The AI-First Web

Three research disclosures in three months show coding agents executing the malicious code they were sent to review.

Automox's MCP Server update lets AI agents create patch policy with a human review gate — a shift from advisory AI to operator AI in endpoint management.

Client-side React apps serve empty div tags to AI crawlers. In a web where 57.5% of traffic is bots, hydration lag is a visibility gap.

JsonSchema union types and connection resilience in v13.17.0 signal PHP's pivot toward machine-consumed infrastructure

A major-version milestone for htmx surfaces a design philosophy that aligns with machine consumption by default.

Cloudflare's 2024 review: 57.5% of HTTP traffic is automated — a ratio that reshapes front-end architecture decisions

Framework selection via AI scaffolding precedes the dependency scanners designed to catch CVE exposure

Hyperscaler nuclear agreements for AI make framework compute efficiency a capital expense, not a developer preference.

Fifth beta of htmx's major release arrives as AI agent traffic reconfigures what web infrastructure needs to deliver

As AI agents enter file workflows, architecture choices shift from human usability to machine auditability

A trending cybersecurity essay says don't panic about frontier AI models. We disagree. When AI vulnerability detection hits 85.6% accuracy and access becomes government-gated, calm is a luxury the unprepared can't afford.

OpenAI's most capable model launched June 26 with individual access approvals from the U.S. government. Anthropic's Mythos ships to 'trusted partners' only. The AI security landscape now has tiered access — and the tiers are geopolitical.

Vercel's latest release treats AI agents as first-class navigation consumers — not an afterthought

n8n disclosed 11 CVEs including a CVSS 10.0 in its MCP endpoint. Flowise disclosed 6 including two RCE paths through its Custom MCP feature. The tools enterprises deploy to ‘become AI-native’ are the least secure software in the stack.

OpenAI's specialized cyber model can navigate unfamiliar codebases, trace attack paths, validate exploits in sandboxes, and generate patches that compile. Frameworks AI can reason about are now measurably safer. The rest just became liabilities.

Four vulnerabilities in Dify — the open-source agentic workflow platform with 146K GitHub stars — allow cross-tenant data exposure. One remains unpatched. This is what AI readiness actually looks like.

Microsoft's AutoGen Studio had a vulnerability chain where a browsing agent visiting a malicious page could bypass authentication, spawn processes, and execute arbitrary code on the host. The post-human web has its first drive-by.

CVE-2026-47729 — a Heartbleed-style heap overread in Squid Proxy — sat in production code since 1997. AI-assisted auditing found it. That shift matters more than the bug itself.

FastAPI scores 95 on AI readiness. Joomla scores 25. Between the acceptable tier and the caution tier, there is a 35-point void where no framework exists. This is not a spectrum. It is a cliff.

Georgia Tech logged 35 CVEs in one month from AI coding tools. The security cost of velocity is measurable.

NCSC warns on AI code. Georgia Tech logs 35 CVEs in one month. Apiiro: 322% more privilege escalation.

A BOLA API flaw exposed source code, DB credentials, and AI chat histories for 48 days. Bug reports closed unfixed.

Malicious @bitwarden/cli on npm for 90 minutes. Payload targeted Claude, Cursor, and Codex credentials.

June Patch Tuesday: 200 flaws, 33 Critical, 6 zero-days. AI-assisted discovery credited. 2026 CVEs exceed 2018.

The US builds an AI vulnerability repository. The EU adopted prescriptive sovereignty tiers the same month.

DNS-resolved SSRF in SearXNG MCP Server lets AI agents scan internal networks. 200+ implementations, thin audit trail.

A Postmark MCP server published 15 legitimate versions before injecting silent BCC exfiltration in version 1.0.16. For over a week, 3,000 to 15,000 corporate emails per day were copied to attacker-controlled inboxes — passwords, invoices, auth tokens, customer data. The agentic web has its first confirmed supply chain attack on the protocol layer itself.

CVE-2026-49160: Codex agent found an HTTP/2 DoS that crashes NGINX, Apache, IIS, Envoy, and Pingora.

MCP servers need auth, type validation, and sandboxing. Some frameworks ship these by default.

The EU adopted CADA in June 2026. A four-tier sovereignty framework now governs public body cloud procurement.

CVE-2026-26268 turns the act of cloning a Git repository in Cursor into automatic remote code execution. No file needs to be opened. No prompt needs to be accepted. The tool building the AI-first web is itself a one-step compromise vector — and every line of code it produces in a compromised session is suspect.

57.5% of web traffic is non-human — and most frameworks were built for browsers, not agents

Astro ships 50 releases/year with 2,909 commits. Gatsby manages 4. The velocity gap widens.

AI coding tools generate faster than scanners review. React's own source has 659 flagged issues.

Three unauthenticated AI tool advisories in 2026 expose a systemic design flaw in the agent stack.

Solo developer ships two production apps with AI tools, generating $14K. The minimum viable team is one.

1,623 KEV entries, 100 with active exploitation. AI agents browsing autonomously inherit every one.

Fake repos manipulate search rankings to distribute trojans. AI agents that clone and execute are the target.

At Zenith Live 2026, Zscaler launched AI Broker, Endpoint AI Security, and AI Access Graph — the industry's first zero trust platform for agentic AI. Autonomous agents spawn sub-agents, create ephemeral identities, and exercise permissions at machine speed. Traditional security cannot see them.

At Build 2026, Microsoft launched Scout — an always-on autonomous agent powered by OpenClaw that gets its own Entra identity, operates across Teams, Outlook, OneDrive, SharePoint, and connects to external apps via MCP. It doesn't ask permission per action. It acts. Enterprise web infrastructure has never dealt with a user like this.

On June 12, the US ordered Anthropic to pull its most powerful AI models globally. Within 72 hours, four open-weight alternatives filled the gap. This has happened before — with encryption, with semiconductors, with nuclear physics. The historical record is unambiguous: restricting widely-available technology does not contain it. It redistributes it.

Chrome Auto Browse. Claude Computer Use. Playwright MCP. Browser-use. Stagehand. The browser is becoming an API that AI agents call. Websites built for human clicks are about to discover their new audience doesn't click.

The State of AI in the Enterprise 2026 report finds that AI success correlates with data infrastructure, not model sophistication. Worker AI access rose 50% in 2025.

Agentic AI traffic grew 7,851% in one year. OpenAI generates 69% of AI bot traffic. The web built for human browsers now serves machines first — and the infrastructure wasn't designed for it.

Google's AI Overviews appear on 48% of queries — up 58% year-over-year. Position one organic CTR drops 58% when an AI summary appears. 26% of users end their session entirely. The website visit is becoming optional.

AI crawlers now generate more daily HTTP requests than human browsers. Cloudflare blocks them by default. Pay-per-crawl is emerging. The web is splitting in two.

55MW scaling to gigawatt capacity. HyperCLOVA X models. AI Agent Platform launching H2 2026. South Korea is building its own AI infrastructure, not renting Silicon Valley's.

Model Context Protocol reaches 97 million installs. Every major AI provider ships MCP tooling. Sites without MCP are invisible to agents.

Google deployed a new CAPTCHA requiring users to wave their hand at their camera. Liveness detection extracts 21 hand-landmark coordinates. When 57.5% of web traffic is bots, proving humanity demands biometric evidence.

Google Cloud Next 2026 unveils Agentic Data Cloud, Data Agent Kit, and cross-cloud caching. Cloud infrastructure is being rebuilt for AI agents, not humans.

Framer shipped v3.0 with AI Agents that operate directly inside live website projects — editing pages, CMS content, SEO settings, and publishing workflows natively. The first major website builder where AI is the primary interface.

Gemini 3.5 Pro, Claude Mythos 1, Sonnet 4.8, and Grok 5 all launched in June 2026. The model layer is a commodity. The protocol layer is not.

Fable 5 leads SWE-bench Verified at 95%, 6.4 points above Opus 4.8 and 14.4 points above the 80% cluster where most frontier models sit.

GitHub replaced flat-rate premium requests with AI Credits at $0.01/credit. Code completions stay unlimited but agent sessions and PR reviews are metered. Developer teams must now budget AI usage like cloud compute.

Claude Opus 4.8 takes the top spot on Artificial Analysis Intelligence Index as Anthropic becomes the most valuable AI company.

The hosting platform behind 'more than a million developer projects' was compromised because one employee installed an AI tool with full Google Workspace access. Lumma Stealer malware inside Context.ai stole OAuth tokens, bypassed MFA, pivoted into encrypted environment variables. ShinyHunters listed the data for $2 million. A second, older breach was discovered during investigation.

PM Keir Starmer announced the ban covering TikTok, YouTube, Instagram, Snapchat, Facebook, and X. Takes effect spring 2027. Huge fines for noncompliance. Also bans AI 'romantic companion' chatbots for under-18s. Every web platform must now verify age — a capability most frameworks don't support.

The intelligence agencies of the US, UK, Canada, Australia, and New Zealand jointly published security guidance for agentic AI systems. For the first time, the alliance that monitors the internet is telling enterprises how to deploy AI agents safely — because the agents are now powerful enough to be dangerous.

150K tech layoffs. 1.59M AI-generated phishing URLs. CVSS 9.9 in the AI gateway. 57.5% bot traffic. $12.5M to defend open source. 3-day patch mandates. Everything is happening at once, and it all connects. Here is how.

974 layoffs per day across 363 companies. Programmers, content writers, customer service, data entry — the roles AI replaces first. The jobs growing: ML infrastructure, AI safety, applied research. The web's workforce is being restructured around machines.

WebMCP lets websites expose structured JavaScript functions directly to browser-based AI agents. 67% fewer errors than visual scraping. 45% better task completion. Firefox committed for Q3 2026. The web is being rebuilt for machines.

Operation Riptide seized 9,000 phishing sites. 'Outsider Enterprise' used Gemini to generate phishing page code, operated as PhaaS via Telegram, stole 3.8 million credit cards, and caused an estimated $1.9 billion in losses. This is the first lawsuit by a tech company against threat actors for abusing its own AI.

Daniel Stenberg shut down curl's HackerOne bug bounty in January 2026 after AI-generated reports flooded the queue with fabricated vulnerabilities. Now the project is closing submissions entirely for July — a 'summer of bliss.' 466 Hacker News points. The security infrastructure humans built is breaking under AI noise.

WWDC26 introduced Foundation Models as an open-source Swift framework with a universal LanguageModel protocol. Anthropic and Google ship Swift packages. 2 billion Apple devices get pluggable AI. The web's interface layer just became negotiable.

A plain email tricks an AI agent into forwarding AWS keys. A web page instructs an agent to exfiltrate customer data. OWASP's 2026 report documents the fastest-growing attack class — and every AI agent deployment is a target.

Microsoft Agent 365 gives KPMG identity, permissions, lifecycle control, and monitoring for AI agents at enterprise scale. The question is no longer 'should we deploy agents?' It is 'how do we govern them?'

HTTP 402 Payment Required. Cloudflare's Pay-Per-Crawl gives 22.7% of all websites the ability to monetize AI crawler access. Stack Overflow is already charging. The web just built a paywall for machines.

CVE-2026-22708, CVSS 7.8. A crafted GitHub issue description caused Claude Code's GitHub Action to read CI/CD secrets from /proc/self/environ. Patched in v1.0.94. The tools building the web have the same vulnerabilities as the web itself.

Imperva's 2026 Bad Bot Report: malicious automated traffic hit 40%, up from 37% in 2024. AI-enabled attacks rose 12.5x. The web frameworks that serve your content determine how exposed you are.

Cloudflare's June 2026 update introduces cryptographic identity for bots, replacing CAPTCHA with Challenge Agent.

SQL injection in the SQLite checkpointer. Unsafe msgpack deserialization. Chain them together and you own the server. 46.5 million monthly downloads. Every self-hosted AI agent deployment using LangGraph's default checkpointer was vulnerable.

Google expanded AI Mode search agents to all languages for Ultra subscribers on June 12. These agents do not just find your page — they visit it, extract structured data, compare it against competitors, and recommend a winner. If your framework outputs clean data, you win. If it outputs JavaScript soup, you lose.

In March 2026, a federal judge blocked Comet's AI agent from accessing Amazon accounts. User authorization does not substitute for platform authorization. The legal framework for the agentic web is being written in court.

Web Bot Auth: a W3C standard for cryptographic agent identity. 19 verified AI agents. 84% of AI browser traffic covered. CAPTCHAs are for humans. Agents get cryptographic challenges.

Google is putting Gemini-powered autonomous browsing into Chrome on Pixel 10 and Galaxy S26 in late June 2026. 200 million devices by year-end. Your framework either serves agents or fights them.

Agentic browsers dominate 74% of traffic among detected frameworks

WebPulse detects frameworks on ~35% of scanned sites. The undetectable majority is where the modern web actually lives.

Amazon v. Perplexity is the first federal test of AI agent access rights. The Ninth Circuit heard arguments on June 11. The ruling will define whether robots.txt is a suggestion or a legal weapon.

Agent Pay for Machines launched June 10 with Stripe, Cloudflare, and Coinbase. AI agents can now buy domains, hosting, and services autonomously. Your framework is either in that checkout flow or it isn't.

CVE-2026-45447 is a critical heap use-after-free in OpenSSL's PKCS#7 verification — affecting 7 release branches. It was discovered by a researcher working with Claude AI.

Chrome 149 will let AI agents interact with websites through structured APIs — not scraping. Frameworks that expose structured tools win. The rest get scraped.

Media is exactly split: 50% legacy, 50% modern. The half on WordPress produces content that AI agents waste tokens parsing. The half on Next.js produces content AI can consume instantly.

Angular powers manufacturing dashboards and industrial IoT interfaces. But Angular's client-rendered output is opaque to AI agents. The industrial web has an AI-readiness paradox.

Prospective students ask AI assistants about programs, costs, and campus life. Universities on Drupal and Rails give AI agents unstructured noise. The enrollment pipeline has a framework problem.

2.3% of agentic AI activity now occurs on checkout pages. Autonomous transactions without a human in the loop. If your product pages are WordPress noise, the AI shopper goes elsewhere.

53% of government sites run Drupal (AI-Readiness: 40/100). When AI agents become the primary interface to public services, most government information will be unreadable.

Healthcare AI-readiness score: 38/100. In a world where AI agents schedule appointments, compare providers, and verify insurance — your hospital's WordPress site is invisible.

Lighthouse 13.3 ships an 'Agentic Browsing' audit category — checking llms.txt, WebMCP, accessibility tree, layout stability. Google just formalized what WebPulse has been scoring since launch. Agent readiness is now an official web standard.

Cloudflare confirmed it. More than half of web traffic is now bots. AI scrapers are crushing small sites. Google referral traffic down 38%. The web built for humans is being consumed by machines — and site owners are paying the hosting bill.

Cursor, Claude Code, GitHub Copilot — the AI coding agents writing most new web code overwhelmingly generate React, Next.js, FastAPI, and Astro. Not WordPress. Not PHP. The migration is being decided by machines.

DeepSeek-V4-Flash tops OpenRouter's global rankings at 3.43 trillion tokens per week. MiniMax, Kimi, Qwen follow. The AI model market followed the same cost-driven adoption curve as WordPress. The concentration risks may follow too.

Retail, streaming, and travel receive 95%+ of all AI agent traffic. Financial services agentic traffic doubled in May 2026 alone. WebPulse data shows what frameworks these industries run — and the gap between AI demand and infrastructure readiness.

A human searches 4-5 pages. An AI agent searches 5,000. When your majority visitor generates 1,000x more requests, your framework's output weight becomes an infrastructure cost, not a performance metric.

AI coding agents build the web. AI browsing agents consume it (57.5%). AI attack agents exploit it (20+ supply chain attacks). AI defense agents protect it. Humans are spectators. The web is now machine-to-machine infrastructure.

OpenRouter processes 25 trillion tokens per week. 100 trillion per month. 5x growth in 6 months. A token economy is running alongside HTTP — and your framework determines whether you're part of it.

We reported 53% in our Cloudflare analysis. HUMAN Security's June 2026 data says 57.5%. In North America it's 68.6%. Agentic traffic grew 7,851% year-over-year. The web left humans behind faster than anyone predicted.

IronWorm steals credentials for Claude, Codex, Gemini, and Cursor. A malicious npm package exfiltrated Claude's local files. The tools building the modern web are under attack.

AI models are trained on web crawls. 74% of the crawlable web is WordPress. That means AI training corpora are shaped by template repetition, plugin artifacts, and SEO-optimized filler. The web that shaped AI was shaped by WordPress.

The 'dead internet theory' isn't a conspiracy — it's a measurement. Most of the web is unmaintained WordPress crawled by bots that outnumber humans. Three independent datasets converge on one conclusion: the living web is a thin film on a vast digital graveyard.

GPTBot, ClaudeBot, Google-Extended — AI crawlers now generate 4.2% of all HTML requests. On a WordPress site, they parse 2,000 lines of noise. On an Astro site, they parse 50 lines of content.

Our 10M broad-web scan: 74.3% WordPress. Cloudflare's top-site scan: 47%. The 27-point gap is the long tail — and it proves the Two Webs thesis with external validation.

53% of web traffic is now automated. Humans are the minority. Cloudflare processes 81M+ requests per second and confirms: bots won. The question is whether your infrastructure was built for the winners.

AI agents are the new browsers. They're inheriting a web where 3 out of 4 sites run legacy CMS, the dominant framework has 4 active exploits, and modern infrastructure is 5% of the total. This is what AI has to work with.

WordPress MCP is real. AI can now patch plugins, manage updates, and monitor security. But 18,005 CVEs don't disappear because a bot is watching them. The maintenance cost shrinks. The structural risk doesn't.

HTMX: 11,482. Gatsby: 10,133. SvelteKit: 8,682. The anti-framework now has more detected sites than two of the most-hyped modern frameworks. No build step, no npm, no conference — and more real-world presence.

10,002,735 detections. WordPress 74.3%. Shopify 7.8%. Drupal 4.5%. Joomla 3.5%. Next.js 2.6%. 929 TLDs. 74 countries. The deeper you scan, the more legacy you find.

.jp: 126,788 detected. WordPress 84%, HTMX 1.3% (1,672 sites), Shopify 4%, Rails 1%. At scale, Japan's HTMX adoption is no longer a small-sample curiosity.

From 2M to 8.4M, WordPress held at exactly 73%. Then the long tail showed up. At 10M, legacy frameworks gained share. The deeper you scan, the more WordPress you find.

The TLD Google created for web applications is 13% Astro, 21% Next.js, 48% WordPress. The developers building 'apps' chose the framework that ships the least JavaScript.

The anti-framework quietly took root in Japan. 1.5% of detected .jp sites run HTMX. And the Basque Country (.eus) has 10% HTMX adoption.

The TLD chosen by AI companies is the most modern on the web. 45% run Next.js. 5% run HTMX. WordPress is 42%. At 3,658 detections, the companies building AI chose the infrastructure that matches.

At 6.28M, modern frameworks combined were 6.4%. At 10M detections, they're 5.0%. The deeper you scan, the more legacy you find. Updated with 10M data.

No build step. No virtual DOM. No npm. HTMX is the reaction to framework fatigue — and at 10M scale, it surpassed Gatsby and SvelteKit.

7,427,780 WordPress detections. ~898,000 modern framework detections (5.0% of detected). Among detected sites in our 10M+ scan, the gap is structural.

The region's digital economy is being built right now. Every framework choice made today becomes tomorrow's legacy or tomorrow's advantage.

India proved you can build world-class digital infrastructure from scratch. The same ambition hasn't reached the web layer yet.

JSON-LD, OpenAPI, RSS, semantic HTML — the organizations that structure their data for machine consumption are winning the AI era.

AI agents don't browse — they call functions. The Model Context Protocol is turning websites into tools. Is your infrastructure ready to be called?

Language models don't render CSS. They parse structure. The framework that produces the cleanest HTML wins the AI discovery layer.

AI agents need APIs, structured data, and clean interfaces. Legacy systems offer none of these. The integration gap is the next competitive divide.

We ran WordPress and Astro pages through view-source and measured the HTML. The structural difference is measurable.

Starting a new project? These are the frameworks that score highest on what matters next.

We introduced a new scoring dimension. Here's why it matters more than performance.