The chain
Zach Hanley, a researcher at Horizon3.ai, used Anthropic’s vulnerability-hunting model Mythos to find CVE-2026-61500, a critical authentication bypass in Rejetto HTTP File Server, the company disclosed on Wednesday. Versions 3.0.0 through 3.2.0 are affected; 3.2.1 fixes it.
The flaw is a chain of two weaknesses that are each unremarkable alone. HFS derives the signing key for its session cookies from JavaScript’s Math.random(), which in V8 is the reversible xorshift128+ generator. Separately, an unauthenticated endpoint leaks raw outputs of that same generator to anyone who asks.
Put together, an attacker can collect about a dozen leaked samples, reconstruct the generator’s internal state, step it backwards to the signing key chosen at startup, forge a valid administrator session cookie, and then use the file server’s own built-in JavaScript execution to run code on the host.
Why it had not been found
The interesting part is not the bug but the reason it survived. Recovering xorshift128+ state from a handful of observations is a constraint-solving problem; the published approach uses Microsoft’s Z3 SMT solver. According to The Register’s account, researchers acknowledged they lacked the expertise to pursue that kind of cryptographic route economically — the payoff was too uncertain for the time it would take.
Mythos did not have that constraint. Hanley said the model “simultaneously identified that the application leaked raw Math.random() outputs through a separate code path, recognized those two facts as a chain”, worked out that a solver could recover the seed from the observations available, and produced a working proof of concept without being steered toward the approach.
That is a specific capability claim, and it is narrower than it sounds: the model did not find a new class of bug. It found a known class of weakness in a place where the economics of human attention had left it alone.
Then it was attacked
Exploitation began the following evening. VulnCheck’s Patrick Garrity confirmed attacks from a China-based address against hosts in the United States and Japan, with further attempts the next day from two US-based addresses that appeared to route through proxies.
The Register reports that 286 CVEs have now been attributed to Mythos and the Project Glasswing partnership programme, and that this is only the second of them to be exploited in the wild. The gap between those two numbers is the thing to hold on to: discovery at volume has not so far translated into attacks at volume.
What it means for anyone running HFS
Rejetto HFS is small, widely deployed on personal and small-business servers, and not the kind of software that gets patched on a schedule. An authentication bypass leading to remote code execution, with a public proof of concept and active scanning, is about as urgent as a self-hosted service gets. The fix is 3.2.1.
What to watch
The number worth tracking is not how many CVEs a model can generate but how the disclosure-to-exploitation window behaves as that number grows. One day is already shorter than most operators can patch in. If AI-assisted discovery keeps compressing it, the burden shifts from finding flaws to shipping fixes people actually install.
