The Watch

Three Critical Edge Disclosures in One Cycle

Three perimeter bugs landed this week. None were on last week's watch list. First: an 18-year-old unauthenticated RCE in NGINX's rewrite module, affecting NGINX Plus and Open Source. That covers every edge proxy, ingress controller, API gateway, and appliance bundling NGINX. Second: Traefik disclosed two CVSS 10.0 auth bypasses, CVE-2026-35051 and CVE-2026-39858. Any service delegating authentication to Traefik middleware is reachable as if the ingress were not there. Third: MOVEit Automation shipped a 9.8 auth bypass, CVE-2026-4670. Same product line, same bug class as the 2023 Cl0p campaign that hit hundreds of organizations over months.

The PraisonAI CVE-2026-44338 was weaponized four hours after disclosure. That is the tempo to plan around for every item on this list.

Why This Cluster Is Different

The common thread is authentication bypass, not memory corruption. EDR does not see these. The exploit surface is the access-control layer itself. Traefik's blast radius extends to every downstream service that assumed the ingress enforced authN. MOVEit has the precedent: the last bug in this class let Cl0p run for months before most victims noticed. NGINX's 18-year exposure window means the vulnerable configuration pattern is baked into infrastructure templates, Helm charts, and ansible roles that predate most security teams' tenure.

Prioritization Matrix

The Tempo Signal

PraisonAI sits in the LLM orchestration layer, where patch cadence runs in weeks. It was exploited in four hours. The NGINX disclosure is being tracked by the same adversary population. Historically, mass scanning on NGINX arrives within 24 to 48 hours of a working PoC. The enterprise change-management window of "next maintenance cycle" is measured in weeks. Wrong unit.

The NGINX inventory problem deserves emphasis: the CMDB is not enough. NGINX embeds inside Kubernetes ingress controllers, appliance firmware, SaaS vendor reverse proxies, and sidecar containers that were never registered. Active discovery across public IP ranges and internal subnets is required.

What AISI Actually Confirmed

The UK AI Security Institute has now empirically validated what red-team leads were saying in private channels. Anthropic's Mythos and OpenAI's GPT-5.5-cyber both completed full network takeover chains autonomously in AISI's controlled evaluation battery. Mythos cleared both of AISI's hardest tests. GPT-5.5-cyber cleared one. The prior generation topped out at 'advanced persistence.' A newer Mythos build reportedly succeeded 6/10 times versus 3/10 for the preview baseline. That is an intra-generation doubling.

Separately: Microsoft's MDASH, a 100+ specialized agent system that scans code, debates exploitability, and builds proof-of-concept exploits, beat Mythos on the CyberGym benchmark. XBOW reportedly surfaced thousands of high and critical vulnerabilities in weeks using frontier models. Google TAG confirmed a threat actor used AI to build a functional cybercrime tool. That is the first public attribution.

The thirty-day patch window that was defensible in 2022 is indefensible now for any internet-facing system with a published CVE. The seven-day window is the new floor.

What This Changes Operationally

Multiple sources converge on the same structural consequence. N-day vulnerabilities now behave like zero-days. Time from CVE publication to working exploit is compressing toward hours. Several defensive assumptions do not survive that shift:

The Congressional Signal

Congress is steering Mythos access toward NSA over CISA. The signal is offensive and intelligence prioritization over civilian defensive distribution. If NSA is the priority recipient, civilian critical-infrastructure uplift is delayed. Budget and plan as if no government help arrives at AI parity with adversaries.

Contradiction Worth Noting

Sources disagree on how close this is to real-world impact. AISI ran its evaluation on instrumented ranges, not production networks with EDR, segmentation, and a SOC. The leap from range to enterprise is not trivial. No source disputes the direction. They dispute the timeline. The reasonable planning assumption is 6-12 months before commodity threat actors wield Mythos-class capability. Nation-states are already there.

The Sub-Processor Nobody Reviewed

Anthropic confirmed 80x demand growth against a 10x capacity plan. The mitigation is a capacity deal that puts Claude inference on Colossus 1, a 220,000+ GPU cluster owned by xAI/SpaceX. The CEO of that company has publicly called Anthropic "misanthropic and evil." Prompts, source code, and customer data sent to Claude now transit infrastructure operated by a direct competitor on record as hostile to the vendor.

In the same window, Anthropic has demonstrated willingness to silently revoke Claude Code access from paying customers, ban corporate accounts without warning, and A/B test access revocation. That is not enterprise SaaS behavior. It is consumer-product behavior with an enterprise invoice attached.

Anthropic ships without per-user telemetry or SLAs. ServiceNow blew its full-year Anthropic budget in months. National Life Group's CIO called it "great for consumer usage but not great for companies."

The Market Share Flip Is a Security Event

Ramp puts Anthropic at 34.4% of enterprise AI spend versus OpenAI's 32.3%. Anthropic quadrupled year-over-year. OpenAI grew 0.3%. Most SOC telemetry, DLP rules, and CASB policies were written when ChatGPT was the synonym for "LLM risk." Claude is now statistically the larger exfiltration channel. Most organizations have no parity monitoring for it.

Control Gaps at Scale

Claude Code /goal: A Non-Human Identity With Push Rights

Anthropic shipped /goal: fully autonomous multi-turn coding sessions, no token budget cap, no per-tool human approval. Paired with Auto Mode it is a non-human developer identity that writes files and executes commands with no human in the loop. The evaluator, Haiku, reads the conversation transcript. It cannot independently verify file state or test results.

CLAUDE.md auto-loads every turn. That makes it a high-value prompt-injection target. A malicious PR or compromised dependency that rewrites this file achieves persistent prompt injection against every developer running /goal in that workspace. The injection survives session boundaries until someone reads the diff.

Enterprise Controls That Exist

Managed settings with allowManagedHooksOnly and disableAllHooks are documented but require active MDM enforcement. Without that enforcement, autonomous code modification is one developer settings toggle away from production.