The Engineer

The Compounding Threat

Rare week. Critical pre-auth vulnerabilities on multiple layers of the same production stack dropped on the same calendar, which is the part the threat models did not price in. The NGINX rewrite module RCE has lived in the tree for 18 years, which is older than most of the fuzzing harnesses that were supposed to find it. The module ships in something like 90%+ of production deployments. Anyone running rewrite ^/old-path /new-path permanent; is in scope.

Unauthenticated means the attacker does not need a login, a cookie, or a prior foothold. The request is handled before your application's auth middleware ever sees it.

Traefik's auth bypass lands at CVSS 10.0. The rubric ran out of knobs. If ForwardAuth, BasicAuth, or any middleware sits behind Traefik, those controls are decorative until the patch is applied. This is the middleware chain evaluation order, not a buffer overflow. Read the diff if you want to see how short the fix is.

The Chain Attack

These do not stand alone. Argo CD 3.2.0-3.2.11 and 3.3.0-3.3.9 let any authenticated user to extract plaintext Kubernetes secrets (CVE-2026-42880, CVSS 9.6). Argo CD typically runs cluster-admin. The realistic path:

1. Traefik bypass reaches an internal service
2. Internal Argo CD API is now accessible
3. Extract K8s secrets (database passwords, cloud credentials, TLS keys)
4. Own the cluster

Stack the LiteLLM vulnerability (CVE-2026-42208, on CISA KEV, which means exploitation is confirmed in the wild) on top. LiteLLM gateways sit in front of model endpoints and hold the API keys. Disclosure to exploitation was 4 hours. The "patch critical within 30 days" SLA is an order of magnitude wrong for this class.

Spring Cloud Config Completes the Picture

Spring Cloud Config 3.1.0-4.3.2 has a directory traversal at CVSS 9.1 allowing arbitrary file read from the config server. Config servers hold other systems' credentials. That is the job description. The chain extends: Traefik bypass, Spring Config traversal, cloud credentials, data lake.

Patch Priority

What Actually Changed

Anthropic moved Claude's programmatic usage to dollar-equivalent API rates. If you routed Claude through Cline, Zed, OpenCode, or a custom harness, you were pulling $700-2,000+ of API-equivalent value out of a $200/month plan. That implicit subsidy is gone. Effective cost per token jumps 3-10x overnight, depending on workload profile.

Same prompts, same images, same outputs, new bill. This is not a regression in capability. It is a regression in cost.

The mechanism is simple. The discount was never a published SKU. Third-party harnesses were riding a billing rail designed for native clients. Starting June 15, third-party tool usage gets a separate credit pool equal to plan value. Drain the pool, you pay full API rates. The goodwill buffer is a 50% rate limit increase for two months.

Vision Costs Hit Separately

Opus 4.7 also tripled image processing costs with no announced performance justification. The per-image token accounting changed. Anything that fans out across a batch pays 3x for the same bytes. If vision is on the hot path, last quarter's pipeline economics do not hold.

The Capacity Context

Anthropic planned for 10x growth and got 80x. That shortfall manifested as silent product degradation. Not error codes. Not degraded-mode headers. Claude Code had features quietly nerfed. Corporate accounts were banned without warning. Some paid subscribers found themselves on a 7-day trial they were never told about. The 220K GPU lease from Colossus 1 should provide relief. The precedent stands: when demand exceeds supply, the product degrades without disclosure.

The Counter-Offer

OpenAI responded the same week with two months of free Codex for any enterprise that switches within 30 days. Deadline July 13. Ramp data already shows the market splitting: Anthropic at 34.4%, OpenAI at 32.3%. Neither vendor has a lock. The teams that built provider abstraction layers a year ago were right.

Cost Modeling

Worked example. Team of 10 engineers on Pro plans, running Claude through third-party tools 8 hours/day:

• Old cost: ~$2,000/month in plan fees.
• New cost: $2,000 in credits exhausted in 3-5 days, then full API rates for the rest of the month.
• Projected new monthly: $6,000-$15,000+ depending on workload.

ServiceNow, a $9B+ revenue company, burned through its entire annual Anthropic budget by May. Their CDIO assigned dedicated headcount to watch usage through external tooling they had to build themselves, because Anthropic exposes no per-user, no per-feature token consumption data, and no SLAs.

The Capability Jump

The UK AI Safety Institute confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber hit "full network takeover" in controlled hacking tests. Prior-generation ceiling was "advanced persistence." Persistence means you keep a foothold. Takeover means you own the domain. Full takeover is a catastrophe, and the gap between the two is not incremental.

AISI is now developing harder benchmarks because the current suite is being saturated. That tells you the capability curve hasn't plateaued.

Mythos cleared both of AISI's hardest challenges. GPT-5.5-cyber cleared one. That is above the prior doubling trend on AI cyber task capability, not on it.

Three Confirming Signals

• Palo Alto Networks pointed frontier models at 130+ products and got dozens of serious vulnerabilities. Real exploitable bugs in shipping code, found at machine pace.
• Microsoft MDASH runs 100+ specialized agents in scan/debate/exploit stages. It surfaced 16 exploitable Windows vulnerabilities patched in one Patch Tuesday.
• Google researchers documented attackers building cybercrime tools with AI in the wild. Operational, not theoretical.

The Foxconn Case Study

Nitrogen ransomware hit Foxconn's North American manufacturing. 8TB exfiltrated before encryption fired. 8TB implies weeks of dwell time and enough egress headroom that nothing flagged it. Detection missed it. Segmentation did not contain it. DLP did not fire on the transfer. If one compromised node reaches 8TB without an alert, the problem is in the design, not the tooling.

What This Changes

The time constants in most threat models are wrong. The working assumption has been 30-90 days from CVE publication to widespread exploitation. For anything an AI can chain, that window is hours to days. The PraisonAI auth bypass went from disclosure to active exploitation in 4 hours. Either attackers pre-positioned against specific targets, or there is an automated weaponization pipeline turning advisories into working exploits in under 4 hours. Both are bad.

Defensive Architecture Implications

If the adversary runs at machine speed, the detection-to-response loop has to as well. First-line defenses (network segmentation, credential scoping, anomaly-triggered isolation) must fire without human approval for containment. The NSA getting Mythos access over CISA tells you how governments are reading this: offensive first, defensive second. Assume undisclosed 0days in the stack.

The Architecture You Need to Understand

Claude Code's /goal command runs multi-turn coding sessions to completion without human checkpoints. A separate Haiku model decides when the goal is met. The critical design choice: the evaluator only reads the conversation transcript. It cannot stat a file, run the test suite, or check that the diff compiles.

If the coding model claims the migration ran and the tests pass, and the transcript is internally consistent, that is a satisfied goal. Whether the repo is actually in that state is a separate question the evaluator is not equipped to answer.

The Cost Failure Mode

There is no built-in token budget. The loop terminates when the evaluator says terminate, or when something upstream kills it. Context grows each turn. Each turn pays for cumulative context. A loop that looks like progress at turn five is a $200 invoice at turn forty. The 4,000-character goal condition is the only built-in control. The official guidance to include a time cap inside it is the floor, not the ceiling.

What Works

Four composable controls make this production-usable.

1. Process-level wrapper: wall-clock timeout plus a token meter via the status endpoint (F26). SIGTERM when cumulative input tokens cross a threshold you picked on purpose. One engineer-hour to set up.
2. PostToolUse hooks: run lint and type-check after every edit. Output lands in the next context window. The agent self-corrects or the loop signals failure.
3. External verification: run the real test suite in a post-step instead of trusting the transcript. pytest -k X exit code is truth. The evaluator's reading of the transcript is not.
4. Branch isolation: hard file allowlist on a scratch branch. A runaway session that cannot touch main is a story, not an incident.

Composability Pattern

PostToolUse hooks plus Auto Mode plus /goal gives a self-correcting loop: agent writes, linter fires, output enters context, agent fixes, proceeds. For well-scoped refactors (migrating one API pattern, upgrading the test framework, converting type annotations) this is genuinely powerful. "Well-scoped" is carrying the sentence. Compound objectives break it.

Start Here

Begin with read-heavy goals: changelog generation, pattern analysis, documentation. Failure blast radius is low. Move to write-heavy goals (refactors, migrations) only after CLAUDE.md guardrails, PostToolUse hooks, process-level timeouts, and a test suite verified to catch breakage are all in place.