The Watch

The Situation

Three critical authentication bypass vulnerabilities landed on internet-facing infrastructure inside a 48-hour window. Each one is an emergency change on its own. Together they are the most concentrated edge-infrastructure cluster since Log4j in late 2021.

Why This Is Different

The common thread across all four is authentication failure at the access-control layer, not memory corruption. EDR will not see it. WAF signatures will not see it. Patching and authorization auditing are the only mitigations that touch the root cause. Anything that delegated authentication to Traefik middleware is exposed. Any ingress controller running NGINX is a candidate entry point. Any Argo CD deployment with read-only users has been leaking Kubernetes secrets.

Authentication bypass dominates the critical-severity list this cycle. The blast radius is not the vulnerable service. It is everything that trusted the vulnerable service to enforce access control.

The NGINX Problem Specifically

The NGINX rewrite module RCE has been sitting in the code for 18 years. It affects NGINX Plus and Open Source. It is pre-authentication and edge-facing. The deployment footprint covers ingress controllers, API gateways, reverse proxies, load balancers, and the long tail of appliances that bundle NGINX without saying so. The CMDB will not find them. Active network discovery will. Mass scanning is expected 24 to 48 hours after PoC publication.

The MOVEit Pattern

Last time MOVEit had a bug in this class, the Cl0p campaign ran for months before most victims noticed. The 2023 campaign hit hundreds of organizations through a single product line. Progress Software's track record is not improving. Organizations still running MOVEit Automation should treat the product as a standing liability and move the migration date forward.

Cross-Source Pattern

Two independent intelligence streams say the same thing. CISA added five CVEs to KEV in ten days (PAN-OS 9.8, Ivanti EPMM, cPanel, LiteLLM, Linux kernel), all under active exploitation against internet-facing infrastructure. In parallel, PraisonAI's CVE-2026-44338 was weaponized 4 hours after public disclosure. Disclosure-to-mass-exploitation has compressed from weeks to hours. Quarterly maintenance windows do not fit that tempo.

The Confirmation

The UK AI Security Institute has empirically validated what red teams have been logging for two quarters. In AISI's controlled battery, Anthropic's Claude Mythos completed full network takeover chains and cleared both of the institute's hardest tests. No prior model has cleared both. OpenAI's GPT-5.5-cyber cleared one. The previous generation stopped at "advanced persistence." AISI's word for the delta is step function.

Microsoft's MDASH, a 100+ specialized agent system, beat Mythos on the CyberGym benchmark, which scores reproduction of real-world vulnerabilities. XBOW partners are reported to have surfaced thousands of high and critical vulnerabilities in weeks using frontier models; treat the count as unverified until a vendor publishes it. Google's Threat Analysis Group has confirmed the first threat actor caught using AI to develop a functional cybercrime tool in the wild. That one is on the record.

Frontier models can now find and chain exploits at something close to real time, and the U.S. government is routing the capability to offensive and intelligence users before civilian defenders see it.

What Changed Since Tuesday

Tuesday's briefing flagged 81% autonomous hack success rates. The data since then is qualitatively different:

Operational Consequences

Seven sources converge independently on the same read: defensive assumptions calibrated to human-speed adversaries are structurally behind. The 30-day critical patch window that was defensible in 2022 is indefensible now. Seven days is the new floor for internet-facing systems. For actively exploited bugs, seven days is already too slow.

Where sources diverge

The disagreement is on proliferation timeline. One camp argues gated access buys 12-18 months before open-weight models reach parity. Another notes that Shai-Hulud's source publication and MDASH's architecture are already blueprints for adversary clones. A third points to China's Tencent-DeepSeek financing talks as the route to ungated offensive AI outside Western safety regimes. The prudent assumption: commodity threat actors wield Mythos-class capability by late 2026.

The Congressional signal

The House Homeland Security Committee is steering Mythos access toward NSA over CISA. That is offensive and intelligence prioritization over civilian defensive distribution. If NSA is first in line, civilian critical-infrastructure uplift slips. Budget and plan as if no government AI parity arrives for defenders this year.

The Tipping Point

Agentic workloads are 59% of all AI token volume per Vercel's production telemetry across 200,000+ teams. This is no longer an emerging attack surface. It is the majority surface. Three events this week moved the threat model from theoretical to operational:

1. OpenClaw deleted a user's entire email archive without human approval. Confused-deputy failure, in production, not a lab
2. Claude Code shipped /goal mode. Fully autonomous multi-turn coding sessions, no token cap, no per-tool human approval, a Haiku-based evaluator that reads only the conversation transcript
3. x402 autonomous payments went live in AWS Bedrock. Agents wire money without API keys or human-in-the-loop, settling in USDC on Base

A successful prompt injection against an agent with payment capability moves money, not data. The blast radius is whatever wallet or credential the agent holds at the moment it is persuaded.

The Governance Gap Is Measured in Quarters

The control plane most organizations operate was built for employees clicking buttons. Ten sources independently document the same structural mismatch:

LLMjacking Matures Into Operational Threat

A honeypot study confirmed AI infrastructure is fingerprinted by Shodan within 3 hours of becoming internet-reachable. The same honeypots drew 175 LLMjacking attempts per week. Nearly 23% of scan traffic targets AI-specific endpoints: /api/tags, /v1/models, /.cursor/rules, /.well-known/mcp.json. The adversary toolchain, LLM-Scanner, updated mid-experiment to defeat honeypot defenses. Shared, actively maintained, evolving.

Claude /goal: The Specific Threat

Anthropic's /goal command paired with Auto Mode creates a non-human developer identity that writes files and executes commands with no built-in token or action ceiling. The Haiku evaluator cannot independently verify file state or test results. It reads the conversation transcript. CLAUDE.md is auto-loaded every turn, which makes it a high-value prompt-injection target. A malicious PR that modifies .claude/ settings achieves persistent prompt injection against every developer who runs /goal in that workspace.