Three pre-auth edge bugs, one four-hour exploit window, one honest week

NGINX disclosed an unauthenticated RCE in its rewrite module that has been sitting in the tree for eighteen years. Traefik shipped two CVSS 10.0 auth bypasses the same day. MOVEit disclosed a 9.8 pre-auth bypass in the same product line Cl0p ransacked in 2023. All three sit at the perimeter. All three require no credentials. Behind them, Argo CD (9.6) hands out plaintext Kubernetes secrets, LiteLLM landed on CISA's KEV, Apache Iceberg (9.9) lets an attacker redirect table metadata to their own S3 prefix, and PraisonAI went from disclosure to a working exploit in four hours.

The patching order is not the interesting part of this week. The exploit tempo is.

The four-hour number is the whole story

Four hours is shorter than most on-call handoffs. Shorter than the average change-approval board. Shorter than the time between a vendor advisory landing in an inbox and a human reading it. A 30-day critical patch SLA — the number that still sits in most enterprise security policies — was calibrated for an adversary that needed weeks to weaponize a disclosure. That adversary retired this year.

The UK AI Security Institute confirmed the trajectory in the same cycle. Anthropic's Mythos cleared both of AISI's hardest ranges — full autonomous network takeover, not just persistence. GPT-5.5-cyber cleared one. Palo Alto's AI-driven scanning surfaced serious vulnerabilities across 130+ products. Google's threat-intel team has now confirmed AI-built cybercrime tooling in the wild, which moves this out of the lab-result column and into the incident column.

Yes, but — the counter-reading is that cyber ranges are instrumented, bounded, and nothing like a real production network with legacy VLANs and dead firewalls. That's true. It also doesn't matter for the number that changed. What AISI validated isn't that Mythos will pwn your DMZ tomorrow. It's that automated disclosure-to-exploit pipelines exist, they run at machine speed, and PraisonAI is the receipt.

Harnesses do the work, not models

The most useful data point of the week is Mozilla's. A Mozilla security engineer wrapped Claude Mythos Preview in a custom agentic harness — one that produces reproducible test cases, scales across ephemeral VMs, and integrates with their existing security lifecycle. It surfaced 271 bugs in Firefox 150, including use-after-frees, sandbox escapes, and race conditions the fuzzers had missed for years. Daniel Stenberg pointed the same model at curl with a generic scan and got one low-severity CVE and four false positives.

Same weights. 270× yield gap. The variable was the harness.

That ratio is the answer to every AI security procurement question this year. Detection-rule IP is becoming commodity input — TrustedSec reverse-engineered five commercial EDR products in days using LLMs, and all five shared the same architectural furniture. The moat is not model access. It's the orchestration, the bug corpus, the triage pipeline, the specific-to-your-codebase context. Fund harnesses. Not wrappers.

The economics under the exploit tempo

On June 15 Anthropic ends the 70–90% implicit subsidy on Claude usage routed through Cursor, Cline, Zed, and OpenCode. Subscriptions convert to dollar-matched API credit pools. Third-party tools get a separate cap, then billed at list. ServiceNow already burned its full-year Anthropic budget by May with no per-user telemetry to explain which tenant or feature did the burning. Vercel's production data across 200K teams shows 59% of tokens are now agentic — the workload class that runs 5–15× heavier per task than single-shot completions.

Two assumptions broke simultaneously. Cost models built on subsidized subscription tokens are wrong by a multiple, not a margin. Eval harnesses that score single-turn completions are measuring the 41% minority of your traffic. OpenAI countered inside the day with two months of free Codex for enterprise switchers, expiring in 30 days.

The security read on the same event is different and worth naming. Anthropic just quietly became the plurality AI vendor in most enterprises (Ramp puts it at 34.4% vs OpenAI's 32.3%) while routing production inference through xAI's Colossus 1 — a competitor's infrastructure, run by a CEO who publicly called Anthropic "misanthropic and evil." Most DLP, CASB, and sub-processor registers still enumerate OpenAI endpoints only. The larger unmonitored egress channel isn't the one your policy names.

What to do this week

One concrete move, and it's the same move whether you sit on the security side, the platform side, or the finance side: compress your critical patch SLA from 30 days to 72 hours for anything internet-facing, and instrument the pipeline that would make 72 hours physically possible by Friday.

That means active discovery for every NGINX instance across public and internal subnets — the CMDB will not have them all, because the bug is 18 years old and predates half of them. It means an egress rule that treats api.anthropic.com and the Claude Code CLI as first-class monitored endpoints, at parity with OpenAI. It means a change-approval path that can push an edge patch in an afternoon without three signatures. It means a per-tenant, per-feature token attribution dashboard sitting behind an LLM gateway — LiteLLM if it's patched, Portkey if it's not — because the next ServiceNow-scale budget blowout is already accruing silently in someone's April traces.

The patching, the pricing reset, and the AISI result are the same event viewed from three angles: the window between something being knowable and something being exploitable is now measured in hours, and nothing about your operating cadence assumes hours. Fix the cadence. The specific bugs will keep coming.