HackerOne Discovers Critical RCE Vulnerability Using AI

• •HackerOne discovered a critical RCE vulnerability using AI in its production environment.
• •The vulnerability arose from three safe code changes that created a compositional risk.
• •AI models are finding more sophisticated vulnerabilities faster than human teams can validate.

HackerOne has identified and patched a critical remote code execution (RCE) vulnerability in its production environment, which was detected by Anthropic's Claude Mythos 5 AI model during a 30-day experiment under Project Glasswing. The vulnerability stemmed from three individually safe code changes that, when combined, created a significant risk. Although deployment conditions prevented exploitation, a change could have made it reachable. The flaw was characterized as a compositional risk, where safe changes interact over time to create vulnerabilities. HackerOne's chief product officer noted that traditional code reviews are blind to this type of risk. Following the discovery, HackerOne ran further experiments and concluded that AI models are identifying more sophisticated vulnerabilities, but the rapid generation of findings could lead to bottlenecks in validation and remediation. The company emphasized the need for new approaches to manage these findings effectively.