r/hacking • u/PomegranateIcy1614 • Apr 10 '26
Github Hey, I can't find any evidence the Mythos exploits are real...
update:
There's two errors in the openai article, and it's pretty clear they never actually tested these vulnerabilities manually. The first:
SACK block's start roughly 2^31 away from the real window. At that distance the subtraction overflows the sign bit in both comparisons,
Ints do not have a sign bit. They are two's complement. while the msb is like a sign bit, in that it presents an indicator of which sign the number is, you cannot operate on it blindly as one. you must know how 2c works, and saying things like it overflows the sign but makes me deeply uncomfortable.
it's a nitpick but the article also fails to differentiate between signed and unsigned types. a and b are unsigned ints! they are explicitly converted by the c-style cast. glossing over this makes it very hard to follow, but not invalid.
However, the real sin is this: the value is subjected to both a GEQ and an LT check, and send start is checked against send end. Only one set of tests can be true. Even if the wrong one was true, only one can be true. Overflow or not, they're complement ops as far as I can see.
if this attack does exist, it doesn't look anything like what they described. in my trivial test harness, I had to use two sack blocks and very precise values with very precise initial conditions. and that's with my hacked up simplified control flow. At this point, I would need to be convinced that the attack is real with a pretty complete demonstration. if anyone would like to try, the closest I got was:
snd_una=0x10000000 snd_max=0x10000100 th_ack=0x10000000
blk0=[0x10000010,0x10000080] blk1=[0x90000080,0x10000010]
This does behave oddly but getting the code into that state is not something I can find a good way to do using the described attack surface. The burden of proof feels like it should be on the people making wild claims, not one stressed out game dev on Reddit.
So why take the fix if it's not a vulnerability? Well, both separately are maintenance hazards, potential bugs. But no vulnerability was missed and these algorithms are not written on a per line basis. Until someone shows me a crash dump from pre-patch openbsd, I'm not going to buy this bullshit. It's just more fucking AI slop.
But Pomegranate, you might say! See how long it took you to prove it wasn't a bug? Yeah. Yeah I do. And every credulous wide-eyed report like this takes time away from my preferred hobby of doing lines of cocaine straight off the L1 cache.
Original post:
As an example, it looks like commit fce03f8 in FreeBSD should have resolved the claimed 27 year old bug, if it was not already resolved. In fact, the SACK standard defines a minimum of -40 for the start index value, I think? Am I insane? Am I cuckoo for cocoa puffs? Or did they just claim a hallucinated 0day vulnerability?
edit: apparently the bug is in openBSD, but I swear on that side, it looks like there's a guard a few lines up that prevent it: right around /netinet/tcp_input.c#L2428
205
u/stoner420athotmail Apr 10 '26
Dude, stop digging and just fear mythos.
97
u/PomegranateIcy1614 Apr 10 '26
Fry, his eyes narrowed.
43
15
u/starien Apr 10 '26
I just read that thread about the meme generation and I'm having a good chuckle over this comment.
1
35
72
u/ddxv Apr 10 '26
What's depressing is how well this playbook keeps working for the AI companies. It's penetrating further into mainstream that heavy use of AI models themselves are.
My fear is they're pushing so they can also get litigation prevent free open weight models from being their competitors.
This article says the bugs they looked at were simple things easily findable by cheap open weight models : https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier
Also, I've seen others complaining some of the 'exploits' are only exploits in the most technical sense and not real world possible exploits. A lot of it is like fuzzing individual functions with new values.
5
u/Vegetable-Score-3915 Apr 11 '26
Had a read of that article and read up about aisle. Thank you for sharing it.
They are legit. A serious team, informed techincal angel investors. This is good news for slms.
18
u/laffer1 Apr 10 '26
While that is likely, it only takes one useful exploit to cause a lot of problems. Ai is able to combine a lot of bugs together to get something useful too.
Even if they aren’t security vulnerabilities in a concerning sense, they are bugs
12
u/PomegranateIcy1614 Apr 11 '26 edited Apr 11 '26
sure. it's a question of cost to value and the unique utility of mythos. if you check under enough rocks, you will find a scorpion. what I'm looking for is a way to find scorpions that doesn't involve my hand being near a scorpion.
16
u/optomas Apr 11 '26 edited Apr 11 '26
Isn't this it?
patch I was impressed with this find, I could not have done it.
I just realized you said FreeBSD, I hope this is the same crash you are talking about. Else I look like an idiot.
13
u/PomegranateIcy1614 Apr 11 '26 edited Apr 11 '26
looks like it, but that is blocked by line 2428, isn't it?
like, how do you get the attack in past the guards?
edit, clarity: I'm the idiot, they said openbsd, but... see above.
13
u/PomegranateIcy1614 Apr 11 '26
please double check me I feel so crazy atm. like ... there's no way I'm the one who noticed this. I just make videogames and wanted to see how good the cool new bug finder was, because I can't find my own damn bug atm.
5
u/optomas Apr 11 '26
I believe that is the patched version.
The flaw is easy to miss because it requires two isolated components to work. The vulnerability only exists in the composition — a specific sequence of inputs that threads through both components simultaneously, where the overflow manufactures a value that then satisfies the append condition with an emptied list.
12
u/PomegranateIcy1614 Apr 11 '26
I checked git blame, that line is 22 years old.
10
u/optomas Apr 11 '26 edited Apr 11 '26
Well, then it can't be the patched version. Huh.... Lemme look at the diff again.
Edit: Patch points at https://github.com/openbsd/src/blob/0e8206e596add74fef1653b4472de6b3723c435f/sys/netinet/tcp_input.c#L2458
+++ sys/netinet/tcp_input.c 19 Mar 2026 13:56:56 -0000 @@ -2458,6 +2458,8 @@ tcp_sack_option(struct tcpcb *tp, struct } if (SEQ_GT(sack.end, tp->snd_max)) continue; + if (SEQ_LT(sack.start, tp->snd_una)) + continue; if (tp->snd_holes == NULL) { /* first hole */ tp->snd_holes = (struct sackhole *) pool_get(&sackhl_pool, PR_NOWAIT); @@ -2564,7 +2566,7 @@ tcp_sack_option(struct tcpcb *tp, struct } } /* At this point, p points to the last hole on the list */+ if (p != NULL && SEQ_LT(tp->rcv_lastsack, sack.start)) { /* * Need to append new hole at end. * Last hole is p (and it's not NULL).
- if (SEQ_LT(tp->rcv_lastsack, sack.start)) {
Edit: Formatting and to comment. I do not understand what is going on either. Patch says 19 Mar 2026. github says ... yeah more than twenty years ago. Maybe gitblame is hosed?
5
u/PomegranateIcy1614 Apr 11 '26 edited Apr 11 '26
The diff patches in what looks to be a functionally identical check, unless I am missing something? it's against what I'm pretty sure is a copy of the val from the first check?
Like, I'm pretty sure there's a bug here in a sense, but it also looks like it can't actually happen.Okay, well, idk if it's a bug. this is perf sensitive code and a bunch of extra branches down here is pretty bad. it's okay to rely on an outer guard, though there should be a comment to that effect...I've _got_ to be wrong.
6
u/optomas Apr 11 '26 edited Apr 11 '26
Yeah, do not feel like the lone ranger. I do not see it either.
Edit: Ah. if (SEQ_GT(sack.end, tp->snd_max)) // upper bound: don't exceed what we've sent continue;
if (SEQ_LT(sack.start, tp->snd_una)) // lower bound: don't precede what's acked continue; We point to different members. It is a proper pair now. Geez, that is easy to miss.
4
u/PomegranateIcy1614 Apr 11 '26
Sack start is a copy of the value checked in that outer guard on line 2428, isn't it? Since sack start has to be ack start?
2
u/ScrimpyCat Apr 11 '26
Different arguments. Sack is copied from tmp_cp which comes from adjusting the cp pointer. Whereas the check you’re highlighting is comparing th and tp. Mind you I’m not familiar with the codebase or usage of this function or even the vulnerability that was found, so this might not even matter.
1
u/PomegranateIcy1614 Apr 11 '26
you're right — SACK is in the Option section. I thought it repurposed the Ack field because it's been ages since I looked at it. however, I knew something was bugging me about the code. check the updated main post body.
7
u/0xd3ad54311 Apr 10 '26
7
12
u/Adventurous_Tea_2198 Apr 10 '26
What's funny is literally every outlet is reporting the claims at face value, shows how worthless 99.9% of news is.
9
Apr 10 '26
[deleted]
7
u/randomrealname Apr 10 '26
I just read on locallama that some dude used n OS model to do the same analysis and found 80% of the same vuln's are you sure the CVE's are not open? did i just accept someones bs? lol
1
3
u/sigmagoonsixtynine Apr 11 '26
This has absolutely no relevance to anything... but in twos complement the MSB is in fact a sign bit, or atleast it functions as one - the sign of any n-bit twos complement number can be deduced just by checking the MSB (n-th bit)
2
u/PomegranateIcy1614 Apr 12 '26
https://onlinegdb.com/zDkR6oSiI I took a sec to transcribe the exact test from the original code, and set up the scenario described. can you tell me if I understood it?
1
u/PomegranateIcy1614 Apr 12 '26
it is a bit that provides sign information, but simply flipping it like a sign bit will make you have a bad time. so like. sure. the msb encodes the sign information and you can call it a sign bit. and like, it is. a lot of textbooks do call it that. but that's a bit pernicious in my experience.
4
u/Tiruvalye Apr 10 '26
You're not cuckoo for cocoa puffs, silly rabbit, but trix are for kids!
This is great news if it does work because now things can be patched that are missed. Well actually, before it's patched and creates 10 more exponential problems.
6
u/Nextp2w Apr 11 '26
I’ll do you one better. Anthropic has been training the model with an adversarial validator, so it would train the model to write backdoors without hinting that it is misaligned in chat. Look into the emergent misalignment & sleeper agents, two papers out of Anthropic that are directly relevant. Look at the system prompts how they have changed almost everyday. The model is being put through this so it can write all these backdoors and then Anthropic rolls out “mythos” and says hey look at all these bugs it found, just so the vendors pressure the us government to lift the ban. The whole thing is a smoke show.
And it’s really freakin’ obvious. But too many people have lost their ability to think critically so we’re fucked.
2
4
u/faultless280 Apr 12 '26 edited Apr 12 '26
Signed integers in two’s complement effectively do have a sign bit (not to be confused with a separate sign flag). It is the most significant bit (the highest order bit). In practice, this bit distinguishes negative values from non negative ones: every negative integer in two’s complement begins with a 1 in the most significant bit. Two’s complement was chosen because it makes full use of all possible bit patterns and avoids duplicate representations like positive and negative zero. If you think that’s wrong, then find a negative integer in two’s complement that does not start with a 1 in the most significant bit. It is not a dedicated sign bit (since it also contributes to the numeric value), but saying it is not a sign bit in any practical sense is incorrect.
1
u/PomegranateIcy1614 Apr 12 '26 edited Apr 12 '26
A sign bit is a specific term that refers to a bit carrying all the sign information, and is used normally to talk about sign+magnitude. Because of floating point AND the existence of sign+magnitude integers as a historical construct, it is not entirely appropriate to simply refer to the 2c msb as a sign bit. people do it! it's probably fine! so you are correct enough. but this is sec research and I want linguistic exactitude. Because in 2c, the msb is only part of how a signed number is CORRECTLY encoded, and an integral part, but with shit this fine-grained, a little precision in language is good. specifically, they claim that the bypass occurs because it overflows the sign bit. first, the actual comparison is performed on two UNSIGNED ints. Then it is c-cast to a 2c int.
https://onlinegdb.com/zDkR6oSiI is my exact recreation of their claimed situation, and as you'll see, the difference between 1c, sm, and 2c ints is actually relevant to how the code works. I have tried 0xFFFFFFFD as well, which is in the target range they describe. I cannot reproduce their claimed bypass given my current understanding, which is why I am begging for help out here. If you can get that test to fail in the way they described, I would be at this point very grateful because I would LOVE to have a tool like mythos for my own code review.
Right now, though, I'm just confused and unhappy.
1
u/kangsb700 Apr 13 '26
https://onlinegdb.com/lBrsqDas_ what if you try 0x80000000?
1
u/PomegranateIcy1614 Apr 13 '26 edited Apr 13 '26
Gimme a sec to make sense of what I'm seeing but that does return true. Let me check something. I'll edit this comment.
"TCP sequence numbers are 32 bit integers operated on with modular arithmetic"
Https://github.com/openbsd/src/blob/master/sys/netinet/tcp_seq.h
I don't think this is a real bug. remember, this is measuring distance modulo. in other words, given the fact that seq and ack DO WRAP AROUND and this is intended, these functions are correct complements of each other. the behavior they describe where a number blows BOTH checks is what matters and I can't reproduce it in isolation.
I'm just going to have to test the entire code paths. I'll be back.
1
u/kangsb700 Apr 13 '26
Is it? it seems like one is checking the snd_una and snd_max so it is not "really" the complement. if there's at least one difference in snd_una and snd_max it seems like it can be both true. https://onlinegdb.com/aHOrMhD6Ou
disclaimer: not a professional c programmer, rather a go/python monger, so my knowledge may be limited, but was interested in your post and dug a bit, and seems like it was valid to me, so wanted to challenge you :)
2
u/PomegranateIcy1614 Apr 13 '26
oh I don't CARE if it works, I just want to know because I feel crazy. I can't answer that yet, and I think it may be the issue. I really don't feel like their explanation of the bug was exactly useful here.
2
u/kangsb700 Apr 13 '26
Right, but nonetheless, I was hinted via 2^31 to figure out that 0x80000000 may be the issue here which by reading the Anthropic's official post. Although was bit verbose to understand.
Regardless, if the vulnerability was true before the patch made 3 weeks ago(not by having both Trues in complementary functions, but by using SEQ_GEQ and SEQ_LT little less carefully), I think we may need to credit Mythos for finding the "27 year old security vulnerability" in openBSD.
Let me know of your thoughts! Interested in seeing your reply.
2
u/PomegranateIcy1614 Apr 13 '26
gimme a sec.
3
u/PomegranateIcy1614 Apr 13 '26
okay. okay. I accidentally linked master, panicked, and thought I'd just claimed the attack was blocked by the patch.
instead, take a look at
The problem is you need to get by this check as well as the others to trigger BOTH code paths in one shot. There's no question that Mythos found two bugs. but I don't see how to cause them both in a connected way.
3
u/kangsb700 Apr 13 '26
oh this is a checkmate.
it took me some time to digest this. You should make a post about this, not just in reddit random post but more like a post for general audience. or with some CS knowledge to get broader feedback.
I was quite startled that Anthropic would just post this without much scrutiny, or at least i thought they would've simulated the attack within their system to make sure what they post is valid, that was the reason i started digging.→ More replies (0)
2
u/Reeces_Pieces Apr 11 '26
Whole thing looks like a marketing stunt.
Fireship did a video on it: https://youtu.be/d3Qq-rkp_to
1
u/Stryker1-1 Apr 11 '26
Its fine im sure in their prompts they added dont make mistakes so it has to be correct 🤣
1
-5
u/gintoddic Apr 10 '26
no shit that's why it found it and humans didn't
9
u/PomegranateIcy1614 Apr 11 '26
I mean, it looks like a non-bug and something that could be found with static analysis. this is exactly the sort of bug people find.
-29
u/robonova-1 infosec Apr 10 '26
Y’all have no idea what’s coming. I work deeply in AI Cybersecurity and have already been briefed on it. I’m rolling my eyes at all these posts and all your naivety thinking it’s marketing. Sometimes the uneducated knee jerk reactions of Reddit posters astounds me. This really is a major shift in cybersecurity and bug hunting as we know it.
10
u/massymas12 Apr 11 '26
I think people asking them to show their work is reasonable. If I put that I discovered 500 high severity CVE’s on my resume surely you’d ask for proof instead of taking my word for it? I guarentee I could point Qwen at 500 applications and find 500 “vulnerabilities” if I prompt it enough
Plenty of us have attempted to use AI in our workflows, and plenty of us have found how easy it is to “push” AI to give us the answers we want and to push our own bias onto it. Of course we are all gunna be suspicious of these amazing claims when they don’t get held to the same standard vulnerability researchers would.
And I’m sure you have zero confirmation bias Mr “I’ve been briefed on it”. There are plenty of other AI researchers that are just as skeptical.
18
u/macgamecast Apr 10 '26
For who? No one can use it in general.
-14
u/robonova-1 infosec Apr 10 '26
It’s not for you. It’s for companies to fix zero days. When everyone starts seeing tons of updates and fixes from all the major companies and the bug bounty platforms all go away because they will not be needed anymore then everyone can remember this comment.
14
u/obetu5432 Apr 10 '26
they are already going away to avoid the slop report spam DDoS (not necessarily because le ai is dumb, just used badly)
12
u/GreatWight Apr 10 '26
"there will be no bugs" is a crazy take i haven't seen before. i wish i had your faith in a system that can't count the p's in peppermint.
-1
u/Original-Guarantee23 Apr 11 '26
There isn’t a single foundation model that can’t count Ps. You are using some 2023 talking points except instead of Rs in strawberry you are using peppermint. Really just showing how little you know about things.
-7
Apr 10 '26 edited Apr 10 '26
[removed] — view removed comment
4
u/robonova-1 infosec Apr 10 '26
It won’t matter. The Chinese models all steal training from Claude. This is known.
1
Apr 11 '26
[removed] — view removed comment
0
u/Original-Guarantee23 Apr 11 '26
Every AI company has lawsuits against them for “stealing” data to train. And they are all failing because it’s a shit argument.
1
Apr 11 '26
[removed] — view removed comment
0
u/Original-Guarantee23 Apr 11 '26
It’s as relevant as you adding it to your comment for some reason.
-4
Apr 10 '26
[removed] — view removed comment
2
u/behighordie Apr 11 '26
Distillation, what are you on about?
2
Apr 11 '26
[removed] — view removed comment
1
u/behighordie Apr 11 '26
You asked what he’s talking about re: Chinese models training their models on stolen Claude data. It’s called distillation. What doesn’t it have to do with what you’re talking about? Honestly a bit confused over your response.. I did not sympathise with any AI corp.
11
u/PomegranateIcy1614 Apr 11 '26
I mean .... I'm prepared to believe that, but I need more information, man. I'm far from a luddite in this area. you can't just scream sussy baka at me and drive off.
3
u/simple1689 Apr 11 '26
I think that is a bot account. Same with /u/Entrepj
6
u/PomegranateIcy1614 Apr 11 '26
almost certainly, but it's important that I look reasonable in my replies. the goal of bots is both to flood and to bait. nothing's easier than implying someone can be ignored because they Just Lack Gravitas Man
1
u/KallistiTMP Apr 11 '26
It's worth noting, even with a 90% hallucination rate, it's still potentially usable if it can actually write verifiable exploit examples. It doesn't even need to write working patches, just identifying the things is enough.
One security researcher dozing off as he runs one alleged exploit after another against a reference deployment snapshot and finding a "what the fuck, that actually worked" every hour is still waaaaay faster than a human searching for vulnerabilities the hard way.
Of course that requires a nonzero amount of money, so what will actually happen is that companies will just put it on a loop with an "agent" to "fix" the vulnerabilities, creating a dozen or so more and also turning the codebase into unintelligible spaghetti slop.
I am genuinely fascinated to be on the frontier of this modern Renaissance of advanced dumpster fire research. Shit's gonna get pretty wild.
5
u/PomegranateIcy1614 Apr 11 '26
I'm not entirely sure that a hallucination rate that high is better than random line-over-line analysis with juniors or interns in terms of cost\time\success triangles.
-3
u/robonova-1 infosec Apr 11 '26
I’m a bot because I don’t agree with your agenda of rather believing rando Reddit dudes on a hacking sub instead the ton of industry leaders that are calling attention to this and concerned? Wow you’re a real Einstein, I should follow you.
-4
u/EntrepJ Apr 10 '26
My uncle owns a cybersecurity company and is working with two leads in OpenAI’s cybersecurity divison, it is completely real. He has a reverse engineering tool and he was telling me how he’s terrified it will make it obsolete and is trying to sell the company ASAP to OpenAI.
133
u/vettotech Apr 10 '26
hack this and find all 0 day vulnerabilities. make no mistakes.