NGINX, Traefik, MOVEit Drop Pre-Auth RCEs in One Window

Three Data Points That Change Defensive Assumptions

This week produced the evidence base that moves AI-assisted offense from tabletop scenario to validated operational capability. Three data points converge:

1. UK AI Security Institute confirmed that Anthropic's Mythos and OpenAI's GPT-5.5-cyber both complete full network takeover chains autonomously — the prior ceiling was 'advanced persistence.' Mythos cleared both of AISI's hardest evaluations.
2. Microsoft's MDASH (100+ specialized agents) surpassed Mythos on the CyberGym benchmark, demonstrating a scan → adversarial debate → proof-of-concept construction pipeline that is directly reusable by threat actors.
3. PraisonAI CVE-2026-44338 was weaponized 4 hours after public disclosure, confirming that the disclosure-to-exploit window has compressed below a single work shift for AI-adjacent infrastructure.

What 'Full Network Takeover' Actually Means

AISI's evaluation measures an LLM autonomously chaining reconnaissance, vulnerability discovery, exploitation, privilege escalation, lateral movement, and objective achievement against a target environment. This is not a single-shot CTF solve. It is an end-to-end intrusion chain without a human in the loop.

Congress is steering Mythos access toward NSA over CISA, signaling offensive/intelligence prioritization over civilian defensive distribution. Budget and plan as if no government uplift arrives at parity with adversaries.

AI-driven exploitation crossed the near-real-time threshold this week. The 30-day patch SLA was defensible in 2022. The 7-day SLA is the new floor, and for actively exploited bugs it is already too slow.

Sources Agree and Disagree

All seven sources covering this story agree the capability is real and validated. They diverge on timeline to commodity availability. Google's threat tracker has already confirmed a threat actor using AI to build a cybercrime tool — the first public validation of weaponization fears. Multiple sources expect open-weight analogs reaching adversary hands within 12-18 months. AISI is building harder evaluations because current benchmarks have saturated. The gap between demonstration and deployment is narrowing faster than any prior cycle.

The Supply-Chain Realignment Nobody Updated the DPA For

Anthropic has confirmed 80x demand growth against a 10x capacity plan. Two effects are now observable. The first is silent product degradation: Claude Code revoked mid-subscription, corporate accounts banned without warning, A/B experiments running on access itself. The second is a capacity deal that places Claude inference onto Colossus 1, a 220,000+ GPU cluster owned by the merged SpaceX/xAI entity.

The operational fact is unambiguous. Prompts, source code snippets, embedded customer data, and agentic workflows routed through Claude may now transit infrastructure owned by a party that is simultaneously a competitor, a hostile public critic ('misanthropic and evil'), and previously banned from Claude on distillation concerns. This is fourth-party risk. Almost no vendor questionnaire currently captures it.

Three Concurrent Vendor-Risk Failures

The exposure is not abstract. Anthropic is now the #1 enterprise AI vendor, at 34.4% of paying business customers per Ramp data, against OpenAI's 32.3%. Most shadow-AI controls, DPAs, and CASB rules were written when ChatGPT was synonymous with 'LLM risk.' Claude traffic is statistically the larger exfiltration channel in most enterprises, and parity rules for it do not exist.

Anthropic's capacity crisis has made Elon Musk the landlord's landlord. Sub-processor paperwork, fallback routing, and detection parity are not in place at most enterprises this quarter.

The Telemetry Gap Is an Attack Surface

Multiple enterprise customers confirm Anthropic ships without per-user telemetry or SLAs. ServiceNow blew its full-year Anthropic budget in months. National Life Group's CIO has stated the product is 'great for consumer usage but not great for companies.' Without per-user event data, four detection scenarios fail at once: stolen session cookies, insider prompt-based exfiltration, compromised API keys running automated scraping, and departing-employee data theft via conversation history. The Claude Admin API exists, but it requires active integration work. Finance is discovering these gaps before Security is.