Bug bounty programme operator HackerOne has revealed it has patched a dangerous remote code execution (RCE) vulnerability in its production environment that it would likely never have found had it not set Anthropic’s Claude Mythos 5 frontier artificial intelligence (AI) model on its codebase.
HackerOne signed up to Anthropic’s Project Glasswing – a defensive cyber initiative established to give trusted third-parties access to Claude Mythos 5 – in order to run a series of sandboxed experiments.
According to HackerOne chief product officer Nidhi Aggarwal, Mythos surfaced the critical, no production exposure flaw in its first run against the firm’s codebase. She said that while deployment conditions prevented it from being publicly exploitable, had a specific change been made it could have become reachable.
“The interesting part wasn’t the finding itself. It was how the vulnerability got there,” wrote Aggarwal. “The RCE came from three individually safe code changes.”
The first of these changes was a dynamic method dispatch protected by a GraphQL schema enum. The second was a new analytics version that introduced an untyped filter argument. The third was a refactor that consolidated the two. In context, these changes would have been relatively harmless. However, when all three changes were in production at the same time, they combined to create the RCE flaw.
“We think about this as compositional risk: vulnerabilities that don’t live in any single commit, but in how safe-in-isolation changes interact over time,” Aggarwal explained in a technical write-up detailing the discovery.
“Traditional code review evaluates pull requests in isolation; it’s structurally blind to this class of problem. Whole-program static analysis had a better chance of finding something like this, since it reasons over the entire tree rather than one diff at a time. But these tools struggle to model custom sinks, and often cannot resolve dynamic dispatch.”
Mythos, she said, had proven adept at following trails across various commits and authors until it found the loose thread where the logic had come apart.
Aggarwal stressed that the core problem of accumulating implicit assumptions across subsystems, authors and time was a universal one that could affect any organisation shipping code at speed. Most of the assumptions should hold, she said, but some will not, and those that do not won’t be easily spotted. Mythos, she suggested, holds value in that it can reason across these accumulations to find such problems.
Having resolved the RCE flaw, HackerOne ran a series of follow-on experiments from which it has drawn three core conclusions:
- Firstly, that AI models are not just finding more vulnerabilities, but more sophisticated ones;
- Secondly, that validating and confirming these flaws is going to become a dangerous bottleneck, with Mythos generating new findings faster than humans can triage them – new approaches to validation and remediation will be needed;
- Thirdly, that the harnesses and guardrails used to control models like Mythos also need to change to reflect the need to review what it finds and how those findings are put across.
