Anthropic Mythos model discovers Rejetto HFS authentication bypass vulnerability CVE-2026-61500, probed and exploited the day after public disclosure
Mythos-Found Rejetto HFS Flaw Probed Within a Day of Public Write-Up
Rejetto HFS 3.0.0 through 3.2.0 has an authentication bypass vulnerability, CVE-2026-61500 (CVSS 9.3). Attackers can forge an administrator session and achieve remote code execution; the vendor released HFS 3.2.1 on July 13, 2026 to fix it. The flaw was discovered by Zach Hanley of Horizon3.ai using Anthropic's Mythos model. Mythos identified that a weak random number generator and login output leakage could be chained, and suggested using the Z3 SMT solver to recover the generator's state. Probe attempts appeared within about a day of Horizon3.ai publishing technical details and a PoC video; reported activity so far is small in scale, with no confirmed successful intrusions.