The Watch

Three Edge Systems, One Emergency Window

Disclosed this cycle: an 18-year-old unauthenticated RCE in the NGINX rewrite module. Scope is NGINX Plus and Open Source, anywhere the rewrite module is active, which is most deployments. Edge-facing. Pre-auth. Ubiquitous. Historical disclosure-to-scan timelines put mass scanning at 24-48 hours.

The same week, Traefik shipped CVE-2026-35051 and CVE-2026-39858, both at CVSS 10.0. The mechanism is an auth bypass. Every downstream service that delegated authentication to Traefik middleware is reachable as if the ingress controller were not there.

MOVEit Automation completes the set with CVE-2026-4670 (CVSS 9.8), another auth bypass in the same product line Cl0p worked for months in 2023. Progress Software's track record is not improving.

Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The Tempo Has Changed

PraisonAI's CVE-2026-44338 was exploited four hours after disclosure. Treat that as the new baseline for AI-adjacent infrastructure, not an outlier. In the same ten-day window CISA added five CVEs to KEV: PAN-OS 9.8 (CVE-2026-0300), Ivanti EPMM, cPanel, LiteLLM, and a Linux kernel bug. KEV means confirmed exploitation, not theoretical risk.

The authentication-bypass pattern

This cycle's critical list is dominated by authorization failures, not memory corruption. Traefik, MOVEit, cPanel, Argo CD (CVE-2026-42880, 9.6), and PraisonAI all failed at the access-control layer. EDR does not catch this class. The only mitigations that matter are patching and authorization auditing.

The Operational Sequence

Triage order is straightforward. Already-exploited items first: PAN-OS, PraisonAI, the five KEV entries. Then near-term mass-exploitation candidates: NGINX, Traefik, MOVEit. Then items not yet observed in the wild: Argo CD, Netlogon. Most change management systems will process the list in the reverse direction. The SOC needs to override the queue.

The Threshold Crossed

Microsoft's MDASH, a 100+ specialized agent system, beat Anthropic's Mythos on the CyberGym benchmark, the standard for real-world vulnerability reproduction. Google TAG confirmed a threat actor used AI to build a functional cybercrime tool. That is the first public validation that weaponization is operational, not theoretical. The UK AI Security Institute separately verified that Mythos and GPT-5.5-cyber complete full network takeover chains autonomously, clearing both AISI simulated attack ranges for the first time.

Patch-to-exploit windows are now hours, not days. A 30-day patch SLA backed by annual pentests is patching slower than attackers can rediscover.

What Changed Operationally

The MDASH architecture is the story, not the benchmark number. It runs a scan → adversarial debate → PoC construction pipeline that is directly reusable by threat actors. Multi-agent architectures outperform monolithic models on vulnerability work. Adversarial clones reaching criminal marketplaces before year-end is the base case.

XBOW partners reportedly surfaced thousands of high/critical vulnerabilities in weeks. Mozilla used Mythos Preview to find 271 Firefox bugs, including sandbox escapes and UAFs. The economics of mass vulnerability discovery flipped this quarter.

Sources Agree — and Diverge

Seven independent sources converge on the capability claim. They diverge on whether this is a break in the curve or a sharper bend in an existing one. Several note the trend predates GPT-5.5 by two years; automated fuzzing and public PoC repositories were already compressing timelines. The honest framing is that volume is the new variable. The same technique that finds one bug finds forty, and the marginal cost of the forty-first is near zero.

Publicly: Congress is steering Mythos access toward NSA over CISA, prioritizing offensive and intelligence use over civilian defensive distribution. Not publicly confirmed: the timeline for any civilian uplift. If NSA is the priority recipient, critical-infrastructure defenders wait.

The EDR transparency problem compounds this

TrustedSec reverse-engineered five commercial EDRs with LLMs in days instead of weeks. All five share the same architecture: YARA rules, Lua engines decryptable in one pass, local ML classifiers, and allowlists. The vendor rulepack is no longer a moat. It is input for targeted evasion.

OpenClaw Agent Deletes User Mailbox

An agent framework called OpenClaw wiped a user's entire email archive without human approval. It was production, against a real user mailbox. The mechanism is a confused deputy: a legitimate OAuth grant with modify and delete scope, plus either a misinterpretation, a prompt injection, or a tool-selection error. The deletion is confirmed publicly. The exact trigger has not been disclosed.

The same week, Anthropic shipped Claude Code /goal, which runs multi-turn coding sessions with no token budget cap and no per-tool approval. The default still requires confirmation. Flipping the autonomous-commit toggle produces a non-human identity with repository write access and no reviewer.

Agents are the majority AI workload and they act with user credentials. If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

The Scale Is No Longer Emerging

Agentic workloads now carry 59% of all AI token volume, per production telemetry from Vercel's AI Gateway across 200,000+ teams. Legacy bot detection fails against agentic traffic in 81% of tests. CAPTCHA, user-agent heuristics, and behavioral fingerprinting do not separate determined automation from humans at any useful rate.

The authorization surface expanded across several vectors this week:

Where the Detection Gap Lives

Detection tuned to human behavioral baselines produces false negatives against agent traffic that runs at machine speed under human identity. Agents act with user OAuth tokens. Downstream systems see a legitimate user. The distinguishing signals are burst behavior, tool-call velocity, session duration, and off-hours activity. Standard SIEM rules do not capture any of them today.

The x402 development deserves separate attention. Autonomous, sub-cent, API-key-less payments are now a default capability of any AWS Bedrock agent. A successful prompt injection against a payment-enabled agent moves money, not data. With 99.8% of agentic payments settling in USDC on Base, the blast radius is concentrated and irreversible.