Claude Mythos discovered a security vulnerability that has existed for nearly 30 years.

Claude Mythos, the most powerful version of Anthropic’s AI, continues to achieve remarkable feats. Available exclusively to companies participating in the Glasswing project, the AI has just uncovered a security flaw in Squid, one of the most widely used web proxy servers in the world.The server is used in thousands of companies, schools, and even aboard commercial aircraft, to manage users’ Internet traffic.

The vulnerability, dubbed « Squidbleed » by researchers from Calif.io, appeared in the Squid code in 1997, 29 years ago. Everything stems from an old feature built into Squid, namely support for the FTP protocol, an old file transfer system on the Internet. In the 1990s, developers had added a small snippet of code so that Squid would also work with NetWare servers, network software that was widespread in companies at the time. These servers displayed the list of their files in a format slightly different from the others. It is this snippet of code that gave rise to « Squidbleed ».

Also read: Claude Mythos hacked the NSA’s « almost all classified systems » in « a few hours », but it was a test

A vulnerability hidden in a technical detail

A few weeks ago, the researchers tasked Claude Mythos with scanning all of Squid’s code. Quickly, the AI noticed an anomaly in the programming of the proxy server. The bug is hidden in a very small technical detail. When reading a list of FTP files, the program uses an instruction intended to ignore spaces in a text. Unfortunately, this instruction behaves unexpectedly when it reaches the end of the text.Instead of stopping, it continues advancing through memory and begins reading data that does not belong to it, potentially data belonging to another user.

Login credentials, session tokens, and plaintext passwords may thus be exposed to an attacker exploiting the vulnerability. This could potentially be a catastrophe for Squid's many users. For decades, the flaw went unnoticed. No researcher had ever laid a finger on this unexpected behavior. The flaw was rated "moderate" by researchers. To exploit it, an attacker must already be a legitimate user of the targeted proxy and control an FTP server accessible from that proxy. HTTPS traffic, which today accounts for the vast majority of connections, is not affected by the security flaw. A patch was added in the Squid v7.6 update to close the breach.

10,000 security flaws uncovered by Mythos

This is not the first time Claude Mythos has uncovered an unknown flaw that had been festering in computer code for years. The AI also found a 27-year-old vulnerability in the OpenBSD system, used to run critical firewalls, and a bug present for 16 years in FFmpeg, a video library used on millions of devices.Since its creation, Mythos has found more than 10,000 vulnerabilities in open-source software.

👉🏻 Follow tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.

Source: Calif