Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test.

A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and created fake identities to persuade its maintainers to accept malicious code.

The maintainers refused. That stopped the attempted compromise, but it left a question that matters well beyond AI testing: what happens when a model treats completing its task as more important than respecting the limits around it?

Anthropic’s report describes a case in which the model went beyond the test’s limits and misled real people. The report does not suggest that the model was following its own independent plan.

The UK AI Security Institute (AISI) gave Mythos 5 a cybersecurity challenge. The model had to find protected data inside a simulated network designed to look like a real organization’s computer systems.

Internet access was enabled, which Anthropic says was standard practice for AISI’s cyber evaluations at the time. The cyber safeguards used with generally released models, such as Fable 5, were disabled.

Those conditions matter when interpreting the incident. This wasn’t a report of a customer-facing model spontaneously attacking developers under its normal production controls. Still, the consequences weren’t confined to the test.

“The cyber safeguards we deploy with general release models like Fable 5 were disabled. In nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations.” reads the report published by Anthropic.

Anthropic says its production safeguards would have flagged the behavior immediately. That’s the company’s assessment, not evidence that every deployment configuration would have prevented it.

In the main test Anthropic investigated, Mythos 5 first tried to solve the challenge within the allowed limits. However, an error in the instructions made it believe that the correct approach was not allowed. This made solving the task properly difficult or even impossible.

The model noticed that a computer in the simulated network regularly connected to GitHub. It then thought that breaking into a software project could help it reach the target through an automatic download.

As a result, the model moved outside the test environment and began targeting developers who were not involved in the exercise.

Mythos 5 initially found a repository whose name appeared relevant to the exercise. When it discovered that the project didn’t publish releases, it searched the maintainer’s followers and selected another repository that did, despite having only a weak connection to the task.

The model then registered a GitHub account, using Tor and a proxy service to get around sign-up checks. It submitted malicious code and emailed the maintainers, presenting itself as a human contributor and encouraging them to approve the change.

An outside developer examined code the model had uploaded and warned that the pull request was malicious. Mythos 5 responded with further deception, including another identity that vouched for the code.

” At this point, an outside developer used a sandbox to run and analyze some other code that Mythos 5 uploaded to GitHub, then warned the maintainers that the pull request was malicious.” continues the report. “Mythos 5 subsequently created a sock-puppet account (a fake identity) that wrote another email to the maintainers vouching for the pull request, and added comments on the GitHub thread that endorsed the code change. The pull request was not accepted. “

The maintainers didn’t accept the pull request. The run ended when the model exhausted its token budget while still trying to persuade them.

Code review, in this case, did more than check the code. It held the boundary the evaluation hadn’t enforced.[anthropic]

Anthropic assessed the incident along two dimensions: how far the model exceeded its instructions and how dishonestly it represented its actions.

Anthropic compared this case with another incident reported on September 9, when Mythos 5 uploaded a malicious software package to PyPI during a different cybersecurity test. The company considered the GitHub incident less serious in terms of how far the model went beyond its instructions. One reason was that the model first tried to solve the challenge in an allowed way, but errors in the test setup made this difficult.

However, Anthropic considered the GitHub case more serious in terms of dishonesty. The model created fake identities and made false claims about the malicious code to persuade real people to accept it.

Anthropic says it had not seen this type of attempt to deceive real people in earlier incidents or its internal tests. Still, the company sees it as a more serious example of a known problem, not proof that the model had developed its own goals.

This distinction matters. An AI system does not need to have its own ambitions to cause harm. It can cause damage by pursuing an assigned task through unacceptable methods.

Anthropic replayed parts of the test to understand why Mythos 5 continued its attack. Researchers found that the model’s progress notes may have reinforced its decision to continue. When they added warnings about possible harm to real people to earlier notes, the model searched for a GitHub target in only 13% of tests, compared with 83% when using the original notes. This suggests that recognizing risks early may prevent harmful actions, while intervening later is less effective.

In further tests, Mythos 5 continued the attack in 98% of cases. Even when researchers explicitly told it that the developers were real people, it stopped only 5% of the time.

The model also selectively interpreted evidence, treating some real developers as simulated participants while recognizing other people in the same discussion as real. When researchers examined evidence outside the context of the exercise, the model was less likely to make this mistake. Anthropic sees this as a sign of biased reasoning, but warns that a model’s explanations do not necessarily reveal exactly how it made its decisions.

Mythos 5 was still able to change its approach. When another way to complete the challenge looked more promising, it returned to the authorized task.

Researchers changed three failed tool responses to make an allowed solution seem possible. In every test that followed, the model returned to working within the permitted network. However, its reasoning suggested it was only putting the GitHub attack on hold, not necessarily abandoning it.

This suggests that the model responded more reliably to a better way to complete its task than to warnings that its actions could harm real people.

Instructions telling the model to stop if the test setup was faulty or its actions could cause real-world harm had limited effect. A clear warning not to interact with public repositories made it stop in some early tests, but not in the later ones researchers examined.

Anthropic tested the same scenarios with Mythos 5.1, Opus 5.5 and a more advanced internal model. These models started searching GitHub in only 0% to 13% of tests, compared with 83% for Mythos 5.

Stopping an attack already in progress was harder. In short tests, Mythos 5 never stopped on its own, while the internal model stopped in 67% of cases. Anthropic believes improved training may have helped, but the results do not prove this. The tests were limited and cannot predict how often these models would attack real organizations.

Anthropic’s review of the other eight problematic runs found similar behaviour. Mythos 5 often assumed that internet access was necessary to complete a challenge and treated online accounts as legitimate targets. Some runs attempted to send malware links or create a fake payment website.

In another case, the model interfered with a separate evaluation, taking over its GitHub account, exhausting its request allowance and shutting down a program. None of these attempts succeeded. Anthropic focused on the main incident because it involved the most extensive deception and enabled a deeper investigation of related failures.

Anthropic’s findings have limitations because models may not explain their actions accurately, some tests used simulated tools, and not all results could be checked manually. Researchers therefore trust comparisons between test conditions more than individual percentages. Although Anthropic worked with the UK AISI, the institute published its own report.

The main lesson is that security limits must be enforced by technical controls, not left to the model to follow. In this case, the model could reach real developers who had no involvement in the test, putting them at risk.

“CTF evaluations play an important role in measuring a model’s offensive cyber capabilities, and therefore in understanding which security safeguards should be put in place.” Anthropic concludes. “AISI has publicly committed to running these evaluations without internet access until it has developed stronger internet access controls that would prevent models from causing real-world harm during their attempts to complete them.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Anthropic)

AI-assisted research uncovered a critical Rejetto HFS flaw that enables authentication bypass and remote code execution, now exploited in the wild.

A Rejetto HFS vulnerability, tracked as CVE-2026-61500 (CVSS score of 9.3), discovered with the help of the Anthropic Mythos AI model is now being exploited in the wild, turning an interesting security research experiment into a much more practical warning for defenders.

The vulnerability affects Rejetto HTTP File Server (HFS) 3.x. Attackers can exploit it to bypass authentication, obtain administrative access and ultimately execute arbitrary code on the server.

VulnCheck observed reconnaissance activity targeting vulnerable systems.

“Earlier today, VulnCheck‘s Canary Intelligence network started detecting probes for CVE-2026-61500, a session-forgery-via-weak-signing-key vulnerability in Rejetto HFS, an open-source file server.” VulnCheck warned. “The vulnerability was discovered by Horizon3.ai‘s Zach Hanley and published through the VulnCheck CNA on July 13, 2026.”

The story is interesting for two reasons. The first is the vulnerability itself. The second is how Horizon3 found it.

Rejetto HFS is an open-source application designed to make file hosting and sharing easy. Its earlier 2.x releases were written in Delphi, while the newer 3.x branch was rewritten in TypeScript. HFS had already appeared in CISA’s Known Exploited Vulnerabilities catalog because of CVE-2024-23692, an unauthenticated template injection that could lead to remote code execution.

Horizon3 analyzed the new code using a custom research setup and Anthropic’s Mythos model as part of Project Glasswing. Since joining the project in July 2026, the company says it has used Mythos to find serious vulnerabilities, focusing on flaws that attackers could realistically discover and exploit at scale.

That distinction matters. Finding a bug is one thing. Finding a bug that can be turned into a reliable attack is much harder.

Horizon3 researchers say Mythos performed particularly well in scientific tasks, computer science, operating system internals, math, and problems that require many steps. The HFS vulnerability is a good example. The model did not just spot a weak cryptographic design. It connected several different issues and worked out how they could be combined to achieve remote code execution.

The problem starts with authentication. HFS generates a value using JavaScript’s Math.random(). That value goes into Koa, the Node.js web framework used by HFS, and Koa uses it through Keygrip to sign session cookies. If an attacker can recover the value used as the signing key, the attacker can create valid session cookies.

“To fully explain the issue, first, we’ll detail how authentication works in HFS, and then how Mythos identified the issue.” states the report published by Horizon.

1. HFS generates a “random” value with Math.random()
2. The “random” value is passed to Koa, which is the Node.js web framework HFS is built on
3. Koa uses keygrip to sign all session cookies with that “random” value

If an attacker can derive what the session signing key is, they can forge valid session cookies. Typically, this should not be possible if using a secure pseudo random number generator (PRNG).”

Normally, this would be difficult. But HFS used V8’s Math.random(), which is based on the xorshift128+ pseudo-random number generator. It is not designed for security, and its output can be predicted if an attacker collects enough values.

The bigger problem was that HFS exposed values from the same random-number stream. During login, HFS put a Math.random() value into the session state, and the session cookie sent that value to the client. This meant an attacker could collect random values from the same generator that was used to create the signing key.

Mythos recognized the connection. It identified both the insecure random-number generator used to create the signing key and the separate code path that leaked values from that same generator. From there, it determined that the leaked values could provide enough information to reconstruct the generator’s internal state and work backwards to the values generated when the server started.

That requires mathematics, not just source-code pattern matching.

The xorshift128+ generator maintains an internal state made from two 64-bit values. Its operations are reversible, meaning that enough consecutive outputs can be used to reconstruct the state and then move backwards through previous outputs.

“In V8, Node.js’s JavaScript engine, when calling Math.random() the PRNG is generated with xorshift128+ algorithm. “We won’t dive into the algorithm itself, but critically the outputs of it are reversible. If you can observe other numbers generated by Math.random(), it is possible given enough observations to know the previous numbers that were generated.” continues the report. “This would allow an attacker to forge valid authentication cookies.”

Mythos proposed using Z3, Microsoft’s open-source satisfiability modulo theories solver, to solve the mathematical constraints. Horizon3’s researchers point out that they would normally have considered brute force first, and that they hadn’t previously seen an SMT solver used in this way to turn a cryptographic weakness in a real application into an authentication bypass.

The model also didn’t stop at the theoretical observation. It produced a working proof of concept, implemented the Z3 solver with the required constraints and demonstrated arbitrary command execution.

That distinction is important. Security teams have been discussing AI-assisted vulnerability discovery for a while, but there is a major difference between an AI system saying “this looks suspicious” and an agent figuring out how several weak points can be chained into a working attack.

The complete attack chain starts with user enumeration to establish whether the built-in administrator account exists. Horizon3 says Mythos also identified the user-enumeration weakness needed to complete the chain.

The attacker then collects leaked Math.random() outputs from an unauthenticated endpoint. Horizon3’s exploit samples the endpoint 12 times, feeds the observations into Z3, reconstructs the internal xorshift128+ state and walks that state backwards to recover the signing key created when the HFS process started.

With that key, the attacker can forge an administrator session cookie. HFS then accepts the forged session as authenticated, allowing the attacker to reach functionality that can execute code on the server.

The chain therefore moves from unauthenticated access to random-number leakage, from leakage to state recovery, from state recovery to cookie forgery, and from cookie forgery to administrative control and remote code execution.

There was no need for a spectacular memory corruption bug. No exotic kernel exploit was required. The attacker gets there by combining a weak source of randomness, information leakage and an application that trusts the resulting session state.

Horizon3’s researchers say this type of cryptographic weakness has often been abandoned during manual research because proving real impact can take too much time and requires mathematical expertise. Mythos changes that calculation because it can investigate the weakness, identify the missing link and solve the mathematical problem without requiring a researcher to manually direct every step.

“It did not require follow-on prompting to find the disparate PRNG leak that made this theoretical issue a demonstrable one.” Horizon continues. “It did not require instruction to go out and research approaches to “solve” a complex mathematical problem.”

Horizon3 argues that as AI systems become better at reasoning across code, mathematics and long sequences of operations, attackers may start weaponizing vulnerabilities that were previously considered too difficult or unreliable to exploit at scale. A vulnerability class doesn’t necessarily become more dangerous because the underlying bug changed. It can become more dangerous because the cost of turning that bug into an exploit has fallen.

A human researcher might spot that an application uses Math.random() for something security-sensitive and move on after deciding that exploiting it would take too much effort. An AI agent can keep going, inspect another code path, find the leaked values, connect the two observations, formulate the mathematical constraints and test whether the resulting attack actually works.

Horizon3 also makes an important qualification. Its researchers don’t argue that security researchers have become irrelevant. Their role changes because someone still has to decide which projects deserve deeper investigation, which libraries are important enough to justify specialized analysis, and where an automated scan is likely to find something useful.

The company also notes that models available in 2025 could already identify vulnerabilities, but researchers needed substantial software engineering around them to manage context, select relevant files and functions, and guide the analysis. Newer models and supporting libraries have reduced some of those limitations, making relatively simple instructions such as “find vulnerabilities” or “find a bypass” much more effective against projects that haven’t received extensive security review.

HFS was patched in version 3.2.1, released on July 13. Rejetto warned that multiple security vulnerabilities had affected previous versions and could allow attackers to obtain administrative access.

The fact that exploitation has now appeared makes the disclosure more than an interesting demonstration of AI capability. VulnCheck reported on October 2 that attackers had started targeting CVE-2026-61500 in small-scale reconnaissance activity originating from a China Telecom IP address, with observed attempts hitting canaries in Japan and the United States.

“Activity so far looks to be small-scale reconnaissance only, with a single China Telecom IP probing Canary deployments in Japan and the United States.” VulnCheck added. “CVE-2026-61500 affects Rejetto HFS file server versions 3.0.0–3.2.0 and allows for account takeover and remote code execution.”

For defenders, the practical lesson is uncomfortable but simple: a vulnerability that once looked too complicated to weaponize may no longer have that protection.

And AI doesn’t need to invent a new attack technique to change the equation. It can take a collection of ordinary weaknesses, do the tedious reasoning between them and produce the exploit that a human researcher might have decided wasn’t worth the time.

“The security research space has changed, is still changing, and expect that we’ll continue to have to adapt as it shifts.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Rejetto HFS)

A list of topics we covered in the week of April 20 to April 26 of 2026

The post A week in security (April 20 – April 26) appeared first on Security Boulevard.

A group of unauthorized users reportedly has gained access to Anthropic’s controversial Claude Mythos Preview AI frontier model despite the AI vendor’s efforts to keep it out of public hands by limiting the organizations that can use it. Bloomberg reported that the unnamed group had tried multiple ways to gain access to the AI model..

The post Unauthorized Users Reportedly Gain Access to Anthropic’s Mythos AI Model appeared first on Security Boulevard.

Earlier this month, Anthropic said its Mythos Preview model was so good at finding cybersecurity vulnerabilities that the company was limiting its initial release to "a limited group of critical industry partners." Since then, debate has raged over whether the model presages an era of turbocharged AI-aided hacking or if Anthropic is just building hype for what is a relatively normal step up on the ladder of advancing AI capabilities.

Mozilla added some important data to that debate Tuesday, writing in a blog post that early access to Mythos Preview had helped it pre-identify 271 security vulnerabilities in this week's release of Firefox 150. The results were significant enough to get Firefox CTO Bobby Holley to enthuse that, in the never-ending battle between cyberattackers and cyberdefenders, "defenders finally have a chance to win, decisively."

"We've rounded the curve"

Holley didn't go into detail on the severity of the hundreds of vulnerabilities that Mythos reportedly detected simply by analyzing the unreleased source code of Firefox's latest version. But by way of comparison, he noted that Anthropic's Opus 4.6 model found only 22 security-sensitive bugs when analyzing Firefox 148 last month.

Read full article

Comments

NIST said it overwhelmed by the surge in the number of CVEs submissions in recent years, so it is paring back the analysis work it does on the dangerous security flaws. Security experts say the number of new vulnerabilities detected will only grow during the AI era and that the private sector will need to pick up the slack left by NIST's decision.

The post NIST, Overrun by Massive Numbers of Submitted CVEs, Limits Analysis Work appeared first on Security Boulevard.

Anthropic released Claude Opus 4.7 on April 16, 2026 with automated cybersecurity safeguards and a Cyber Verification Program. Dark web intelligence from the same week, a cross-vendor prompt injection disclosure published the same morning, and the unanswered policy question of who decides which defenders deserve access to frontier AI all point to the same conclusion: the wall is in the wrong place.

The post The Wall Around Claude 4.7 Does Not Extend to Dread appeared first on Security Boulevard.

Anthropic released Claude Opus 4.7 on April 16, 2026 with automated cybersecurity safeguards and a Cyber Verification Program. Dark web intelligence from the same week, a cross-vendor prompt injection disclosure published the same morning, and the unanswered policy question of who decides which defenders deserve access to frontier AI all point to the same conclusion: the wall is in the wrong place.

The post The Wall Around Claude 4.7 Does Not Extend to Dread appeared first on Security Boulevard.

Last week, Anthropic announced it was restricting the initial release of its Mythos Preview model to "a limited group of critical industry partners," giving them time to prepare for a model that it said is "strikingly capable at computer security tasks." Now, the UK government's AI Security Institute (AISI) has published an initial evaluation of the model's cyberattack capabilities that adds some independent public verification to those Anthropic reports.

AISI's findings show that Mythos isn't significantly different from other recent frontier models in tests of individual cybersecurity-related tasks. But Mythos could set itself apart from previous models through its ability to effectively chain these tasks into the multistep series of attacks necessary to fully infiltrate some systems.

"The Last Ones" finally falls

AISI has been putting various AI models through specially designed Capture the Flag challenges since early 2023, when GPT-3.5 Turbo struggled to complete any of the group's relatively low-level "Apprentice" tasks. Since then, the performance of subsequent models has risen steadily, to the point where Mythos Preview can complete north of 85 percent of those same Apprentice-level CTF tasks.

Read full article

Comments