Ethical Hacking News
Anthropic's super bug-hunting model, Mythos, has been making headlines in the cybersecurity world for its impressive capabilities in uncovering vulnerabilities. The latest vuln under attack, CVE-2026-61500, has shown that Mythos is indeed hardcore good at math, as it was able to identify a critical authentication-bypass bug in Rejetto HTTP File Server (HFS) that can lead to full admin access and remote code execution. This highlights the importance of Mythos in the fight against cyber threats and its potential impact on the cybersecurity landscape.
Anthropic's super bug-hunting model, Mythos, has identified a critical authentication-bypass bug in Rejetto HTTP File Server (HFS) that can lead to full admin access and remote code execution.Mythos excels at mathematical distillations and scientific tasks, particularly those related to computer science and operating systems.The vulnerability stems from HFS' use of Math.random() and Koa's keygrip, which can be exploited if the session signing key is derived.Mythos' analysis used Z3, a Microsoft-developed SMT solver, to recover the PRNG seed and identify the vulnerability.As of Thursday, Mythos and Project Glasswing had uncovered 286 CVEs, with only one previously exploited in real-world attacks.The discovery highlights the capabilities of Mythos in identifying vulnerabilities in web applications and its potential role in the fight against cyber threats.
Anthropic's super bug-hunting model, Mythos, has been making headlines in the cybersecurity world for its impressive capabilities in uncovering vulnerabilities. The latest vuln under attack, CVE-2026-61500, has shown that Mythos is indeed hardcore good at math, as it was able to identify a critical authentication-bypass bug in Rejetto HTTP File Server (HFS) that can lead to full admin access and remote code execution.
The vulnerability, which was initially detected by researcher Zach Hanley at AI pen-testing company Horizon3, highlights Mythos' capabilities in mathematical distillations and scientific tasks, especially those relating to computer science and operating systems. According to Hanley, Mythos excels at mathematical distillations and scientific tasks, and its ability to identify the CVE "speaks to Mythos's capabilities in understanding of mathematics, how it identified an exploitable set of cryptographic missteps, and approached solving the constraints to achieve remote code execution."
The security issue stems from how HFS authenticates users. It generates a random value with Math.random() and then passes this value to Koa, the Node.js web framework foundation for HFS. Koa uses keygrip to sign all session cookies with that random value. This means that if an "attacker can derive what the session signing key is, they can forge valid session cookies." However, V8's Math.random() did not use a secure pseudo random number generator (PRNG). Mythos discovered that the output of the xorshift128+ algorithm it used was fully reversible, and the application was leaking Math.random() outputs.
The model's analysis claimed that Z3, a Microsoft-developed, publicly available Satisfiability Modulo Theories (SMT) solver, could be used to recover the PRNG seed. Hanley notes that Horizon3's researchers could not recall seeing an SMT solver used this way to attack a cryptographic flaw in a real application and bypass authentication. "What makes this impressive is that Mythos didn't just flag the insecure PRNG in isolation – it simultaneously identified that the application leaked raw Math.random() outputs through a separate code path, recognized those two facts as a chain, and determined the leak produced exactly the observations needed to make state recovery feasible," he wrote.
As of Friday, Mythos and Project Glasswing have uncovered 286 CVEs, according to Garrity's tracker, and up until Thursday only one of these bugs had been exploited in real-world attacks. The Thursday night activity originated from one IP address in China and targeted vulnerable servers in the US and Japan. Garrity told The Register that today they have seen four hits, which originated from two different IP addresses in the US: 173.239.211[.]248 and 173.239.211[.]249. Both are in the same subnet, and "appear to be coming from a proxy." Garrity added that in April, a 10-country security advisory warned of China-nexus cyber operatives using proxy networks "strategically, and at scale."
In his write-up, Hanley said Horizon3 has used Mythos in its vulnerability research – and discovered "many critical vulnerabilities" ever since the security company joined Project Glasswing in July. The discovery of CVE-2026-61500 highlights the capabilities of Mythos in identifying vulnerabilities in web applications, and it is clear that this model is going to play an important role in the fight against cyber threats in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Mythic-Mathematical-Marvels-The-Rise-of-Anthropics-Mythos-and-Its-Impact-on-Cybersecurity-ehn.shtml
https://www.theregister.com/security/2026/10/03/anthropics-super-bug-hunting-model-mythos-is-hardcore-good-at-math-as-latest-vuln-under-attack-shows/5300933
Published: Sat Oct 3 11:06:15 2026 by llama3.2 3B Q4_K_M
