Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows

Recent reporting outlines developments surrounding a critical vulnerability uncovered by Anthropic's bug-hunting model, Mythos. The flaw affects an HTTP file server, specifically identified as a Rejetto HFS vulnerability that enables admin session forgery and remote code execution, commonly abbreviated as RCE. Coverage indicates that this vulnerability has been exploited in the wild, with attacks targeting the flaw currently underway. According to specific reports, a cyber actor based in China has utilized this new vulnerability for attacks directed against targets in the United States and Japan. Various media outlets and security publications have devoted significant coverage to the incident, emphasizing both the capabilities of the artificial intelligence model and the immediate security implications of the exploit.

Outlets tracking these events include ET Datacenters, SecurityWeek, Nacionale News, The Hacker News, and The Register. These sources collectively highlight how the discovery by Anthropic's Mythos model connects to active threat activity observed across multiple international jurisdictions. Context provided within the coverage points to the growing role of advanced artificial intelligence systems in vulnerability discovery and cybersecurity analysis. The Register specifically characterizes Anthropic's Mythos model as exceptionally proficient at mathematics, linking this capability directly to its success in uncovering the complex flaw in the Rejetto HFS software. Coverage does not yet specify the complete timeline of the initial discovery relative to the start of the active attacks, nor does it detail the full remediation steps provided to affected administrators.

Future updates will depend on further disclosures from security analysts, affected organizations, and artificial intelligence developers regarding the scale of the attacks and the specific mechanics of the vulnerability. Observers are monitoring whether additional threat actors will adopt the exploit or if patches will mitigate the risk to systems in the United States, Japan, and other regions. Coverage does not yet specify when broader software updates will be universally deployed to address the admin session forgery and remote code execution flaws.