ClarityBeta

Security & Threat Intelligence

The Watch

7 min read · 1,429 words · 4 moves to watch
The Signal

NGINX disclosed an 18-year-old unauthenticated RCE in the rewrite module today

Traefik shipped two CVSS 10.0 auth bypasses on the same day, and MOVEit pushed a 9.8 auth bypass whose shape matches the 2023 Cl0p campaign. Patches are out. Mass scanning on NGINX is expected within 24 to 48 hours, which is the operative number.

In Play

  1. Perimeter Authentication Collapse: Three Critical Bypasses in 48 Hours

    NGINX (18yr pre-auth RCE), Traefik (CVSS 10.0 auth bypass), and MOVEit (9.8 auth bypass) all disclosed within the same cycle. Five additional CVEs hit CISA KEV in 10 days including PAN-OS 9.8 and Ivanti EPMM. The common thread: authentication bypass, not memory corruption — EDR is blind to these.

    Ask Clarity

  2. AI Offensive Capability Crosses Operational Threshold

    AISI confirmed Mythos achieves full autonomous network takeover — a step-function from 'advanced persistence.' Google TAG documented the first AI-built cybercrime tool in the wild. Microsoft's MDASH beat Mythos on CyberGym. PraisonAI was weaponized 4 hours after disclosure. The 30-day patch SLA is now structurally indefensible.

    Ask Clarity

  3. Agentic AI Is Now the Majority Attack Surface

    Agentic workloads hit 59% of all AI token volume. Claude Code /goal ships fully autonomous coding with no human review. AWS Bedrock now includes x402 agent-to-agent payments by default. AI agents bypass bot detection 81% of the time. Gemini Intelligence grants screen-reading and auto-purchase authority to every Android. The governance layer is a quarter behind the capability layer.

    Ask Clarity

  4. Windows Zero-Days: Unpatched and Unmitigated

    Two new Windows zero-days from the same anonymous researcher: a BitLocker full-disk encryption bypass and a CTFMON local privilege escalation. No CVE numbers. No patches. No timeline from Microsoft. Every SOC 2/HIPAA narrative built on 'BitLocker encrypts data at rest' now carries an asterisk. Compensating controls only.

    Ask Clarity

  5. AI Vendor Trust Boundaries Dissolve

    Anthropic's inference now runs on xAI's Colossus 1 cluster — prompts transit a competitor's hardware. Google Gemini is regurgitating PII (phone numbers) from training data with no patch possible. Anthropic overtook OpenAI in enterprise share (34.4% vs 32.3%). The sub-processor chain, the data-handling assumptions, and the DLP scope all need rewriting.

    Ask Clarity

Deep Dives

Perimeter Under Siege: NGINX, Traefik, and MOVEit All Fell Today

Three Authentication Bypasses, One Cycle

The pattern this cycle is not memory corruption. It is authentication failure at the edge. Three products that gate access to downstream services disclosed critical bypasses inside the same window. EDR will not catch any of them. The defect lives in access-control logic, not in executable behavior.

ProductCVE / CVSSMechanismBlast RadiusPatch Status
NGINX rewrite moduleNo CVE yet / ~9.8Pre-auth RCE, 18 years oldEvery edge, reverse proxy, ingress controllerVendor advisory imminent
TraefikCVE-2026-35051, -39858 / 10.0Auth bypass — downstream exposed as if ingress absentEvery service delegating authN to TraefikAvailable
MOVEit AutomationCVE-2026-4670 / 9.8Auth bypassFile transfer infrastructureAvailable (2025.1.5+)

Why NGINX Is the Priority

The NGINX bug is pre-authentication, 18 years old, and affects both NGINX Plus and Open Source. The rewrite module is on in the vast majority of production configurations. Eighteen years means every version ever deployed in the environment is in scope. Mass scanning is the base case 24 to 48 hours after advisory publication. The CMDB will not list every instance. Run active discovery across public IP ranges, internal subnets, and container images.

Why MOVEit Matters Again

Last time MOVEit had a bug in this severity class, the Cl0p campaign ran for months before most victims noticed. The 2023 campaign hit hundreds of organizations. Progress Software's track record is not improving. If MOVEit Automation is still in the environment, the product-replacement conversation at the board is now a documented vendor-risk data point, not a hypothetical.

The Five KEV Additions Compound This

CISA added PAN-OS (9.8, CVE-2026-0300), Ivanti EPMM, cPanel, LiteLLM, and Linux kernel algif_aead to KEV in ten days. KEV means active exploitation, confirmed. Combined with the three new disclosures, this is the densest perimeter-threat window since Log4Shell.

Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

What to do

  1. Run active discovery for all NGINX instances (edge, internal, sidecars, ingress controllers, appliances) and deploy emergency patch within 24 hours. Disable rewrite module or add WAF virtual-patching rules as interim control.

  2. Audit all Traefik deployments and identify every downstream service relying on Traefik for authentication enforcement. Patch CVE-2026-35051 and -39858 today. Validate app-layer auth exists for sensitive services even after patching.

  3. Patch MOVEit Automation to 2025.1.5/2025.0.9/2024.1.8 immediately. In parallel, escalate the product replacement conversation — this is the third critical-class bug in 3 years.

  4. Verify PAN-OS User-ID Authentication Portal patched for CVE-2026-0300. If internet-exposed and unpatched after 2026-05-06, initiate IR assuming compromise.

  5. Patch Ivanti EPMM (CVE-2026-6973) and run retrospective hunt for pre-patch exploitation patterns from last 30 days.

AI-Driven Exploitation Goes Live: Four Hours From Disclosure to Weapon

The Capability Is No Longer Theoretical

Three independent confirmations this week that AI offensive capability crossed the operational threshold:

  1. UK AISI confirmed Claude Mythos clears full autonomous network takeover, including the Cooling Tower range. First model to do so. Prior models stalled at advanced persistence.
  2. Google TAG documented the first in-the-wild case of a threat actor using AI to build a functional cybercrime tool.
  3. PraisonAI CVE-2026-44338 went from disclosure to weaponized exploit in four hours. The pipeline is automated and pointed at AI agent frameworks.

Adjacent data points. Microsoft's MDASH multi-agent system, 100+ specialized agents, outperformed Mythos on the CyberGym benchmark. Palo Alto's scanning work with Mythos surfaced dozens of serious vulnerabilities across 130+ products.

What This Changes for Defenders

AssumptionPre-This-WeekPost-This-Week
Critical CVE patch SLA7–30 days acceptableHours-to-days required; n-day behaves like 0-day
Responsible disclosure window90 days standardAttackers rediscover independently before patch
Pentest cadenceAnnual or semi-annualContinuous; AI-augmented red-team baseline
Attacker dwell timeHours to daysMinutes — sub-hour kill chains plausible

The Government Is Routing This to Offense

Congressional reporting puts NSA, not CISA, at the front of the line for Mythos-class capability. Civilian critical-infrastructure uplift is delayed. Budget and plan as if no government help arrives at AI parity with adversaries.

Sources Disagree on Timeline

Publicly: Mythos cleared the ranges, and several outlets read that as proof the threat is here. Less remarked on: cyber ranges are instrumented, bounded, and built to be solved. Production networks with EDR, segmentation, and SOC monitoring are not. The honest read is that the capability exists in lab conditions, and the leap to production is not a wall, but not a straight line either. Assume private hands within the year. Plan accordingly.

AI-driven exploitation crossed the near-real-time threshold this week. Any security program still operating on 30-day patch SLAs and annual pentests is structurally behind the threat curve.

What to do

  1. Compress critical CVE patch SLA from 30 days to 7 days for internet-facing systems and from 90 to 30 for high-value internal assets. Re-baseline exception process against the new timeline.

  2. Commission a red-team engagement using frontier model capability (Mythos Preview or GPT-5.5) against a scoped segment of your codebase. Measure time-to-first-finding versus current SAST/pentest baselines.

  3. Add 'AI-augmented adversary' as a named threat category in the enterprise risk register. Brief the board using AISI's capability trend and Mythos results as authoritative references.

  4. Update detection engineering to assume sub-hour dwell times. Tune SIEM correlation windows, velocity analytics, and alert latencies against compressed kill chains.

Agentic AI Reached 59% of Traffic — Your Governance Is Watching the Minority

Agentic Traffic Is Now The Majority

Vercel's production telemetry across 200,000+ teams puts 59% of all AI token volume in agentic workloads — programs calling APIs on behalf of humans, or on behalf of other programs. Agentic is the majority surface, and most SOCs have no detection coverage for it.

Three releases this week, all expanding what agents can do without a human in the loop:

  • Claude Code /goal + Auto Mode: Fully autonomous multi-turn coding sessions. No token cap or per-tool approval; the action ceiling is whatever the model decides. The evaluator (Haiku) reads the conversation transcript and nothing else. It cannot independently verify system state.
  • AWS Bedrock AgentCore + x402: Machine-to-machine payments over HTTP 402 are now a default capability of any Bedrock agent. A successful prompt injection now moves money out via x402.
  • Google Gemini Intelligence: Ships summer 2026 on Galaxy S26 and Pixel 10 with screen-reading, app-navigating, and auto-purchase authority on every corporate Android device.

The Detection Gap Is Structural

AI agents act with user OAuth tokens. Downstream systems see legitimate users. Every detection tuned to human behavioral baselines produces false negatives against agent traffic that operates at machine speed but carries human identity. The 81% bot-detection bypass rate measured against LLM-orchestrated headless browsers means CAPTCHA, UA heuristics, and most behavioral fingerprinting are statistically useless.

SurfacePrimary ThreatDetection Gap
Claude Code /goalUnattended code writes, credential exposure, supply-chain injection via CLAUDE.mdNo standard EDR rule for long-running no-human-input Claude sessions
x402 in BedrockPrompt injection → financial exfiltration (USDC, irreversible)DLP/CASB cannot inspect x402 traffic; default enabled
Gemini IntelligenceIndirect prompt injection via screen content → auto-purchaseMDM policies not yet updated for agent autofill and auto-browse
MCP servers (ServiceNow, SAP, Salesforce)Agent credential theft, over-permissioned workflow executionMost CASB/API tools don't classify MCP traffic

The Incident Is Not Hypothetical

Publicly: an agent framework, OpenClaw, wiped a user's entire email archive this week without human approval. That is a live confused-deputy failure, not a tabletop scenario. Every agent with modify or delete scope in Gmail, M365, Slack, Jira, or GitHub has the same topology.

Agents are the majority AI workload and they act with user credentials. If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface area in the environment is already gone.

What to do

  1. Inventory every OAuth grant and API token issued to an LLM agent or agent framework (Claude Code, OpenClaw, Codex, MCP servers). Remove modify/delete scopes where only read is needed. Complete within 2 weeks.

  2. Push managed Claude Code settings via MDM that set allowManagedHooksOnly and prohibit /goal and Auto Mode in repositories touching production credentials, signing keys, or regulated data.

  3. Audit AWS Bedrock AgentCore deployments for x402 payment capability. Disable by default. Block outbound wallet interactions at egress for agents that don't explicitly need financial authority.

  4. Deploy SIEM detection rules for agentic traffic patterns: multi-step tool calls from single sessions, mass-delete/modify operations from service principals, high-volume downstream API calls from LLM user-agents.

  5. Draft mobile AI agent policy restricting Gemini Intelligence autofill and auto-browse on MDM-managed devices before summer 2026 fleet refresh.

Your AI Vendor's Landlord Is Their Competitor: The Fourth-Party Trust Problem

Anthropic's Infrastructure Now Runs on Musk's Hardware

Anthropic confirmed capacity growth of 80x against a 10x plan. The stated fix: a compute agreement routing Claude inference through Colossus 1, the 220,000+ GPU cluster (H100/H200/GB200) operated by the merged SpaceX/xAI entity. That entity's CEO has publicly called Anthropic "evil" and was previously banned from Claude's API over distillation concerns.

Any organization sending prompts, source code, or customer data to Claude is now transiting infrastructure operated by a direct competitor with stated hostility toward the vendor. The trust boundary moved. The data-flow diagrams did not.

Gemini Is Leaking PII From Training Data

Google Gemini is returning real phone numbers from its training corpus in routine queries. One software developer began receiving WhatsApp messages from strangers. A university researcher reproduced the behavior by extracting a colleague's private cell. This is training-data memorization, not prompt injection or jailbreak. Structural, not patchable.

Under GDPR, that is processing performed on data subjects who never consented. Liability cascades to any controller using Gemini without a DPIA that explicitly names memorization risk.

Anthropic Overtakes OpenAI in Paying Business Seats

Ramp data puts Anthropic at 34.4% of paying business customers, OpenAI at 32.3%. Enterprise adoption has quadrupled YoY. Most CASB allow-lists, DLP rules, and AI gateways were written when ChatGPT was synonymous with 'LLM risk.' Claude is statistically the larger egress channel now, and most shops have no parity coverage for it.

Risk VectorSignalYour Exposure
Fourth-party hostingClaude inference on xAI/SpaceX Colossus 1GDPR Art. 28 sub-processor notification; DPIA refresh
Gemini PII leakagePhone numbers returned in normal queriesAny Workspace/Vertex deployment; no patch exists
Vendor concentration shiftAnthropic 34.4% > OpenAI 32.3%DLP/CASB rules under-cover the majority provider
Availability volatilitySilent Claude Code revocations, corporate bansCI/CD and SOC pipelines with hard Claude dependency
Anthropic's capacity crisis made Elon Musk the landlord's landlord. Claude is a concentrated, volatile dependency. Most shops lack sub-processor coverage, a fallback model, or egress parity. None of those are quick.

What to do

  1. File a formal inquiry with Anthropic confirming whether Colossus 1 hosts inference for your tenant, what data classes transit it, and whether xAI personnel have any access path. Update the fourth-party register.

  2. Enable output-side PII DLP scanning on all Gemini touchpoints (Workspace, Vertex AI, embedded features). File a DPIA addendum covering training-data memorization risk.

  3. Extend CASB/DLP/egress monitoring to cover api.anthropic.com, Claude Code CLI, and MCP endpoints at parity with OpenAI rules. Re-run top-talker report and confirm Anthropic appears.

  4. Document a Claude-off contingency: inventory every pipeline where 24-hour loss of Claude access causes business impact, and test one failover path this quarter.

The bottom line

Your perimeter is under simultaneous assault — an 18-year NGINX pre-auth RCE, Traefik at CVSS 10.0, and MOVEit bleeding a 9.8 auth bypass that Cl0p will find before you patch it — while AI-driven exploitation crossed the operational threshold (AISI-confirmed autonomous network takeover, Google-confirmed AI-built malware in the wild, 4-hour disclosure-to-exploit on PraisonAI) and 59% of your AI traffic is now agentic workloads running with user credentials that no SOC detection was built to distinguish from humans. Patch the edge tonight, compress your SLAs to days not months, and get agent governance in place before the majority of your AI traffic disappears from your visibility entirely.