NGINX Rewrite Module Hides 18-Year Unauthenticated RCE

The Capability Jump

The UK AI Safety Institute confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber hit "full network takeover" in controlled hacking tests. Prior-generation ceiling was "advanced persistence." Persistence means you keep a foothold. Takeover means you own the domain. Full takeover is a catastrophe, and the gap between the two is not incremental.

AISI is now developing harder benchmarks because the current suite is being saturated. That tells you the capability curve hasn't plateaued.

Mythos cleared both of AISI's hardest challenges. GPT-5.5-cyber cleared one. That is above the prior doubling trend on AI cyber task capability, not on it.

Three Confirming Signals

• Palo Alto Networks pointed frontier models at 130+ products and got dozens of serious vulnerabilities. Real exploitable bugs in shipping code, found at machine pace.
• Microsoft MDASH runs 100+ specialized agents in scan/debate/exploit stages. It surfaced 16 exploitable Windows vulnerabilities patched in one Patch Tuesday.
• Google researchers documented attackers building cybercrime tools with AI in the wild. Operational, not theoretical.

The Foxconn Case Study

Nitrogen ransomware hit Foxconn's North American manufacturing. 8TB exfiltrated before encryption fired. 8TB implies weeks of dwell time and enough egress headroom that nothing flagged it. Detection missed it. Segmentation did not contain it. DLP did not fire on the transfer. If one compromised node reaches 8TB without an alert, the problem is in the design, not the tooling.

What This Changes

The time constants in most threat models are wrong. The working assumption has been 30-90 days from CVE publication to widespread exploitation. For anything an AI can chain, that window is hours to days. The PraisonAI auth bypass went from disclosure to active exploitation in 4 hours. Either attackers pre-positioned against specific targets, or there is an automated weaponization pipeline turning advisories into working exploits in under 4 hours. Both are bad.

Defensive Architecture Implications

If the adversary runs at machine speed, the detection-to-response loop has to as well. First-line defenses (network segmentation, credential scoping, anomaly-triggered isolation) must fire without human approval for containment. The NSA getting Mythos access over CISA tells you how governments are reading this: offensive first, defensive second. Assume undisclosed 0days in the stack.

The Architecture You Need to Understand

Claude Code's /goal command runs multi-turn coding sessions to completion without human checkpoints. A separate Haiku model decides when the goal is met. The critical design choice: the evaluator only reads the conversation transcript. It cannot stat a file, run the test suite, or check that the diff compiles.

If the coding model claims the migration ran and the tests pass, and the transcript is internally consistent, that is a satisfied goal. Whether the repo is actually in that state is a separate question the evaluator is not equipped to answer.

The Cost Failure Mode

There is no built-in token budget. The loop terminates when the evaluator says terminate, or when something upstream kills it. Context grows each turn. Each turn pays for cumulative context. A loop that looks like progress at turn five is a $200 invoice at turn forty. The 4,000-character goal condition is the only built-in control. The official guidance to include a time cap inside it is the floor, not the ceiling.

What Works

Four composable controls make this production-usable.

1. Process-level wrapper: wall-clock timeout plus a token meter via the status endpoint (F26). SIGTERM when cumulative input tokens cross a threshold you picked on purpose. One engineer-hour to set up.
2. PostToolUse hooks: run lint and type-check after every edit. Output lands in the next context window. The agent self-corrects or the loop signals failure.
3. External verification: run the real test suite in a post-step instead of trusting the transcript. pytest -k X exit code is truth. The evaluator's reading of the transcript is not.
4. Branch isolation: hard file allowlist on a scratch branch. A runaway session that cannot touch main is a story, not an incident.

Composability Pattern

PostToolUse hooks plus Auto Mode plus /goal gives a self-correcting loop: agent writes, linter fires, output enters context, agent fixes, proceeds. For well-scoped refactors (migrating one API pattern, upgrading the test framework, converting type annotations) this is genuinely powerful. "Well-scoped" is carrying the sentence. Compound objectives break it.

Start Here

Begin with read-heavy goals: changelog generation, pattern analysis, documentation. Failure blast radius is low. Move to write-heavy goals (refactors, migrations) only after CLAUDE.md guardrails, PostToolUse hooks, process-level timeouts, and a test suite verified to catch breakage are all in place.