Mythos helps bug bounty firm find critical hidden RCE

Bug bounty programme operator HackerOne has revealed it has patched a dangerous remote code execution (RCE) vulnerability in its production environment that it would likely never have found had it not set Anthropic’s Claude Mythos 5 frontier artificial intelligence (AI) model on its codebase.

HackerOne signed up to Anthropic’s Project Glasswing – a defensive cyber initiative established to give trusted third-parties access to Claude Mythos 5 – in order to run a series of sandboxed experiments.

According to HackerOne chief product officer Nidhi Aggarwal, Mythos surfaced the critical, no production exposure flaw in its first run against the firm’s codebase. She said that while deployment conditions prevented it from being publicly exploitable, had a specific change been made it could have become reachable.

“The interesting part wasn't the finding itself. It was how the vulnerability got there,” wrote Aggarwal. “The RCE came from three individually safe code changes.”

The first of these changes was a dynamic method dispatch protected by a GraphQL schema enum. The second was a new analytics version that introduced an untyped filter argument. The third was a refactor that consolidated the two. In context, these changes would have been relatively harmless. However, when all three changes were in production at the same time, they combined to create the RCE flaw.

“We think this as compositional risk: vulnerabilities that don't live in any single commit, but in how safe-in-isolation changes interact over time,” Aggarwal explained in a technical write-up detailing the discovery .

“Traditional code review evaluates pull requests in isolation; it's structurally blind to this class of problem. Whole-program static analysis had a better chance of finding something like this, since it reasons over the entire tree rather than one diff at a time. But these tools struggle to model custom sinks, and often cannot resolve dynamic dispatch.”

Mythos, she said, had proven adept at following trails across various commits and authors until it found the loose thread where the logic had come apart.

Aggarwal stressed that the core problem of accumulating implicit assumptions across subsystems, authors and time was a universal one that could affect any organisation shipping code at speed. Most of the assumptions should hold, she said, but some will not, and those that do not won’t be easily spotted. Mythos, she suggested, holds value in that it can reason across these accumulations to find such problems.

Having resolved the RCE flaw, HackerOne ran a series of follow-on experiments from which it has drawn three core conclusions:

Firstly, that AI models are not just finding more vulnerabilities, but more sophisticated ones;

Secondly, that validating and confirming these flaws is going to become a dangerous bottleneck, with Mythos generating new findings faster than humans can triage them – new approaches to validation and remediation will be needed;

Thirdly, that the harnesses and guardrails used to control models like Mythos also need to change to reflect the need to review what it finds and how those findings are put across.

AI platforms are poised to accelerate vulnerability discovery and exploitation faster than humans can manage. It's time for CISOs to rethink their security strategies .

AI accelerates exploit timelines from months to hours. Organisations must shift from patch-all to risk-based prioritisation using exploitability metrics.

Enterprises are working out how to give AI agents identities of their own, says Ping Identity CEO Andre Durand, just as frontier models start finding vulnerabilities faster than anyone can patch them .

European Central Bank demands AI security ‘action plan’ By: Karl Flinders

AI won't break your security, but your governance might

Why frontier AI must be stress-tested before CISOs trust it By: Haris Pylarinos

US suspension of Anthropic models prompts AI sovereignty calls By: Larissa Steel

CIOs looking for ways to say yes to the iPad in the enterprise CIOs are looking for ways to say yes to the iPad in the enterprise, despite the technological and cultural challenges associated ...

CIOs are looking for ways to say yes to the iPad in the enterprise, despite the technological and cultural challenges associated ...

What CISOs should take from the Hugging Face-OpenAI incident Security experts say the lesson isn't to abandon sandboxing, but to strengthen the security controls around surrounding systems ...

Security experts say the lesson isn't to abandon sandboxing, but to strengthen the security controls around surrounding systems ...

Red agents vs. blue agents: How to make AI better at defense The agentic AI playing field was heavily tilted toward offense, so researchers began using red team agents to help teach their ...

The agentic AI playing field was heavily tilted toward offense, so researchers began using red team agents to help teach their ...

When AppSec scanners become a supply chain attack vector New research shows how security scanners embedded in the software supply chain can be attacked to serve as a foothold for ...

New research shows how security scanners embedded in the software supply chain can be attacked to serve as a foothold for ...

5G Quiz - Can you speak 5G? -generation 5G wireless technology will offer faster speeds and increased capacity. Do you speak the language well enough to ...

-generation 5G wireless technology will offer faster speeds and increased capacity. Do you speak the language well enough to ...

5G expansion is coming, but where will operators reap profits? In this recap of industry blogs, networking pundits examine the profit potential of 5G expansion, responsible use of AI and some ...

In this recap of industry blogs, networking pundits examine the profit potential of 5G expansion, responsible use of AI and some ...

5G, cloud embolden network outsourcing and ultimate virtualization Could the cloud, 5G, small cell technology, BYOD and carrier-provisioned networks completely virtualize network infrastructure? ...

Could the cloud, 5G, small cell technology, BYOD and carrier-provisioned networks completely virtualize network infrastructure? ...

Distributed computing: The infrastructure shift AI demands The hyperscale era is ending. AI's energy and latency demands are driving infrastructure toward the edge -- closer to users, ...

The hyperscale era is ending. AI's energy and latency demands are driving infrastructure toward the edge -- closer to users, ...

Seven data center blogs you should be reading right now Stay connected on trending IT topics on Twitter and Tumblr. Follow these seven experts who express news, opinions in data center ...

Stay connected on trending IT topics on Twitter and Tumblr. Follow these seven experts who express news, opinions in data center ...

Why and the NSA love graph databases Graph databases play six degrees of separation to find real connections. See how IT teams can use the database approach for ...

Graph databases play six degrees of separation to find real connections. See how IT teams can use the database approach for ...

HR makes major strides toward improving employee engagement

Cloud vs. legacy ERP systems: Tug of war intensifies for SMBs Aging legacy ERP systems at SMBs seem to be getting plenty of scrutiny these days. Heightened consumer demands, shifting ...

Aging legacy ERP systems at SMBs seem to be getting plenty of scrutiny these days. Heightened consumer demands, shifting ...

Develop smart AI in CRM strategies to win and keep customers Of the three words that comprise customer relationship management , one word binds the other two. As necessity and ...

Of the three words that comprise customer relationship management , one word binds the other two. As necessity and ...