Anthropic's Mythos finds Rejetto HFS flaw, exploited in a day
TL;DR
- Mythos chained two independently benign code paths — weak PRNG seeding and login-handler output leakage — without follow-on prompting, a step that previously required sustained human cryptographic analysis.
- Twelve unauthenticated login requests yield enough Math.random() outputs to reconstruct V8's xorshift128+ state and forge a valid admin session cookie.
- A China-based IP hit US and Japanese HFS servers within 24 hours of disclosure; four more hits from US-based proxies followed within 48 hours, per VulnCheck canary data.
Anthropic's Mythos model found a critical authentication-bypass bug in Rejetto HTTP File Server. Within a day of Wednesday's disclosure, VulnCheck's canaries picked up an attacker in China hitting vulnerable servers in the US and Japan.
The flaw, tracked as CVE-2026-61500, sits in how HFS derives the signing key for its Koa session cookies: from Math.random(). V8's implementation of Math.random() runs on the xorshift128+ algorithm, which The Register reports Mythos determined was "fully reversible" once the application leaked outputs through a separate code path. Two facts chained: a forged cookie, an admin session, remote code execution.
"What makes this impressive is that Mythos didn't just flag the insecure PRNG in isolation," wrote Horizon3's Zach Hanley. "It simultaneously identified that the application leaked raw Math.random() outputs through a separate code path, recognized those two facts as a chain, and determined the leak produced exactly the observations needed to make state recovery feasible."
VulnCheck's Patrick Garrity said the firm's "canaries detected an actor in China targeting real vulnerable hosts in the US." By the next day he reported "four hits" from two US proxy IPs, 173.239.211[.]248 and 173.239.211[.]249. Horizon3 joined Anthropic's restricted-access Project Glasswing in July 2026.
The piece notes Anthropic claims Mythos is "too powerful to release to the general public." This is the second Anthropic-linked vulnerability now known to be exploited in the wild. The fix is Rejetto HFS 3.2.1 or later.
What others are reporting
-
Superpower Daily Read →
Frames the finding through Horizon3's research methodology and their forecast that AI makes complex multi-step exploits economical at scale; notes at time of writing no widespread attacks had been confirmed.
It did not require follow-on prompting to find the disparate PRNG leak that made this theoretical issue a demonstrable one.
-
DEV Community Read →
Defensive engineering angle: supplies actionable grep commands for auditing codebases for Math.random() in security contexts and frames the two stacked mistakes as a generalizable pattern for code review.
The signing key becomes randomBytes(32).toString('base64url') and the sid becomes randomUUID(). Both come from Node's cryptographic generator.
-
DEV Community Read →
Six-step technical exploitation chain: harvesting six Math.random() outputs, brute-forcing 2,048 missing-bit combinations, recovering the signing key, then reaching RCE via HFS's server_code config feature.
Any value with a security role — including a session identifier that looks like throwaway metadata — needs a CSPRNG.
Originally reported by theregister.com
Read the original article →Original headline: Anthropic's Mythos finds Rejetto HFS auth bypass, China actor exploits CVE-2026-61500 within 24 hours