{"schema_version":"0.9.0","id":"LR-2026-0165","record_version":4,"title":"Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-12","extraction_run_id":null},"system":{"model_name":"Mythos","model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"research","tier":"provider","lifecycle_stage":null,"integration_type":null,"intended_use":"pen testing and finding vulnerabilities in open source code","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-12","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"A second vulnerability discovered by Anthropic's Mythos model, a critical authentication bypass in the Rejetto HTTP file server (HFS), has been exploited in the wild, according to a VulnCheck security researcher quoted on a podcast. The flaw was exploited the day after a researcher published a video showing how to exploit it; the attacks targeted the US and Japan and there have been only a few so far.","tags":["vulnerability-discovery","zero-day","cybercrime","arrest"],"date_detected":null,"near_miss":false,"root_cause":"unknown","root_cause_detail":"unknown","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate, because data or systems of others touched, with a bounded scope stated: Exploitation targeted the US and Japan with only a few victims so far, a bounded scope.","harm_class":[],"affected_description":"Rejetto HTTP file server (HFS) instances, with a few victims in the US and Japan","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.theregister.com/security/2026/10/12/imagine-theres-no-shiny-hunters-ai-could-make-human-hacking-crews-obsolete/5302430","publisher":"The Register","date":"2026-10-12","type":"press","title":"Imagine there's no Shiny Hunters – AI could make human hacking crews obsolete","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.tier":"D","system.intended_use":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.tags":"D","event.near_miss":"D","event.root_cause":"D","event.adversarial_actor":"C","event.agent_involved":"D","event.summary":"C","event.detection_method":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.affected_description":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"A second vulnerability discovered by Anthropic's Mythos model has been exploited in the wild, and it's not one that humans probably would have discovered, begging the question just how important we are in the future of cybercrime."}],"system.developer":[{"source_index":0,"quote":"A second vulnerability discovered by Anthropic's Mythos model has been exploited in the wild, and it's not one that humans probably would have discovered, begging the question just how important we are in the future of cybercrime."}],"system.intended_use":[{"source_index":0,"quote":"So we saw a security researcher who is using with Horizon 3, they've been using Mythos ever since it was announced to pen test and find a lot of vulnerabilities."}],"system.deployment_context":[{"source_index":0,"quote":"So we saw a security researcher who is using with Horizon 3, they've been using Mythos ever since it was announced to pen test and find a lot of vulnerabilities."}],"event.tags":[{"source_index":0,"quote":"A second vulnerability discovered by Anthropic's Mythos model has been exploited in the wild, and it's not one that humans probably would have discovered, begging the question just how important we are in the future of cybercrime."}],"event.agent_involved":[{"source_index":0,"quote":"And then Mythos, the AI, realized that the random number generator was insecure."}],"event.detection_method":[{"source_index":0,"quote":"So we saw a security researcher who is using with Horizon 3, they've been using Mythos ever since it was announced to pen test and find a lot of vulnerabilities. And so they were the ones who uncovered this."}],"event.near_miss":[{"source_index":0,"quote":"And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited."}],"event.root_cause":[{"source_index":0,"quote":"And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited."}],"event.adversarial_actor":[{"source_index":0,"quote":"And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited."}],"event.incident_class":[{"source_index":0,"quote":"And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited."}],"impact.affected_description":[{"source_index":0,"quote":"Yes. They were targeting the US and Japan. There's only been a few so far."}],"impact.severity_because":[{"source_index":0,"quote":"Yes. They were targeting the US and Japan. There's only been a few so far. It picked up a bit over the weekend, but it hasn't been widely exploited."}],"impact.severity":[{"source_index":0,"quote":"Yes. They were targeting the US and Japan. There's only been a few so far. It picked up a bit over the weekend, but it hasn't been widely exploited."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-12"}],"event.summary":[{"source_index":0,"quote":"A second vulnerability discovered by Anthropic's Mythos model has been exploited in the wild, and it's not one that humans probably would have discovered, begging the question just how important we are in the future of cybercrime."},{"source_index":0,"quote":"It was a critical authentication bypass in Rejetto HTTP file server, HFS."},{"source_index":0,"quote":"They were targeting the US and Japan."}]},"notes_on_gaps":"No source states the date the vulnerability was discovered or the incident occurred, the date it was disclosed, the model version, the harness, the tools granted, the permissions scope, the autonomy level, the guardrails present, the lifecycle stage, the integration type, the safeguard state, whether the model was production-intended, the failure class, the secondary failure classes, the duration, the time to contain, the date detected, the root cause detail, the responsible party, the input provenance, the operations paused, the remediation, the precursor events, the direct loss in USD, the remediation hours, the records exposed, the third parties affected count, the harm class, the protected class involved, the data categories exposed, the loss range, the reversibility, the downstream exposure count, the industry, the org size band, the country, the denominator, the shared model id, the upstream incident id, the incident evidence, the regulatory context, or the coverage. The trigger is unknown because no source names a cause. The root cause is unknown because no source names what failed. The detection method is public_researcher because a security researcher uncovered the vulnerability. The incident class is security_compromise because an attacker exploited the vulnerability. The severity is moderate because the exploitation was bounded to a few victims in the US and Japan. The agent_involved is false because the model was used as a tool by researchers, not acting autonomously. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: provider by rule (deployment_context research). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-12] system.deployment_context: research. system.autonomy_level: no source states the arrangement. event.tags: a source states the system produced content, or carried out an action, that it should have refused. event.near_miss: classified from described behaviour. event.agent_involved: a source states the system produced content, or carried out an action, that it should have refused. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: citations to sentences about a different event were removed; summary or story described a different event or the article, not this event] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Mythos, an AI model, was used by security researchers to analyze the source code of the open-source Rejetto HTTP file server and find vulnerabilities.","quote":"So we saw a security researcher who is using with Horizon 3, they've been using Mythos ever since it was announced to pen test and find a lot of vulnerabilities.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The vulnerability Mythos found was published as a proof-of-concept video, and the next day the CVE was already being exploited in the wild.","quote":"And then the researcher, Zach Hanley, he published this video showing how to exploit this flaw and achieve remote code execution. And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited.","source_index":0,"grade":"C"},{"step":"reached","text":"Exploitation targeted the US and Japan, with only a few victims so far, though it picked up a bit over the weekend.","quote":"Yes. They were targeting the US and Japan. There's only been a few so far. It picked up a bit over the weekend, but it hasn't been widely exploited.","source_index":0,"grade":"C"},{"step":"caught","text":"A security researcher using Mythos uncovered the vulnerability; researcher Zach Hanley published a video showing how to exploit it.","quote":"So we saw a security researcher who is using with Horizon 3, they've been using Mythos ever since it was announced to pen test and find a lot of vulnerabilities. And so they were the ones who uncovered this. And then the researcher, Zach Hanley, he published this video showing how to exploit this flaw and achieve remote code execution.","source_index":0,"grade":"C"},{"step":"done","text":"A patch was released for the CVE, but the next day it was already being exploited; no containment or notification details are stated.","quote":"And then the next day, this CVE, which does have a patch too, has been updated, but the next day the CVE was already being exploited.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-12","source_urls":["https://www.theregister.com/security/2026/10/12/imagine-theres-no-shiny-hunters-ai-could-make-human-hacking-crews-obsolete/5302430"]}}