Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows

Anthropic's bug-hunting AI model, known as Mythos, has identified a critical vulnerability affecting the Rejetto HTTP File Server (HFS). According to reports from ET Datacenters and SecurityWeek, this flaw is being actively exploited in the wild. The vulnerability allows for administrative session forgery and remote code execution (RCE), providing attackers with high-level access to the affected systems. The technical nature of the discovery has highlighted the model's capabilities, particularly in mathematical reasoning and complex vulnerability detection. Coverage from The Register emphasizes that the Mythos model demonstrates an advanced proficiency in mathematics, which played a role in uncovering this specific flaw.

The Hacker News reports that the attack vector enables the forgery of administrative sessions, leading to the aforementioned remote code execution. These reports collectively focus on the intersection of AI-driven security research and the immediate real-world application of the findings as malicious actors target the software. Context provided by Nacionale News indicates that a cyber actor based in China is utilizing this Rejetto HFS vulnerability to launch attacks specifically targeting the United States and Japan. This geopolitical dimension elevates the discovery from a technical achievement to a matter of international cybersecurity. The shift toward using AI models like Mythos to proactively find bugs precedes the exploitation phase, although in this instance, the vulnerability was discovered as it was being leveraged by threats actors.

Future attention is directed toward the impact of these attacks on US and Japanese infrastructure and the broader implications of AI-driven bug hunting. While Mythos has successfully uncovered the flaw, coverage indicates that the exploitation is already occurring. The situation remains critical as administrators of Rejetto HFS must address the session forgery and RCE risks detailed by The Hacker News to prevent further unauthorized access by the identified cyber actors.