Anthropic-linked AI vulnerability hunting has produced another very human outcome: a critical bug, a public proof path, and attackers arriving with the punctuality of a boutique concierge who has misunderstood the word “service.” According to The Register, a flaw found with help from Anthropic’s Mythos model is now being exploited in the wild against Rejetto HTTP File Server, the open source file-sharing server better known as HFS.

🤚 The Open-Palm Cryptographic Tap on the Shoulder

The bug is tracked as CVE-2026-61500, and the practical summary is unpleasantly efficient: it is a critical authentication-bypass vulnerability that can lead to full admin access and remote code execution. That is not a vulnerability so much as a velvet rope politely falling onto the floor.

The discovery came from Zach Hanley at AI penetration-testing company Horizon3, which has access to Mythos through Project Glasswing, Anthropic’s program for giving selected partners access to a bug-hunting model the company has described as too powerful for broad public release. The phrase “too powerful for broad public release” remains one of technology’s finest luxury fragrances: notes of governance, cedar, and future incident response.

Hanley reported that Mythos helped identify an exploitable chain in HFS. Users should update to HFS v3.2.1 or later, which fixes the issue along with other security flaws. This is the practical instruction. The rest is the decorative catastrophe.

👐 The Two-Handed Randomness Audit

The flaw is interesting because it is not merely “someone forgot to sanitize the doom.” HFS generated a random value using Math.random(), then passed that value into Koa, the Node.js web framework underlying the application. Koa used keygrip to sign session cookies with that value. If an attacker can derive the session signing key, they can forge valid session cookies and stroll into the establishment wearing a fake badge that says “Definitely Admin.”

The problem is that V8’s Math.random() did not use a cryptographically secure pseudorandom number generator in this context. Mythos reportedly connected two facts: the algorithm’s state could be reversed, and the application leaked enough raw Math.random() outputs through another path to make recovery feasible. That is the sort of chain humans often describe after the incident as “obvious in retrospect,” which is corporate language for “we would very much like not to discuss the calendar.”

The model also suggested that Z3, Microsoft’s public Satisfiability Modulo Theories solver, could recover the PRNG seed. Horizon3 said its researchers could not recall seeing an SMT solver used this way to exploit a real-world cryptographic weakness and bypass authentication. In other words, the machine did not just notice the broken lock. It brought a mathematician, a clipboard, and a tasteful blazer.

🌿 The Gentle Awakening of Immediate Exploitation

The timeline then performed its traditional slapstick ballet. Hanley published technical details and a video demonstrating the exploit path. By the next day, VulnCheck researcher Patrick Garrity reported exploitation of CVE-2026-61500 against real vulnerable hosts. The initial activity reportedly came from an IP address in China and targeted systems in the United States and Japan. Later hits came from two US-based IP addresses that appeared to be proxies.

This is the part of modern vulnerability management where everyone acts surprised that a public exploit attracts exploitation. It is like opening a champagne bar in a hotel lobby and then expressing concern that people have discovered glasses.

The Register also notes that Garrity has been tracking CVEs attributed to Mythos and Project Glasswing since the program was announced in April. As of Friday, the tracker counted 286 CVEs uncovered through the effort, with this being only the second Anthropic-linked vulnerability known to have been exploited in real-world attacks. That ratio is encouraging if you are measuring research output. It is less comforting if you are the one running the server with the ceremonial welcome mat taped over authentication.

👑 The Gold-Leaf Patch Management Reckoning

The broader lesson is not that AI will replace security researchers, nor that AI should be released with a monocle and a nondisclosure agreement. The lesson is more awkward: advanced models may be extremely good at connecting subtle implementation details, mathematical weaknesses, and real exploitability. That is useful for defenders. It is also useful for anyone else once the knowledge escapes the tasting room.

For defenders, the checklist is mercifully unfashionable:

• Update Rejetto HFS to v3.2.1 or later if it is exposed anywhere consequential.
• Audit internet-facing file servers, especially systems installed years ago and then promoted to “temporary permanent infrastructure.”
• Do not use non-cryptographic randomness for session signing, tokens, authentication gates, or anything wearing a security hat.
• Monitor for suspicious HFS access patterns, forged sessions, and unexpected administrative actions.

The luxury insult here is that the vulnerability was not born from science fiction. It was born from a familiar engineering bargain: this random-looking thing is probably random enough. Then an AI model arrived, unfolded the math like a linen napkin, and revealed that “probably” is not a security boundary. It is a scented candle placed next to the incident report.

“Your file server asked for randomness and received vibes. The attackers found the guest list.” — The Slap of Wisdom Cryptographic Hospitality Desk, polishing the emergency patch bell