Mythos · China · Japan · Anthropic · The Register
Anthropic's super flaw-hunting model Mythos is hardcore good at math, as latest vuln under attack indicates
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Exploitation attempts came from China-hosted IP, VulnCheck researcher says.
Key facts
- These originated from two different IP addresses in the US: 173.239.211[.]248 and 173.239.211[.]249
- On Wednesday, researcher Zach Hanley at AI pen-testing company Horizon3 said he used Mythos to uncover a new flaw in the file server, now tracked as CVE-2026-61500
- We started detecting exploitation of CVE-2026-61500 in Rejetto HFS this evening,” VulnCheck security researcher Patrick Garrity posted on LinkedIn on Thursday, adding that Hanley and team reported
- CVE-2026-61500 highlights a couple of Mythos capabilities that make it good at uncovering vulnerabilities, according to Hanley
Summary
The second Anthropic-linked vulnerability known to have been exploited in the wild saw initial activity from an IP address in China targeting vulnerable hosts in the US and Japan. The vuln is a critical authentication-bypass bug in Rejetto HTTP File Server (HFS) that can lead to full admin access and remote code execution. On Wednesday, researcher Zach Hanley at AI pen-testing company Horizon3 said he used Mythos to uncover a new flaw in the file server, now tracked as CVE-2026-61500. Hanley also published a video showing the steps to exploit HFS and remotely execute code on the server.