The Watch

The Convergence

Three pre-auth bypasses landed on edge infrastructure in the same window. All three fail the same way: the access-control layer broke, not memory safety. EDR will not see this. Patching and authorization audits will.

NGINX: 18 Years Hiding in Plain Sight

The RCE sits in the rewrite module and affects both NGINX Plus and Open Source. The module is on in most production configurations. The bug is pre-authentication, edge-facing, and has been there for 18 years. Exposure: ingress controllers, reverse proxies, API gateways, load balancers, and the long tail of appliances that bundle NGINX. Mass scanning for bugs of this class typically starts within 24-48 hours.

Traefik: Your Ingress Auth Is Fiction

CVE-2026-35051 and CVE-2026-39858 are both 10.0 CVSS. Anything that delegated authN to Traefik middleware is now directly reachable. Downstream services assumed the ingress was enforcing the gate. Until patched, that assumption does not hold. App-layer auth must remain warranted for anything sensitive, even after patching.

MOVEit: The Cl0p Playbook Runs Again

Progress MOVEit Automation, CVE-2026-4670, 9.8 auth bypass. Cl0p hit hundreds of organizations through the same product line in 2023. The playbook then was exploit silently, exfiltrate for weeks, then notify victims en masse. If MOVEit is still in the environment, assume compromise is a question of weeks, not whether.

Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The Five CISA KEV Additions

CISA added five entries in 10 days. PAN-OS (CVE-2026-0300, 9.8, KEV May 6). Ivanti EPMM (CVE-2026-6973, KEV May 7). LiteLLM (CVE-2026-42208, KEV May 8, the first AI infrastructure entry on the list). cPanel (CVE-2026-41940, KEV Apr 30). Linux kernel algif_aead (CVE-2026-31431, KEV May 1). All confirmed exploited in the wild. KEV is not a watchlist. CISA adds only what responders have already seen used.

The Data Point That Changes the Math

PraisonAI CVE-2026-44338 is an auth bypass in an LLM orchestration framework. It was exploited within 4 hours of public disclosure. The actor was not a state service. It was commodity tooling running automated disclosure-to-exploit pipelines against AI agent frameworks. That is the tempo.

Microsoft's MDASH is a 100+ specialized agent system that scans code, debates exploitability among agents, and builds proof-of-concept attacks. It has surpassed Anthropic's Mythos on the CyberGym benchmark. XBOW reportedly surfaced thousands of high and critical vulnerabilities in weeks. The UK AI Security Institute reports that the length of cyber tasks frontier models can complete is doubling every few months.

What the Defender's Assumptions Used to Look Like

Sources Agree: The Curve Has Bent

Multiple independent sources land on the same conclusion this week. Mythos cleared both AISI end-to-end cyber ranges, a first for any model. Palo Alto's scanning work surfaced dozens of serious vulnerabilities across 130+ products. Congress is steering Mythos access toward NSA over CISA. Read that as offensive and intelligence prioritization over civilian defense. The capability is in hand. Proliferation is now a timing question.

Enterprise change-management runs in weeks. PraisonAI was weaponized in hours. MDASH finds and chains exploits at machine speed. The 30-day patch SLA that was defensible in 2022 is a liability in 2026.

The MDASH Architecture Is Replicable

MDASH's pipeline runs scan → adversarial debate → PoC construction. The multi-agent architecture outperforms monolithic models on vulnerability work, and the pattern is reusable by threat actors. Publicly: nothing yet. Rumored: adversarial clones within months, commoditized versions on criminal marketplaces before year-end. Treat the second sentence as unverified until it is not. A newer Mythos version reportedly cleared a cyber range 6/10 times versus 3/10 for the preview baseline, an intra-generation doubling.

The First Confirmed Destructive Agent Incident

An AI agent framework (OpenClaw) wiped a user's entire email archive without human approval. This is the first confirmed confused-deputy failure resulting in data destruction — not a lab demo, not a tabletop, a real mailbox permanently emptied because an agent had modify/delete OAuth scope and either a misinterpretation, a prompt injection, or a tool-selection error turned cleanup into annihilation.

This incident lands in a week where three other developments compound the exposure:

• Claude Code /goal shipped fully autonomous multi-turn coding sessions with no token budget, no per-tool human approval, and a Haiku evaluator that can only read transcripts — not verify filesystem reality
• x402 payments now ship as a default component in AWS AgentCore Bedrock, enabling machine-to-machine payments without API keys or human-in-the-loop
• 59% of all AI token volume is now agentic workloads, per Vercel gateway data across 200,000+ teams

The Attack Surface Is the Majority Surface

When 59% of traffic is agentic, this is no longer an emerging threat model. It is the threat model. Every OAuth grant issued to an agent is a non-human identity with potential destructive reach. Every MCP server is an ungoverned trust boundary. Every x402-enabled agent carries financial exfiltration capability.

Agents are the majority AI workload and they act with user credentials. If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

Apple Confirms the Problem

Apple is publicly racing to build agent governance into the App Store because its current review model cannot cover agents that spin up sub-applications at runtime. If the strictest app-review regime on the planet cannot cleanly solve agent authorization, enterprise agent deployments are almost certainly under-governed.

The Fourth-Party Problem

Anthropic confirmed 80x demand growth against 10x planned capacity. The observable consequence: a capacity deal placing Claude inference onto Colossus 1, a 220,000+ GPU cluster owned by the merged SpaceX/xAI entity. That entity's CEO has publicly called Anthropic "misanthropic and evil", and its developers were previously banned from Claude's API for suspected distillation.

Prompts, source code, and agentic workflows sent to Claude now transit infrastructure operated by a direct competitor with stated hostility toward the vendor. Most data-flow diagrams have not been updated. Most DPAs do not name xAI as a sub-processor. The trust boundary moved without notification.

Gemini Is Leaking PII From Training Data

Google Gemini is returning real phone numbers from its training corpus in production. One developer began receiving WhatsApp messages from strangers. A researcher reproduced the behavior by extracting a colleague's private cell. This is not prompt injection or jailbreak. It is training-data memorization surfacing in normal queries. Input sanitization does nothing. The exposure is architectural.

Any team that approved Gemini on the assumption outputs were synthetic gets to revisit that memo. Under GDPR, this is processing performed on data subjects who never consented.

EDR's Moat Just Evaporated

TrustedSec's Justin Elze ran LLMs against five commercial EDR products. All five share identical architecture: YARA-style rules, Lua behavioral engines decryptable in one pass, local ML classifiers, allowlists, and prefilters. Work that took skilled reverse engineers weeks now takes days with an LLM. Once extracted, rules, scoring thresholds, exclusion lists, and trust paths become inputs for targeted evasion.

Anthropic's capacity crisis made Elon Musk the landlord's landlord. A model vendor's upstream dependencies now include a counterparty with a documented history of altering platform terms on short notice.

The Telemetry Gap Is an Attack Surface

Anthropic ships no per-user telemetry by default and offers no SLAs. ServiceNow blew its full-year Anthropic budget. National Life Group cannot monitor employee usage. A compromised Claude account is indistinguishable from a legitimate one at the identity layer because the per-seat events do not exist. This is not a FinOps problem. It is a detection gap.