The Watch

What Just Landed

Three of the most-deployed edge technologies disclosed critical authentication bypasses in the same cycle. None require authentication. All are remotely exploitable. The change window is measured in hours, not days.

Why This Is Different

The common thread across all four is authentication bypass at the access-control layer, not memory safety. The operational consequences:

• EDR will not catch these. No shellcode, no anomalous process trees.
• WAF rules need specific crafting. Generic signatures will miss.
• PraisonAI was weaponized in four hours. That sets the tempo for the rest.

The NGINX bug is 18 years old. It is present in both Plus and Open Source, and lives in the rewrite module, which is the configuration pattern used by the majority of deployments. NGINX sits behind an estimated 34% of all websites and is the default ingress controller for most Kubernetes environments. The blast radius speaks for itself.

Traefik shipped two auth bypasses at CVSS 10.0. Any service delegating authentication to Traefik middleware is now exposed as if the middleware were not there. This is not a perimeter vulnerability. It negates the perimeter.

MOVEit is bleeding again. The last time this product had a bug in this class, the Cl0p campaign ran for months before most victims noticed. If MOVEit is still in the environment, treat compromise as a question of weeks.

Cross-Source Intelligence

Multiple sources agree that authentication bypass dominates the critical-severity list this cycle. SANS AtRisk lists MOVEit, Traefik, cPanel, OpenCTI, Microsoft ESTS, and Argo CD all failing at the access-control layer. The Hacker News independently validates the NGINX and PraisonAI timelines. The convergence is not coincidence. It reflects a systemic under-investment in authorization logic relative to memory-safety controls.

The Capability Statement

Three independent validators reached the same finding this week. The UK AI Security Institute confirmed that Anthropic's Mythos completed full end-to-end network takeover in both of its hardest cyber ranges, including the Cooling Tower scenario, under a 2.5M-token budget. OpenAI's GPT-5.5-cyber cleared one of two. A newer Mythos build hit 6/10 success vs 3/10 baseline, doubling within a single generation. Separately, Google's Threat Analysis Group attributed a functional cybercrime tool to a real threat actor using AI to build it. That is the first public attribution of AI-assisted malware development in the wild.

The Structural Shift

Microsoft's MDASH, a 100+ agent system, surpassed Mythos on the CyberGym benchmark, which measures real-world vulnerability discovery and exploitation speed. The pipeline is scan, adversarial debate, proof-of-concept construction. XBOW reportedly surfaced thousands of high and critical vulnerabilities in weeks. Mozilla used Mythos Preview to find 271 previously-unknown Firefox bugs, including sandbox escapes and use-after-frees.

AI-driven exploitation crossed the near-real-time threshold this week. Any security program still operating on 30-day patch SLAs and annual pentests is structurally behind the threat curve.

What This Means for Your Program

Contradictions Worth Noting

Sources diverge on the proliferation timeline. Publicly, AISI and Anthropic emphasize gated access as a control. Other sources, less publicly, treat gating as a speed bump rather than a lid. Weight leaks, jailbreaks, and open-weight competitors such as DeepSeek and Qwen forks are expected to deliver equivalent capability to commodity actors within 12-18 months. Congressional hearings are routing Mythos access toward NSA over CISA, which signals offensive prioritization over civilian defense. Plan as if no government help arrives at AI parity with adversaries.

The Defender Side

MDASH and Mozilla's 271-bug haul show the same capability is usable on defense. Per Mozilla, the differentiator is harness quality, not model choice. Custom harness plus frontier model produces hundreds of findings. Generic prompt plus frontier model produces noise. Budget for orchestration engineering, not just API spend.

The Inflection Point

Agentic workloads now carry 59% of all AI token volume per Vercel's production telemetry across 200,000+ teams. This is no longer an emerging attack surface — it is the majority surface. And it produced its first destructive incident: OpenClaw deleted a user's entire email archive without human approval. The confused-deputy pattern moved from theoretical to operational.

Three Concurrent Expansions

1. Agents Get Payment Authority

Coinbase's x402 payment protocol now ships as a built-in component of AWS AgentCore Bedrock. Autonomous, sub-cent, API-key-less payments become a default capability. 99.8% of agentic payments settle in USDC on Base. A successful prompt injection or agent-hijack now moves money, not just data — and it's irreversible.

2. Agents Get Screen-Level Access

Google's Gemini Intelligence, shipping this summer on Galaxy S26 and Pixel 10, grants an LLM screen-read, cross-app navigation, autofill, and auto-purchase authority. Every capability maps to a classic Remote Access Trojan objective — except it ships by default, signed by the OEM. The primary attack vector is indirect prompt injection: a malicious PDF, poisoned email, or crafted QR code steers the agent into unintended actions.

3. Agents Get Autonomous Code Authority

Anthropic shipped Claude Code /goal — fully autonomous multi-turn coding sessions with no token budget cap and no per-tool human approval. The evaluator (Haiku) only reads the conversation transcript and cannot independently verify filesystem state. CLAUDE.md files are auto-loaded every turn, making them a high-value prompt-injection target for persistent compromise of every developer who runs /goal in that workspace.

The Governance Gap Is Structural

If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

The Market Share Crossover

Ramp's enterprise spend data: Anthropic at 34.4% of paying business customers, OpenAI at 32.3%. Anthropic grew 4x year over year. OpenAI grew 0.3%. Eight independent sources this cycle confirm the crossover. Most CASB rules, DLP policies, and shadow-AI inventories were written when ChatGPT was the assumed shape of LLM risk. Claude is now the larger exfiltration channel by paying-customer count. Parity rules are largely absent.

The Fourth-Party Problem

Anthropic has confirmed 80x demand growth against a 10x capacity plan. Visible symptoms: silent product degradation, corporate accounts banned without notice, A/B experiments on access revocation. Less visible: a capacity deal places Claude inference onto Colossus 1, a 220,000+ GPU cluster owned by xAI/SpaceX. The xAI CEO has publicly called Anthropic "misanthropic and evil." That is the operator of the silicon your prompts now traverse.

Prompts and code sent to Claude now transit infrastructure operated by a direct competitor with stated hostility toward the vendor. The trust boundary has moved and nobody updated the data-flow diagram.

The Enterprise-Readiness Gaps

ServiceNow exhausted its full-year Anthropic budget in months. National Life Group reports it cannot monitor employee Claude usage. Multiple sources confirm Anthropic ships without per-user telemetry or SLAs that mature SaaS vendors have offered for a decade. This is not a rumor. The customers are named.

What To Do About It

Operational posture: Anthropic is a Tier-0 AI vendor with immature enterprise controls. It is not the scrappy alternative to OpenAI anymore. Refresh the DPA, the sub-processor list, and the DPIA. Bring shadow-AI detection rules to parity with the OpenAI ruleset. Write the contingency plan for a 24-hour loss of Claude access before the 24 hours arrive.