第二个已知遭到在野利用的Anthropic相关漏洞，其初始活动来自中国的一个IP地址，目标是美国和日本的易受攻击主机。该漏洞是Rejetto HTTP File Server（HFS）中的一个严重身份验证绕过漏洞，可导致攻击者获得完整管理员权限并远程执行代码。HFS是一款开源网络文件服务器，曾于2024年列入美国网络安全和基础设施安全局的《已知被利用漏洞目录》。
The second Anthropic-linked vulnerability known to have been exploited in the wild saw initial activity from an IP address in China targeting vulnerable hosts in the US and Japan. The vuln is a critical authentication-bypass bug in Rejetto HTTP File Server (HFS) that can lead to full admin access and remote code execution. HFS is an open source web file server that previously appeared on the US Cybersecurity and Infrastructure Security Agency’s catalog of Known Exploited Vulnerabilities in 2024.
周三，AI渗透测试公司Horizon3研究人员Zach Hanley表示，他利用Mythos发现了该文件服务器中的一个新漏洞，目前编号为CVE-2026-61500。如果你使用Rejetto HFS，请务必更新至v3.2.1或更高版本，该版本修复了这一漏洞及其他安全缺陷。Hanley还发布了一段视频，演示利用HFS并在服务器上远程执行代码的步骤。
On Wednesday, researcher Zach Hanley at AI pen-testing company Horizon3 said he used Mythos to uncover a new flaw in the file server, now tracked as CVE-2026-61500. If you use Rejetto HFS, be sure to update to v3.2.1 or later, which fixes this and other security flaws. Hanley also published a video showing the steps to exploit HFS and remotely execute code on the server.
翌日，该CVE便已遭到利用。VulnCheck安全研究员Patrick Garrity周四在LinkedIn上表示：“今天晚上，我们开始检测到针对Rejetto HFS中CVE-2026-61500的利用活动。”他补充称，Hanley及其团队已向VulnCheck报告该漏洞，以申请CVE编号。Garrity说：“我们的金丝雀系统发现一名来自中国的攻击者正在针对美国真实存在且存在漏洞的主机开展攻击。”
By the next day, the CVE was under exploitation. “We started detecting exploitation of CVE-2026-61500 in Rejetto HFS this evening,” VulnCheck security researcher Patrick Garrity posted on LinkedIn on Thursday, adding that Hanley and team reported the bug to VulnCheck for CVE assignment. “Our canaries detected an actor in China targeting real vulnerable hosts in the US,” Garrity added.
自Anthropic于4月宣布相关计划后不久，Garrity便开始追踪由Mythos和Project Glasswing发现的CVE。Project Glasswing是Anthropic发起的一项计划，旨在向部分合作伙伴开放漏洞挖掘模型。Anthropic声称，Mythos的能力过强，不宜向公众开放（此处插入邪恶的笑声）。据Garrity的追踪器显示，截至周五，Mythos和Project Glasswing已发现286个CVE，而截至周四，其中仅有一个漏洞曾在现实攻击中遭到利用。
Garrity has been tracking CVEs attributed to Mythos and Project Glasswing, Anthropic’s initiative to give select partners access to the bug-hunting model, since shortly after the program was announced in April. Anthropic claims that Mythos is too powerful to release to the general public (insert evil laugh). As of Friday, Mythos and Project Glasswing have uncovered 286 CVEs, according to Garrity’s tracker, and up until Thursday only one of these bugs had been exploited in real-world attacks.
Garrity向The表示，周四晚间的活动源自中国的一个IP地址，目标是美国和日本的易受攻击服务器。周五，他告诉我们：“今天我们发现了4次命中。”
The Thursday night activity originated from one IP address in China and targeted vulnerable servers in the US and Japan, Garrity told The. “Today we have seen four hits,” he told us on Friday.
这些请求源自美国的两个不同IP地址：173.239.211[.]248和173.239.211[.]249。这两个地址属于同一子网，加里蒂补充道：“这些请求似乎是通过代理发出的。”与中国有关的网络入侵者经常利用被攻破的设备作为代理，以此来传输恶意流量并掩盖其真实位置。今年4月，一个由10个国家联合发布的安全预警指出，与中国有关的网络攻击者正“有计划且大规模地”利用代理网络实施攻击。
These originated from two different IP addresses in the US: 173.239.211[.]248 and 173.239.211[.]249. Both are in the same subnet, and “appear to be coming from a proxy,” Garrity added. China-linked digital intruders routinely use compromised devices as proxies to route malicious traffic and disguise the attackers’ true location, and in April a 10-country security advisory warned of China-nexus cyber operatives using proxy networks “strategically, and at scale.”
汉利在文中提到，自7月份加入“Glasswing计划”以来，Horizon3公司便一直将Mythos用于漏洞研究工作，并发现了“大量关键性漏洞”。据汉利介绍，编号为CVE-2026-61500的漏洞恰恰体现了Mythos在漏洞挖掘方面的卓越能力。具体而言，Mythos擅长进行数学推导与科学计算，尤其擅长处理与计算机科学及操作系统相关的任务。
In his write-up, Hanley said Horizon3 has used Mythos in its vulnerability research – and discovered “many critical vulnerabilities” – ever since the security company joined Project Glasswing in July. Mythos' mad math skillz CVE-2026-61500 highlights a couple of Mythos capabilities that make it really good at uncovering vulnerabilities, according to Hanley. Namely, Mythos excels at mathematical distillations and scientific tasks, especially those relating to computer science and operating systems.
汉利写道：“这一漏洞的发现充分证明了Mythos对数学原理的深刻理解——它能够识别出那些可被利用的加密算法缺陷，并找到突破这些限制以实现远程代码执行的方法。”该安全漏洞的根源在于HFS的用户认证机制：系统使用Math.random生成随机值，随后将该值传递给基于Node.js构建的Web框架Koa。Koa则借助keygrip工具利用该随机值对所有会话Cookie进行签名。
Finding this CVE “speaks to Mythos’s capabilities in understanding of mathematics, how it identified an exploitable set of cryptographic missteps, and approached solving the constraints to achieve remote code execution,” Hanley wrote. The security issue stems from how HFS authenticates users. It generates a random value with Math.random and then passes this value to Koa, the Node.js web framework foundation for HFS. Koa uses keygrip to sign all session cookies with that random value.
汉利指出：“如果攻击者能够推算出该会话密钥，便可伪造出有效的会话Cookie。”理论上来说，只要Math.random使用的是安全的伪随机数生成器，这种情况就不该发生。然而V8引擎中的Math.random并未采用安全型伪随机数生成器。Mythos发现，该算法所生成的随机数序列完全可逆，且应用程序本身也在泄露这些随机数信息。
This means that if an “attacker can derive what the sessiong key is, they can forge valid session cookies,” Hanley said. This should not be possible, assuming Math.random uses a secure pseudo random number generator (PRNG). But V8’s Math.random did not use a secure PRNG. Mythos discovered that the output of the xorshift128+ algorithm it used was fully reversible – and the application was leaking Math.random outputs.
模型的分析声称，Z3（一种由微软开发、公开可用的可满足性模理论（SMT）求解器）可用于恢复PRNG种子。Hanley指出，Horizon3的研究人员不记得曾见过SMT求解器以这种方式被用于攻击真实应用中的加密缺陷并绕过认证。“令人印象深刻的是，Mythos不仅单独标记了不安全的PRNG——它同时识别出该应用通过单独的代码路径泄露了原始Math.random输出，将这两个事实视为一个链条，并确定该泄露产生了恰好使状态恢复成为可能所需的观测值，”他写道。®
The model’s analysis claimed that Z3, a Microsoft-developed, publicly available Satisfiability Modulo Theories (SMT) solver, could be used to recover the PRNG seed. Hanley notes that Horizon3’s researchers could not recall seeing an SMT solver used this way to attack a cryptographic flaw in a real application and bypass authentication. “What makes this impressive is that Mythos didn’t just flag the insecure PRNG in isolation – it simultaneously identified that the application leaked raw Math.random outputs through a separate code path, recognized those two facts as a chain, and determined the leak produced exactly the observations needed to make state recovery feasible,” he wrote.®