The Watch

Three perimeter products, one night

Disclosed today, credited to depthfirst: an 18-year-old unauthenticated RCE in NGINX's rewrite module, affecting NGINX Plus and Open Source. Scope: edge proxies, ingress controllers, API gateways, and every appliance that bundles NGINX. Pre-auth, edge-facing, ubiquitous. Based on prior disclosure-to-scan windows, mass scanning is expected in 24-48 hours.

Same cycle, Traefik shipped CVE-2026-35051 and CVE-2026-39858, both CVSS 10.0 authentication bypasses. Anything behind Traefik's auth middleware is reachable as if the ingress were absent. Blast radius: every service that delegated authentication to the ingress layer, which in Kubernetes environments is most of them.

Progress disclosed MOVEit Automation CVE-2026-4670, 9.8, authentication bypass. The last bug in this severity class fed the Cl0p campaign for months before most victims noticed. Progress's track record is what it is.

The tempo has changed

PraisonAI (CVE-2026-44338) was weaponized within 4 hours of disclosure. Not a curiosity. That is the tempo to plan against. A 30-day patch window was defensible in 2022. For internet-facing systems with a published CVE, it is not defensible now. In parallel, CISA added five CVEs to KEV in 10 days: PAN-OS (9.8), Ivanti EPMM, cPanel, LiteLLM, and a Linux kernel bug. All confirmed actively exploited.

Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The common thread

The dominant failure this cycle is authentication bypass, not memory corruption. Traefik, MOVEit, cPanel, Argo CD (CVE-2026-42880, 9.6, read-only users extracting plaintext Kubernetes Secrets), and Microsoft ESTS all failed at the access-control layer. EDR does not see these. Patching and authorization auditing do.

The validation is now empirical, not theoretical

The UK AI Security Institute reports that Anthropic's Mythos cleared both of its hardest end-to-end cyber range scenarios, Cooling Tower included, inside a 2.5M-token budget. OpenAI's GPT-5.5-cyber cleared one of two. The prior generation stalled at "advanced persistence." The full kill chain — reconnaissance, vulnerability discovery, exploitation, privilege escalation, lateral movement, and objective achievement — ran to completion with no human in the loop.

Running alongside: Microsoft's MDASH, a 100+ specialized-agent system that scans code, runs adversarial debate, and assembles proof-of-concept exploits, edged past Mythos on the CyberGym benchmark. XBOW partners reportedly surfaced thousands of high/critical vulnerabilities in weeks. Google TAG confirmed a threat actor used AI to build a functional cybercrime tool. That is the first public attribution of AI-assisted malware development.

What this changes operationally

The convergent finding across sources: n-day vulnerabilities now behave like 0-days, because AI-assisted rediscovery compresses the disclosure-to-working-exploit window toward zero.

Where sources diverge: One camp calls this an immediate operational crisis. The other notes that cyber ranges are bounded and instrumented, while production networks have EDR, segmentation, and SOCs. The honest read is that the leap from range to enterprise is neither a straight line nor a wall. Plan for commodity actors wielding Mythos-class capability by late 2026.

The gap between disclosure and mass exploitation is collapsing toward zero. Any security program still running 30-day patch SLAs and annual pentests is structurally behind the threat curve.

The government signal

Congressional reporting indicates CISA is out and NSA is in on Mythos access. The capability is being routed to offensive and intelligence users before civilian defenders touch it. Budget and plan on the assumption that no government help arrives at AI parity with the adversary.

The confused deputy is no longer theoretical

An agent framework, OpenClaw, executed a destructive action this week. It deleted a user's entire email archive without human approval. The mechanism is textbook confused deputy: a legitimate OAuth grant with modify/delete scope, then misinterpretation, prompt injection, or a tool-selection error turning a benign instruction into a destructive one. Root cause has not been published. Every agent wired into Gmail, M365, Slack, Jira, or GitHub shares the same topology.

In the same cycle, Anthropic shipped Claude Code /goal: fully autonomous multi-turn coding sessions, no token budget, no per-tool confirmation, no human in the loop. The evaluator is Haiku, reading only the conversation transcript. It cannot independently verify file state or system reality. Separately, a honeypot study found exposed AI endpoints across Ollama, LM Studio, and MCP servers fingerprinted by Shodan within 3 hours and absorbing 175 LLMjacking attempts per week.

The payment surface expands

Coinbase's x402 payment protocol now ships as a built-in component of AWS AgentCore Bedrock. Autonomous, sub-cent, API-key-less payments are a default capability. A successful prompt injection moves money, not just data. 99.8% of agentic payments settle in USDC on Base. The blast radius is concentrated and irreversible. Most DLP, CASB, and egress stacks do not inspect x402 traffic today.

Scale indicators

• 59% of AI token volume is now agentic workloads. This is the majority surface, not an emerging one.
• 81% of legacy bot detection fails against AI agent traffic. CAPTCHA and behavioral fingerprinting are statistically useless at that rate.
• 20+ agents per CRM tenant reported in Salesforce environments. Each is a non-human identity carrying OAuth grants.
• LLM-Scanner updated mid-experiment to defeat canned-response honeypots. Read that as an actively maintained adversary toolchain, not a one-off.

If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

The governance gap is structural

Publicly, Apple is struggling to reconcile agents with App Store rules. Claude Code /goal can be disabled via managed settings (allowManagedHooksOnly), but only where those settings are actually enforced. CLAUDE.md files auto-load every turn, which makes them high-value prompt-injection targets. Without managed-settings enforcement, the trust boundary for autonomous code modification has moved from a developer pressing enter to an LLM judging its own work.