The Watch

The Situation

Three pre-auth critical vulnerabilities in edge and ingress infrastructure, disclosed in the same cycle. Any one of them justifies an emergency change window. Together they make this the most concentrated perimeter-risk window of 2026.

Why These Are Different

The NGINX bug went undetected for 18 years. It sits in the rewrite module, which is configured in the majority of production deployments. Unauthenticated. Edge-facing. Base case: mass scanning within 24 to 48 hours of PoC publication. The CMDB will not list every instance. Run active discovery across public IP ranges and internal subnets.

The Traefik pair is CVSS 10.0. Both are auth bypasses. Every service behind the ingress becomes reachable as if the ingress were not there. Any service delegating authentication to Traefik middleware is exposed. Remediation is two steps: patch Traefik and confirm downstream services enforce their own auth.

MOVEit is the rerun. In 2023, Cl0p exploited MOVEit Transfer via a comparable auth-bypass class and ran the campaign for months. Progress's recurrence rate is now a documented vendor-risk data point. Cl0p affiliates target this product line by name.

Five actively-exploited perimeter CVEs, an 18-year NGINX RCE, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

The Authentication-Bypass Pattern

The dominant failure mode this cycle is authentication bypass, not memory corruption. Traefik, MOVEit, cPanel, OpenCTI, Argo CD (CVE-2026-42880, 9.6, read-only users extracting plaintext K8s Secrets), and Microsoft ESTS all failed at the access-control layer. EDR will not catch these. Patching and authorization auditing are the only effective responses.

What Changed

The UK AI Security Institute has now empirically confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber complete full network takeover chains autonomously in controlled evaluations. Mythos cleared both of AISI's hardest tests. GPT-5.5-cyber cleared one. The prior generation topped out at 'advanced persistence.' Call it a step function, not an increment. AISI is already building harder evaluations because the current ones are saturating.

Separately, Microsoft's MDASH, a 100+ specialized agent system that scans, debates, and builds proof-of-concept exploits, surpassed Mythos on the CyberGym benchmark. XBOW partners reportedly surfaced thousands of high and critical vulnerabilities in weeks. We have been writing since the 2023 benchmarks that the cost of vulnerability discovery would collapse before defenders were ready. The collapse is here.

What This Means Operationally

The congressional access question is the policy layer worth tracking. Reporting indicates NSA is being prioritized over CISA for Mythos access. That routes the capability to offense and intelligence before civilian defenders see it. Budget and plan as if no government AI help arrives at parity with adversaries. It has not yet, in any cycle this desk has covered.

Frontier AI models now execute full network takeover autonomously. Gated access buys us months, not years, to rebuild detection around machine-speed adversaries.

Sources Agree and Diverge

Seven sources covered the theme. All agree the capability is real and validated. They diverge on imminence of threat to defenders. Some note that cyber ranges are bounded environments, unlike production networks with EDR and segmentation. A fair caveat, and the same one offered ahead of every prior capability jump. Others note the cost curve: what takes a junior operator days takes a model minutes at near-zero marginal cost. Consensus call: commodity threat actors will wield Mythos-class capability by late 2026, not just nation-states. Open-weight analogs from Chinese labs follow within 12 to 18 months.

Google's TAG also confirmed a hacking group used AI to build a functional cybercrime tool. That is the first public validation that post-Mythos weaponization is operational, not theoretical. Everything beyond it is still rumor, and worth treating that way until it is not.

The Fourth-Party Problem

Anthropic has confirmed 80x demand growth against a 10x capacity plan. Publicly: silent product degradation, Claude Code revoked mid-subscription, corporate accounts banned without notice. Less publicly: a capacity deal places Claude inference onto Colossus 1, a 220,000+ GPU cluster owned by the merged SpaceX/xAI entity. The CEO of that entity has on the record called Anthropic "misanthropic and evil."

Frame this correctly. It is not a procurement question. It is a data-flow problem. Prompts, source snippets, embedded customer data, and agentic workflows running through Claude now potentially transit infrastructure operated by a direct competitor, a hostile public critic, and a party previously banned from Claude APIs on distillation concerns. Same party, three hats.

The Enterprise Concentration Shift

Ramp puts Anthropic at 34.4% of enterprise spend versus OpenAI's 32.3%. Year-over-year, Anthropic quadrupled. OpenAI grew 0.3%. Most DLP rules, CASB policies, and DPA portfolios were drafted when ChatGPT was the assumed exposure. Claude traffic is now statistically the larger exfil channel in most environments. Parity controls, in most orgs, do not exist.

The detection picture is worse. Anthropic ships without per-user telemetry by default and without SLAs. ServiceNow burned its full-year Anthropic budget. National Life Group's CIO went on record: "great for consumer usage but not great for companies." A compromised Claude seat looks identical to a legitimate one. The per-seat events that would distinguish them require Admin API integration work that has not been done.

Anthropic's capacity crisis has made Elon Musk the landlord's landlord. Treat Claude as a concentrated, volatile dependency. Get sub-processor paperwork, a fallback model, and AI-code review gates in place this quarter.

The /goal Problem

Anthropic also shipped Claude Code /goal. The command runs fully autonomous, multi-turn coding sessions. No token budget cap. No per-tool human approval. Paired with Auto Mode, the result is a non-human developer identity with commit rights and shell access, judged only by a Haiku-based evaluator that reads the transcript without independently verifying file state. The evaluator is the last gate. It checks coherence, not truth.

CLAUDE.md files auto-load every turn. That makes them a high-value prompt-injection target. A malicious PR modifying that file achieves persistent prompt injection against every developer running /goal in the workspace. Treat the file as code with privileges.