The Ingress Layer Is Fictional Tonight, and Your AI Bill Is About to Prove It

The edge is unauthenticated until you say otherwise

An 18-year-old pre-auth RCE in NGINX's rewrite module and a CVSS 10.0 authentication bypass in Traefik (CVE-2026-35051, CVE-2026-39858) disclosed within days of each other. Both fire before your application middleware sees the request. The NGINX bug reaches back to code shipped in 2007 — vendored copies and appliance firmware are in scope, not just what apt tells you. PraisonAI, the point of comparison for tempo, went from CVE to working exploit in four hours yesterday.

If you delegate auth to the ingress — which most microservices deployments do — every service behind those proxies is running naked until both are patched. That is the entire sentence. There is no clever reading of it.

Patch order, tonight, in this sequence: NGINX first because the install base is roughly everything; Traefik second because the CVSS is 10.0 and the auth middleware chain is decorative until fixed; Argo CD third (CVE-2026-42880, 9.6, plaintext K8s secret extraction — rotate every secret in reachable namespaces, patching alone does not close the window); LiteLLM fourth if you run 1.81.16 through 1.83.7, and rotate every upstream provider key stored in its DB because CISA already put it on KEV. If MOVEit Automation is in the environment, treat CVE-2026-4670 as a timeline question — Cl0p specifically hunts that product line.

Yes, but — a competent security team will point out that NGINX rewrite is only exploitable in specific configurations, and Traefik ForwardAuth is not universal. Both true. Neither changes the triage order, because you find out which configurations you actually have by inventorying, and the inventory is the work.

The AI bill breaks June 15

On the same rough calendar, Anthropic converted every Claude subscription into dollar-matched API credits for programmatic usage. The $200 plan buys $200 of tokens. That's it. Teams running Claude through Cursor, Cline, OpenCode, Zed, Conductor, or any custom harness were extracting between three and ten times that in API-equivalent value. The subsidy was never a published SKU — it was a side effect of how native clients were billed, and third-party harnesses rode the same rail. The rail is gone June 15.

OpenAI answered the same afternoon with two months of free Codex for enterprise switchers, deadline July 13. Ramp's April data put Anthropic at 34.4% of business spend against OpenAI's 32.3% — the first documented lead change, and not the sort of number you leave lying around before Anthropic's likely October IPO.

The operational tell is ServiceNow burning its full-year Anthropic budget by May and being unable to say which users or workloads drove it. Anthropic ships no per-user telemetry, no per-tool telemetry, and no SLAs worth invoking. National Life Group's CIO put it on the record: great for consumer, not great for companies. If ServiceNow — with $9B in revenue and a dedicated FinOps function — cannot govern this passively, your team cannot either.

So the 30-day audit is not optional. Pull every Claude-backed workload — Agent SDK, GitHub Actions, batch evals, harness usage — and multiply projected token volume by API list rates. That is your new invoice. Do it before the finance conversation, not during it.

The layer worth building this week

Two things need to exist in your stack that probably don't. First, an LLM gateway (LiteLLM patched, Portkey, or your own) with per-tenant and per-feature token tagging and daily budget alerts. This is a sprint of work and it pays for itself the first time someone's runaway agent loop shows up in an alert instead of an invoice. Second, a provider-agnostic routing layer that lets you send reasoning to Opus-class models and utility calls — JSON extraction, classification, rewriting — to Flash or Haiku. Vercel's production data across 200,000 teams shows 59% of tokens are now agentic and the market has already bifurcated: Anthropic captures 61% of spend, Google captures 38% of volume. That's two different businesses, and treating them as one line item is why the budget breaks.

While you're in there, add trajectory-level metrics to your eval harness — tool-call precision, steps-to-completion, cost-per-successful-task. Single-turn accuracy scores the minority of your traffic. A planner that burns 40K tokens arguing with itself before producing the right answer looks identical to one that solves it in two calls, until the bill arrives.

What lands underneath all of it

UK AISI confirmed Anthropic's Mythos completed both of their hardest simulated attack ranges — full network takeover, not just persistence. Google TAG caught the first live threat actor using generative AI to build a functional cybercrime tool. TrustedSec reverse-engineered five commercial EDR products in days using LLMs and reported they share identical architecture: YARA rules, Lua engines readable after one decryption pass, allowlists. The rulepack is not a moat anymore.

The 30-day patch SLA that was defensible in 2022 is indefensible now. Seven days is the new floor for internet-facing systems with a published CVE. The compensating controls that matter live above the endpoint — identity, network telemetry, behavioral analytics, out-of-band verification for anything that moves money or credentials. If your SIEM correlation windows assume hours of dwell time, they will miss chains that complete in minutes.

This week: inventory NGINX and Traefik and patch tonight. Rotate every Kubernetes secret Argo CD could reach. Instrument Claude spend before the June 15 meter change activates. Take OpenAI's Codex trial and run it against your three highest-value workflows — the eval is free and produces leverage whether you switch or not. Everything else is next sprint.