The Watch

The Perimeter Failed in Three Places at Once

Three pre-authentication bypasses landed on internet-facing infrastructure in the same patch cycle. Any one of them justifies an emergency change window. Together they are the worst edge-security week since the Fortinet and Ivanti campaigns of early 2025.

Why These Three Converge Into One Problem

The shared failure mode is authentication bypass, not memory corruption. EDR, SIEM, and network-anomaly tooling is tuned for post-exploitation behavior. When the ingress itself is fictional, as with Traefik's 10.0, everything downstream is reachable as if no gateway exists. Services that delegated auth to Traefik middleware now have zero authentication until patched.

NGINX compounds the problem through ubiquity. The bug sat in the rewrite module for 18 years. NGINX fronts ingress controllers, API gateways, reverse proxies, load balancers, and the long tail of appliances that bundle it silently. The CMDB does not have the full count. Active discovery across owned IP ranges is the only reliable inventory.

MOVEit is the pattern match that should trigger board notification. The 2023 Cl0p campaign hit hundreds of organizations through the same product line. Progress Software's track record has not improved since. If MOVEit Automation is still in the environment, assume compromise is measured in weeks.

Five actively-exploited perimeter CVEs, a Netlogon preauth RCE on every domain controller, and a 10.0 ingress bypass that makes Traefik auth-delegation fictional. Most shops will patch Netlogon first and MOVEit last. Cl0p will work the list in reverse.

Argo CD: The Kubernetes Secrets Bleed

CVE-2026-42880 gets separate treatment because it is a missing-authorization bug, not a memory-corruption bug. Any user with read-only RBAC in Argo CD can extract plaintext Kubernetes Secrets. EDR will not see it. Detection requires Argo CD audit-log analysis for unusual Secret reads. Most SOCs are not running that query. Assume every K8s Secret managed by Argo CD has been readable by the broadest user set since the vulnerable version shipped.

Three Data Points That Change Defensive Assumptions

This week produced the evidence base that moves AI-assisted offense from tabletop scenario to validated operational capability. Three data points converge:

1. UK AI Security Institute confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber both complete full network takeover chains autonomously — the prior ceiling was 'advanced persistence.' Mythos cleared both of AISI's hardest evaluations.
2. Microsoft's MDASH (100+ specialized agents) surpassed Mythos on the CyberGym benchmark, demonstrating a scan → adversarial debate → proof-of-concept construction pipeline that is directly reusable by threat actors.
3. PraisonAI CVE-2026-44338 was weaponized 4 hours after public disclosure, confirming that the disclosure-to-exploit window has compressed below a single work shift for AI-adjacent infrastructure.

What 'Full Network Takeover' Actually Means

AISI's evaluation measures an LLM autonomously chaining reconnaissance, vulnerability discovery, exploitation, privilege escalation, lateral movement, and objective achievement against a target environment. This is not a single-shot CTF solve. It is an end-to-end intrusion chain without a human in the loop.

Congress is steering Mythos access toward NSA over CISA, signaling offensive/intelligence prioritization over civilian defensive distribution. Budget and plan as if no government uplift arrives at parity with adversaries.

AI-driven exploitation crossed the near-real-time threshold this week. The 30-day patch SLA was defensible in 2022. The 7-day SLA is the new floor, and for actively exploited bugs it is already too slow.

Sources Agree and Disagree

All seven sources covering this story agree the capability is real and validated. They diverge on timeline to commodity availability. Google's threat tracker has already confirmed a threat actor using AI to build a cybercrime tool — the first public validation of weaponization fears. Multiple sources expect open-weight analogs reaching adversary hands within 12-18 months. AISI is building harder evaluations because current benchmarks have saturated. The gap between demonstration and deployment is narrowing faster than any prior cycle.

The Supply-Chain Realignment Nobody Updated the DPA For

Anthropic has confirmed 80x demand growth against a 10x capacity plan. Two effects are now observable. The first is silent product degradation: Claude Code revoked mid-subscription, corporate accounts banned without warning, A/B experiments running on access itself. The second is a capacity deal that places Claude inference onto Colossus 1, a 220,000+ GPU cluster owned by the merged SpaceX/xAI entity.

The operational fact is unambiguous. Prompts, source code snippets, embedded customer data, and agentic workflows routed through Claude may now transit infrastructure owned by a party that is simultaneously a competitor, a hostile public critic ('misanthropic and evil'), and previously banned from Claude on distillation concerns. This is fourth-party risk. Almost no vendor questionnaire currently captures it.

Three Concurrent Vendor-Risk Failures

The exposure is not abstract. Anthropic is now the #1 enterprise AI vendor, at 34.4% of paying business customers per Ramp data, against OpenAI's 32.3%. Most shadow-AI controls, DPAs, and CASB rules were written when ChatGPT was synonymous with 'LLM risk.' Claude traffic is statistically the larger exfiltration channel in most enterprises, and parity rules for it do not exist.

Anthropic's capacity crisis has made Elon Musk the landlord's landlord. Sub-processor paperwork, fallback routing, and detection parity are not in place at most enterprises this quarter.

The Telemetry Gap Is an Attack Surface

Multiple enterprise customers confirm Anthropic ships without per-user telemetry or SLAs. ServiceNow blew its full-year Anthropic budget in months. National Life Group's CIO has stated the product is 'great for consumer usage but not great for companies.' Without per-user event data, four detection scenarios fail at once: stolen session cookies, insider prompt-based exfiltration, compromised API keys running automated scraping, and departing-employee data theft via conversation history. The Claude Admin API exists, but it requires active integration work. Finance is discovering these gaps before Security is.