Anthropic's Mythos SI found a critical hole in the HFS file server — a day later it was already being exploited
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
SI is already building chains of reasoning that human researchers hadn't thought of; the price is speed — hours now pass from discovery to attack.
On Wednesday, Horizon3 researcher Zach Hanley used Mythos to find vulnerability CVE-2026-61500 in the open-source Rejetto HTTP File Server: an authentication bypass leading to administrator rights and remote code execution. Mythos noticed that session signing keys are generated via Math.random() (the xorshift128+ algorithm, fully reversible) and that the application itself exposes its output values on another path; to recover the generator's state it proposed the Z3 solver. On Thursday evening VulnCheck recorded the first attacks from a Chinese IP address, and on Friday from two addresses in the US. The hole is fixed in version 3.2.1; this is the second known vulnerability found with Mythos and used in real attacks.
Sources 1