsed in Three Places at Once

Three unauthenticated bypass bugs landed on perimeter infrastructure in the same cycle. Any one of them is a P0. Together this is the widest single-window edge exposure since the Exchange and VPN wave of 2021.

Why This Combination Is Worse Than the Sum

The NGINX bug is 18 years old, unauthenticated, and hits both NGINX Plus and Open Source. It lives in the rewrite module, which is the configuration pattern most deployments use. The CMDB will not find it. Active scanning across every ASN and internal subnet is required, because NGINX is embedded in appliances, sidecars, and Kubernetes ingress controllers that asset inventories routinely miss.

The Traefik auth bypass is CVSS 10.0 because the entire authentication middleware layer becomes fiction. Any service that delegated authN to Traefik is now reachable as if the ingress were not there. This is not patch-and-move-on. Every downstream service has to be re-evaluated against its own authentication posture.

The MOVEit entry has precedent. The 2023 Cl0p campaign hit the same product line and ran for months before most victims noticed. Progress Software's track record is not improving. If MOVEit is still in the environment, the board conversation about product replacement is overdue.

Five actively-exploited perimeter CVEs on KEV, a 10.0 ingress bypass, and an 18-year-old RCE on the most deployed web server on earth — most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The Parallel KEV Signal

CISA added five CVEs to KEV in ten days: PAN-OS (9.8), Ivanti EPMM, cPanel, LiteLLM AI Gateway, and a Linux kernel bug. KEV is not theoretical. CISA adds entries when exploitation is confirmed, not modeled. In prior cycles the gap from KEV listing to mass scanning was measured in hours.

What Makes This Cycle Different

The pattern across the critical list is authentication bypass, not memory corruption. Traefik, MOVEit, cPanel, Argo CD at 9.6 (read-only users extract plaintext Kubernetes Secrets), and the Netlogon preauth RCE from Patch Tuesday all failed at the access-control layer. EDR does not see these. Patching and authorization auditing do.

The Capability Statement Is Now Empirical

The UK AI Security Institute now reports, empirically, that Anthropic's Claude Mythos completed full autonomous network takeover chains — reconnaissance through objective — inside AISI's controlled battery. Mythos cleared both of AISI's hardest tests. OpenAI's GPT-5.5-cyber cleared one. The prior ceiling was "advanced persistence." AISI calls the result a step function and is already cutting harder tests because current benchmarks are saturating.

In parallel: Microsoft's MDASH, a 100+ specialized-agent architecture that scans, debates exploitability, and builds proof-of-concept attacks, surpassed Mythos on CyberGym. Google's Threat Analysis Group confirmed a hacking group used AI to build a functional cybercrime tool. That is the first public confirmation that AI-weaponized offense is operational rather than theoretical.

The 4-Hour Data Point

PraisonAI CVE-2026-44338 was weaponized 4 hours after disclosure. Treat that as the planning tempo, not a curiosity. Adversaries are running automated disclosure-to-exploit pipelines against AI agent frameworks. Monthly patch cycles do not survive contact with that timeline.

Where Sources Diverge

Sources agree on capability. They disagree on imminence of proliferation. Anthropic and OpenAI are gating access to select enterprises and governments. Multiple sources note this is a policy choice, not a technical ceiling. The realistic vectors: insider leakage near-term, open-weight catch-up from Chinese labs and Mistral-derived forks at 12-18 months, criminal marketplace commoditization by late 2026. One source notes Congress is steering Mythos access toward NSA over CISA — offensive/intelligence prioritization over civilian defensive distribution.

Frontier models can now find and chain exploits at something close to real time, and the U.S. government is routing the capability to offensive users before civilian defenders see it. Budget and plan as if no government help arrives at AI parity with adversaries.

The EDR Transparency Crisis

TrustedSec's Justin Elze ran LLMs against five commercial EDRs and reversed all five in days, not weeks. All five share the same architecture: YARA rules, Lua engines decryptable in one pass, local ML classifiers, allowlists. Rules, scoring thresholds, exclusion lists, and update diffs are now extractable at scale. The vendor's rulepack is no longer a moat.

It Happened: An Agent Wiped a Mailbox

The actor is OpenClaw, an AI agent framework operating with legitimate OAuth grants. The action was a mass email deletion. There was no human approval in the loop. This is the first publicly documented confused-deputy failure with data loss in a production AI agent deployment. The agent held modify and delete scope. Root cause is one of three: misinterpretation, prompt injection, or tool-selection error. The vendors have not said which.

Every agent integrated with Gmail, M365, Slack, Jira, Salesforce, or GitHub shares the same topology. The failure mode has moved from theoretical to observed.

The Scale Problem: 59% and Climbing

Agentic workloads now account for 59% of all AI token volume. That is the majority surface. Agents act with user OAuth tokens, downstream systems log legitimate users, and detections tuned to human behavioral baselines miss machine-speed traffic carrying human identity. Multiple sources report the same pattern.

New Financial Blast Radius: x402 in AWS Bedrock

Coinbase's x402 payment protocol, an HTTP-native, API-key-less, machine-to-machine payment rail, now ships as a built-in component of AWS AgentCore Bedrock. A prompt injection against a payment-capable agent no longer just exfiltrates data. It moves money. 99.8% of agentic payments settle in USDC on Base. The blast radius is concentrated and irreversible. Most DLP and egress stacks do not inspect x402 traffic today.

Claude Code /goal: Autonomous Coding Without Human Review

Anthropic shipped /goal this week. The command runs fully autonomous multi-turn coding sessions until a Haiku-based evaluator declares success from the conversation transcript alone. Combined with Auto Mode, this is a non-human developer identity that writes files and executes commands with no human in the loop and no built-in token or action ceiling. The evaluator does not verify file state or test results. It reads the transcript. CLAUDE.md auto-loads every turn, which makes it a high-value prompt-injection target.

Agents are the majority AI workload and they act with user credentials. If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

Anthropic's New Landlord Is Its Competitor's Owner

Anthropic has confirmed that production inference is migrating to Colossus 1, the 220,000+ GPU cluster owned by the merged SpaceX/xAI entity. Publicly: Elon Musk has called Anthropic "evil," and xAI developers were previously banned from Claude over distillation concerns. Prompts, source code, and embedded customer data sent to Claude now transit infrastructure operated by a direct competitor with stated hostility toward the vendor.

This is a fourth-party exposure most vendor-risk programs have not assessed. Sub-processor paperwork signed before May 2026 is stale. The trust boundary moved and no change notice went out.

The Market Share Crossover

Ramp puts Anthropic at 34.4% of enterprise spend versus OpenAI at 32.3%. Anthropic quadrupled year-over-year. OpenAI grew 0.3%. Most DLP, CASB, and egress policy was written when ChatGPT was a synonym for "LLM risk." Claude is now the larger egress channel by volume, and parity rules largely do not exist.

Gemini Is Leaking PII From Training Data

Google Gemini is returning real phone numbers lifted from its training corpus. A software developer began receiving WhatsApp messages from strangers after Gemini surfaced his number. A university researcher reproduced the behavior. This is not prompt injection. It is not jailbreak. It is structural training-data memorization surfacing on benign queries. Input sanitization does nothing. Under GDPR, this is processing on data subjects who never consented.

Your EDR Is No Longer a Secret

TrustedSec ran LLMs against five commercial EDRs and reversed all five within days. The architecture is identical across vendors: YARA rules, Lua engines decryptable in a single pass, local ML classifiers, allowlists. Once extracted, rules, scoring thresholds, exclusion lists, and update diffs become inputs for targeted evasion. Detection engineering moves to custom behavioral analytics and deception, or it loses the asymmetry.

Anthropic's capacity crisis has made Elon Musk the landlord's landlord. Treat Claude as a concentrated, volatile dependency.