The Watch

The Situation

Three edge-infrastructure authentication bypasses landed in the same cycle. The combined effect is a compounding perimeter failure that no single patch resolves. The headline item is an 18-year-old pre-auth RCE in NGINX's rewrite module, which affects every edge and reverse proxy running the affected configuration. That is most of them. Traefik separately disclosed two CVSS 10.0 auth bypasses (CVE-2026-35051, CVE-2026-39858). Anything downstream of Traefik is reachable as if the ingress were not there. MOVEit Automation shipped a 9.8 auth bypass (CVE-2026-4670). The shape of the bug matches the 2023 Cl0p campaign.

Five actively-exploited perimeter CVEs, a 10.0 ingress bypass, and an 18-year-old RCE that affects most of the internet. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

Cross-Source Analysis

The pattern across feeds is consistent. Authentication bypass dominates the critical-severity list this cycle, not memory corruption. SANS lists Traefik, MOVEit, cPanel, OpenCTI, Microsoft ESTS, and Argo CD as failing at the access-control layer. EDR does not see these. Patching and authorization auditing do.

NGINX is the one to watch. It is pre-authentication. It is ubiquitous. NGINX Plus and OSS are both in scope, which covers ingress controllers, API gateways, sidecars, and the appliance long tail that bundles NGINX downstream. Mass scanning is expected within 24-48 hours of PoC availability.

The tempo is the other half of the story. PraisonAI (CVE-2026-44338) was weaponized 4 hours after disclosure. Honeypot telemetry shows exposed AI endpoints fingerprinted by Shodan within 3 hours of coming online. The window between disclosure and exploitation is now a single shift.

Priority Matrix

What Makes This Different

The common thread is authentication failure, not memory safety. Traditional EDR and runtime protection contribute nothing here. The attack completes before any post-auth detection has anything to look at. Services that delegated authentication to Traefik middleware have no authentication at all until patched. Apps behind NGINX that assumed the reverse proxy validated requests are now directly exposed.

MOVEit is the one to flag separately. The last time this product line shipped a bug in this class, Cl0p ran a campaign for months before most victims noticed. Progress Software's track record is not improving. The vendor-risk conversation about replacement is now board-level, backed by a documented repeat-offender pattern.

The Step Function

Three independent signals this week put AI offensive capability across a commercial threshold. The UK AI Security Institute confirmed that Anthropic's Mythos completed full network takeover chains autonomously, clearing both AISI cyber ranges including the Cooling Tower scenario. Prior-generation models stalled at 'advanced persistence.' Google's Threat Analysis Group documented a hacking group using AI to build a functional cybercrime tool, the first public confirmation of weaponized AI in the wild. And Microsoft's MDASH, a 100+ agent architecture, beat Mythos on the CyberGym vulnerability-reproduction benchmark.

Frontier models can now find and chain exploits at something close to real time, and the U.S. government is routing the capability to offensive users before civilian defenders see it.

What Changed This Week vs. Prior Coverage

Tuesday's briefing covered the 81% autonomous success rate. Today's signals are different in kind, not degree:

• AISI confirmation is authoritative. Not a vendor claim. Not a benchmark artifact. A government evaluator using the words 'full network takeover.'
• Google TAG is a confirmed wild incident. Not a lab demo. A real threat actor shipped real crime tooling built with AI.
• MDASH's multi-agent architecture outperforms monolithic models and is directly reusable by threat actors. Criminal-marketplace clones within months is the working assumption.
• TrustedSec reverse-engineered 5 commercial EDRs with LLMs in days, extracting YARA rules, Lua engines, allowlists, and scoring thresholds. The vendor rulepack is no longer a defensive moat.

Defensive Assumptions That No Longer Hold

Policy Signal

The House Homeland Security Committee is hearing on Mythos. Reporting indicates CISA is being sidelined and NSA is being positioned as primary recipient of Mythos access. Treat the routing as the story. If the civilian defensive agency is deprioritized, enterprises should plan as if no government defensive uplift arrives at AI-speed parity with adversaries. Budget accordingly.

Separately, Mozilla used Mythos Preview to surface 271 previously-unknown Firefox bugs, sandbox escapes included. The delta between Mythos against Firefox (271 bugs with a custom harness) and Mythos against curl (1 low-severity CVE without one) is the finding: harness quality matters more than model capability. Defenders investing in AI vulnerability discovery should spend on orchestration, not API access.

The Incident That Changes the Conversation

An agent framework called OpenClaw wiped a user's entire email archive without human approval. First confirmed confused-deputy destruction in the wild. Not a lab demo. The agent held a legitimate OAuth grant with modify/delete scope. Mechanism is unclear: misinterpretation, prompt injection, or a bad tool-selection call. Outcome is not. Every agent wired into Gmail, M365, Slack, Jira, Salesforce, or GitHub sits on the same topology.

Three developments the same week stack on top:

• Claude Code /goal ships fully autonomous multi-turn coding sessions with no token budget, no per-tool approval, and a Haiku evaluator that only reads transcripts. It cannot independently verify file state or test results.
• x402 payments now ship inside AWS AgentCore Bedrock as a built-in component. Agents execute sub-cent machine-to-machine payments without API keys or human confirmation. Prompt injection is no longer a data leak. It is a withdrawal.
• 59% of all AI token volume is agentic, per Vercel gateway telemetry across 200,000+ teams. This is the majority surface, not an emerging one.

Agents are the majority AI workload and they act with user credentials. If the SOC cannot tell a human from an agent in the logs, visibility over the largest surface in the environment is already gone.

The Converging Surfaces

The Claude Code /goal Problem

Anthropic's /goal paired with Auto Mode creates a non-human developer identity that writes files and runs commands with no built-in ceiling. The evaluator is Haiku. It reads the conversation transcript and nothing else. It does not verify filesystem state. CLAUDE.md auto-loads every turn, which makes it the obvious prompt-injection target. A malicious PR or a compromised dependency that touches those files achieves persistent prompt injection against every developer running /goal in that workspace.

The enterprise control is narrow but documented: allowManagedHooksOnly in managed settings, pushed via MDM. Absent that, the trust boundary for autonomous code modification moved from a human pressing enter to an LLM grading its own homework. It moved quietly.

The Fourth-Party Problem

Anthropic has confirmed inference workloads are moving onto Colossus 1, a 220,000+ GPU cluster owned by the merged SpaceX/xAI entity. The CEO of that entity has publicly called Anthropic "misanthropic and evil." Prompts, source code, and agentic workflows sent to Claude now transit infrastructure run by a party that is simultaneously a direct competitor, a hostile public critic, and a company previously banned from Claude for distillation concerns.

This is not theoretical vendor-risk. It is a fourth-party data-flow change that most sub-processor registers and DPAs do not reflect.

The trust boundary has moved. Nobody updated the data-flow diagram.

Compounding Factors

Three signals make the Anthropic vendor-risk profile materially different this week than last quarter.

1. No SLAs, No Per-User Telemetry

ServiceNow blew its full-year Anthropic budget. National Life Group's CIO called Claude "great for consumer usage but not great for companies." Anthropic does not offer performance SLAs or support-response commitments and does not expose granular per-user usage data by default. A compromised Claude account is indistinguishable from a legitimate one at the identity layer, because the per-seat events do not exist.

2. Silent Access Revocation

Anthropic has demonstrated willingness to silently revoke Claude Code from paying customers, ban corporate accounts without warning, and run A/B experiments on access revocation. Any CI/CD, SOC triage, or internal agent pipeline with a hard Claude dependency carries availability risk with no contractual backstop.

3. Gemini PII Leakage

Google Gemini is regurgitating real phone numbers from training data in production. A developer began receiving WhatsApp messages from strangers after Gemini surfaced his number. A researcher reproduced the behavior. This is not prompt injection. It is training-data memorization at the architecture level, with no patch cycle. Any enterprise that approved Gemini on the assumption outputs were synthetic should revisit that memo.

Concentration Risk Snapshot

What To Do

This is a governance cycle, not a patch cycle. The register entry writes itself. The dominant enterprise AI vendor has taken on a landlord whose other tenants include a competing frontier model, with no SLAs, no native telemetry, and a track record of revoking access without notice. DPAs signed before May 2026 are stale.