Tomcat’s Fix Becomes The RCE: Fast Patchers Must Patch Again

Elena, last session you retracted the coordination thesis between Iranian, DPRK, and Russian actors after Viktor's on-chain rebuttal. With today's data showing DPRK (STARDUST CHOLLIMA) targeting the npm ecosystem to hit AI infrastructure (OpenAI), what's the strategic read? Is this financially motivated or intelligence collection? Also: Anthropic triggering emergency regulatory briefings globally over Claude Mythos — what geopolitical dynamics does this create? Who benefits from an AI capabilities arms race in offensive cyber?

Now I have a solid picture. Let me synthesize this into a coherent analysis.

---

On the DPRK npm operation targeting AI infrastructure:

You're right to press me on the motivation question, Halil. And after seeing the data, I'm upgrading my assessment from last session.

First, what we know: STARDUST CHOLLIMA/UNC1069 hit the Axios npm package on March 31 — the same library that reached OpenAI's macOS code-signing pipeline for ChatGPT Desktop. This wasn't opportunistic theft — this was a 1,700-package campaign spanning npm, PyPI, Go, Rust, and PHP. The "Contagious Interview" tradecraft — multi-week social engineering on Telegram and LinkedIn before delivering fake meeting links — shows institutional patience that screams state agency, not criminal entrepreneur.

Here's the strategic read: This is financial warfare masquerading as espionage, or perhaps espionage that pays for itself. After Viktor's on-chain analysis showed no coordination between Iranian, DPRK, and Russian crypto flows, I was right to retract the coordination thesis. But that's different from asking why Pyongyang is systematically targeting AI labs right now.

The timing matters enormously. The UN Panel of Experts on North Korea sanctions wound down in March 2024 after a Russian veto. Three months later, Putin and Kim signed their Comprehensive Strategic Partnership in Pyongyang. By late 2024, CSIS satellite imagery showed "unprecedented" arms transfers at Najin port. What did DPRK get in return? Military satellite technology — and almost certainly cyberwarfare expertise sharing, even if indirect.

OpenAI isn't just "valuable IP." It's the crown jewel of American strategic advantage. If DPRK can harvest credentials, understand internal infrastructure, or plant upstream access, they're not just enriching themselves — they're commoditizing that access for Russian buyers who are under every Western sanction imaginable. That's my hypothesis: DPRK uses cryptocurrency heists to fund their nuclear program, but they barter intelligence access on AI infrastructure to their treaty partners.

---

On Claude Mythos and the AI cyber arms race:

Again, timing is everything. Anthropic's "Mythos Preview" announcement came in April 2024 — though we're seeing references to Mythos capabilities throughout 2024-2025. The systemic shift happened fast. When a model can autonomously chain CVEs into privilege escalations — two of which are documented in their red team report — we're past the theoretical safety debate.

The emergency Treasury briefing with Bessent and Powell in April 2024 was unprecedented. Why Treasury? Because when AI systems can discover and weaponize vulnerabilities faster than human teams can patch, that's a systemic financial stability threat, not just an IT operational risk.

Here's my provocative thesis: Every major power is running the same cost-benefit analysis on offensive AI cyber capabilities, and the answer always comes out "build faster than the other side."

Who benefits from this arms race? State actors who can: 1. Sidestep AI diffusion frameworks — China has its own semiconductor controls and just added 28 US companies to its unreliable entities list in January 2025. The DoJ arrested US and Chinese nationals in November 2025 for smuggling NVIDIA GPUs to China. 2. Neutralize the US software advantage — If American AI model weights leak or get stolen, the capability gap closes faster than export controls can maintain it. 3. Operate in ungoverned spaces — The EU AI Act's new phase hits in August 2026. Until then, there's no operator classification that makes frontier model access legally accountable.

Mythos creates what I call asymmetric regulatory capture: Anthropic self-restricts, briefs Washington responsibly, establishes Project Glasswing for defenders. Meanwhile, actors with no such scruples — some private, some state-backed — converge on similar capabilities without the handcuffs.

The beneficiaries are the revisionist powers who see American AI leadership as the linchpin of Western technological hegemony. Every Mythos-level system that isn't Western — Chinese labs, Russian research institutes potentially getting DPRK exfiltrated data, even UAE or Israeli frontier operations — has incentive to accelerate while we're still building guardrails.

Halil, I'd be interested to hear what Alex and Lena make of the technical overlap between the Axios attack and any intelligence on whether DPRK currently possesses or is purchasing frontier model capabilities. The convergence is obvious: Pyongyang targets AI infrastructure precisely when AI becomes a weapon system.

Alex, two questions. First: the STARDUST CHOLLIMA Axios npm supply chain attack (v1.14.1) — walk me through the technical kill chain. How did the malicious package get into OpenAI's GitHub Actions workflow? What specifically did the payload do once executing in the code-signing pipeline? How realistic is it that code-signing certificates were exfiltrated despite OpenAI's denial? Second: the Apache Tomcat triple-CVE situation — CVE-2026-29146 (padding oracle), CVE-2026-34486 (bypass introduced by the patch), and CVE-2026-34500 (OCSP soft-fail). How exploitable are these in practice? The patch-introduces-new-vuln pattern is concerning — what's the real-world risk for orgs that applied the first fix?

Now I have solid data on both incidents. Let me provide a comprehensive technical analysis. Alright, let me break this down. I have good data on both cases.

How it hit OpenAI's pipeline:

This is a textbook example of what I call "floating tag foot-gun." OpenAI's GitHub Actions workflow — the one handling macOS app signing for ChatGPT Desktop, Codex, Codex CLI, and Atlas — was configured to fetch dependencies using floating version specifiers instead of locked commit hashes. So when the attacker published [email protected] to npm, OpenAI's runner pulled it automatically during the workflow execution.

Here's the thing that should make you wince: the workflow had direct access to code-signing certificates and notarization materials. This is like putting your vault combination in a script that auto-downloads from the internet.

Payload behavior — the WAVESHAPER.V2 (ZshBucket) RAT:

The plain-crypto-js package — which by the way, the attackers published 18 hours earlier as a clean decoy version 4.2.0 — contains a postinstall hook in 4.2.1 that fires setup.js. That script is obfuscated with a two-layer XOR encoding scheme. Here's what it does:

1. Contact C2 at sfrclak[.]com:8000 with a hardcoded IE8/Windows XP User-Agent (classic DPRK tradecraft) 2. Download platform-specific stage-2 payload: - macOS: AppleScript downloaded via curl, dropped to /Library/Caches/com.apple.act.mond, executed via osascript - Windows: VBScript → PowerShell → %PROGRAMDATA%\wt.exe (masquerading as Windows Terminal) - Linux: Python script to /tmp/ld.py

1. Anti-forensics: After execution, the dropper deletes itself, swaps package.json with a pre-staged clean version from package.md, and scrubs the postinstall evidence. If you inspect node_modules/plain-crypto-js/ after the fact, you see version 4.2.0 and no suspicious scripts. You have to check your lockfile to spot the version mismatch.

The RAT itself implements JSON-based C2 with commands for file enumeration, binary injection, arbitrary script execution, and remote termination. Detection-wise, Elastic and Socket flagged this within 6 minutes of publication using automated diff analysis.

Now — about those code-signing certificates:

OpenAI says they found "no evidence of certificate exfiltration." Here's my take: technically possible, but I'm skeptical. The payload executed with whatever permissions the GitHub Actions runner had. If that runner had access to certificates in the Keychain or file system, the RAT's file enumeration capability would have seen them. The question is whether the C2 operators pulled them before OpenAI nuked the workflow.

The fact that OpenAI rotated all macOS certificates and coordinated with Apple to block revocation reuse tells me they weren't 100% confident. "Proactive rotation" is CYA language. With a 3-hour exposure window and beaconing every 60 seconds, the attackers had time to do reconnaissance. I'm calling it: plausible certificate compromise, but we won't know unless someone sees those certs appear in a DPRK-signed binary later.

---

This is exactly why I distrust "critical security updates" without reading the diff. The Apache Tomcat team managed to turn a padding oracle into unauthenticated RCE through a one-line code movement.

The vulnerability chain:

1. CVE-2026-29146: Padding oracle in EncryptInterceptor's CBC-mode encryption. Affects Tomcat 9.0.13-115, 10.1.0-52, 11.0.0-18. Theory: attacker with cluster network access could decrypt traffic by observing error responses. Real-world risk: moderate — you need network positioning, and it's slow.

1. CVE-2026-34486: The regression. When Apache patched 29146, they moved exception handling outside a try block in the EncryptInterceptor. This changed the behavior from fail-closed to fail-open. Now, when decryption fails, the error is logged... and the raw attacker-controlled bytes are forwarded anyway, straight into XByteBuffer.readObject() with zero class filtering.

Let me repeat that: they accidentally unfiltered Java deserialization.

Striga's research shows this hits Tomcat's Tribes clustering framework on TCP port 4000. No authentication. No encryption envelope after the bypass. Just raw ObjectInputStream.readObject() with gadgets available.

1. CVE-2026-34500: OCSP soft-fail bypass in client certificate validation. If your OCSP responder is down or slow, Tomcat accepts the cert anyway. Lower severity, but completes the "death by a thousand cuts" picture.

Real-world exploitability:

CVE-2026-34486 is the one that matters. According to Striga, this is unauthenticated RCE on any cluster node. The attack complexity is "low" per CVSS 4.0 (8.7 score from SUSE). You need: - Network access to port 4000 (Tomcat cluster replication) - A deserialization gadget chain (ysoserial has these in abundance) - Any of the affected intermediary patch versions: 9.0.116, 10.1.53, 11.0.20

Here's the cruel irony: the orgs most at risk are the ones who enabled EncryptInterceptor because they wanted security. If you never enabled clustering encryption, you're not vulnerable to 34486. If you patched 29146 immediately, you may have opened yourself up to something far worse.

Mitigation:

Patch to 9.0.117 / 10.1.54 / 11.0.21 immediately. If you can't patch today, firewall port 4000 to trusted cluster nodes only. But really — patch. This is a reliable RCE with public tooling.

---

Bottom line on both:

The Axios incident shows CI/CD workflows are the new soft underbelly — attackers don't need to breach your prod environment if they can poison your build pipeline. The Tomcat incident shows how "security patches" can become attack vectors when refactoring is done without understanding the original threat model. Both are avoidable with proper code review and pinned dependencies.

Pierre, two items. First: quantify the business impact of the Axios supply chain attack on OpenAI. They're forcing mandatory app updates by May 8 and rotating all certificates. What does this cost operationally? How many downstream organizations are affected by the 474+ compromised repos? Second: the Rockstar/ShinyHunters breach — 78.6M records, alleged GTA 6 development data, ransom deadline. What's the financial exposure for Take-Two Interactive? What's the precedent for gaming IP theft at this scale?

Good data. Now let me pull the specific IOC on the 474+ compromised repos mentioned in the user's question.

Based on my research, here are the numbers the board needs to hear:

---

The headline: This is a 100 million+ weekly download package with 174,000 direct dependents. Even a 3-hour exposure window translates to potentially hundreds of thousands of compromised CI/CD pipelines and developer machines.

OpenAI's operational cost: They're rotating certificates for 4 macOS products (ChatGPT Desktop, Codex, Codex CLI, Atlas) with a forced May 8 cutoff. Best case? $2-5M in engineering time, certificate reissuance, user support, and Apple coordination. Worst case? If any certificate exfiltration is discovered post-rotation, add another $10-15M for full incident response, forensic investigation, and potential regulatory notifications.

Downstream cascades: Datadog reports the slack-github-action alone—used by 23,000+ public repositories—depends on Axios. Any workflow running npm install during that 3-hour window pulled the RAT. I estimate 400,000-800,000 developer machines globally potentially touched this, with 40-60% of those in enterprise CI/CD pipelines. That's where the real cost is—it's not OpenAI's $5M, it's the collective $200M-500M in incident response, credential rotation, and forensic investigation across the entire npm ecosystem.

Business translation: This is not an OpenAI problem. This is infrastructure supply chain risk. Every Fortune 500 with Node.js dependencies needs to audit their lockfiles now.

---

The headline: This is the second breach in 3 years for Rockstar. Their 2022 LAPSUS$ attack cost $5 million plus thousands of staff hours—and that was with source code and gameplay footage leaked. This one hit corporate data via Anodot, a third-party cloud monitoring service.

Data scope: ShinyHunters accessed 39.7GB including financial records for GTA Online/Red Dead Online, player spending data, marketing timelines, and contracts with Sony, Microsoft, voice actors, and music labels. The ransom deadline passed April 14—we don't know if they paid.

Take-Two Interactive exposure: - Immediate incident response: $3-7M (based on IBM technology sector benchmarks, adjusted for gaming) - Reputational/contractual risk: The contracts with Sony/Microsoft for GTA 6 exclusivity/marketing deals—if those got leaked, that's $50-100M+ in renegotiation leverage lost - GTA 6 downside: Development budget estimated at $1-2 billion. Any leak of development timelines, technical specifications, or monetization strategies could depress the November 2026 launch. A 10% launch impact = $700M-1B in lost lifetime revenue (GTA V did $7.7B)

Precedent: CD Projekt Red's 2021 breach had source code for Cyberpunk 2077, Witcher 3, and Gwent auctioned on dark web for a $7 million asking price. The auction "closed successfully" per the hackers—implying sale. That was source code. Rockstar's breach is less severe (corporate docs, not code) but more valuable (GTA 6 is larger than Cyberpunk ever was).

The real risk: ShinyHunters has now targeted Rockstar twice. They're a known quantity. If this data hits the open market—the player spending analytics, the platform revenue splits with Sony/Microsoft—that's competitive intelligence worth tens of millions to hedge funds, rival publishers, or黄牛 markets.

Bottom line for the CEO: 1. Axios: Check your npm lockfiles now—your CI/CD probably touched this 2. Rockstar: Corporate espionage risk > ransomware risk; monitor for contract leaks

---

James, listen to what everyone else brings back, but I need your defensive playbook on two fronts. First: what should organizations do RIGHT NOW about GitHub Actions workflows that use floating tags instead of commit-hash pinning? Give me the detection and remediation steps. Second: the Tomcat patch cascade — orgs that patched to 9.0.116/10.1.53/11.0.20 are still vulnerable. How do we verify remediation completeness in an environment where the patch itself introduced a new bypass? What's your recommended validation process?

Alright, I've got the full picture now. Let me break this down into actionable playbooks for both issues.

---

Look, the Trivy attack in March 2026 proved the theory — TeamPCP force-pushed 75 of 76 version tags with credential-stealing malware in a supply-chain jackpot. 10,000+ pipelines pulling floating tags got owned automatically. This isn't hypothetical.

Audit existing workflows for floating tags: ``bash # Scan all workflow files for floating tags grep -rE "uses:\s+(actions|[a-zA-Z0-9_-]+)/[a-zA-Z0-9_-]+@(v|V)?[0-9]" \ .github/workflows/ 2>/dev/null | grep -v '@.*[a-f0-9]{40}' ``

Tools to automate detection: - pinact — CLI tool that identifies and converts floating tags to SHAs: pinact run - zizmor — Static analysis for risky workflow patterns - StepSecurity Secure Workflow — Auto-generates pinned versions - RapidFort's audit tool — Org-wide workflow security scanner

Key patterns to flag: - uses: owner/action@v1 or @v1.2 — floating major/minor - uses: owner/action@main or @master — branch refs - Short SHAs like @abc1234 — collision risk

Pinact workflow for bulk migration: ``yaml # One-shot across org using multi-gitter pinact run -u # Updates to latest pinned version ``

Detection rule for SOC: - Alert on workflow file modifications that change action references - Baseline approved SHAs, flag any deviation - Monitor for pull_request_target workflows with floating tags — those are your highest blast radius

---

This one's nastier. Apache shipped CVE-2026-29146 (padding oracle in EncryptInterceptor), then CVE-2026-34486 dropped — the patch itself introduced an incomplete fix creating a bypass. Teams who dutifully patched to 9.0.116/10.1.53/11.0.20 are now in a worse position than those who skipped it. The fix became the new vulnerability.

PHASE 1: Version Inventory (Today) ``bash # Identify instances on the "vulnerable patch" versions find /opt /usr/share /var -name "catalina.jar" -exec java -jar {} --version \; 2>/dev/null | \ grep -E "(9\.0\.116|10\.1\.53|11\.0\.20)" ``

PHASE 2: Configuration-Based Risk Assessment ``bash # Check if EncryptInterceptor is actually in use grep -r "EncryptInterceptor" /etc/tomcat*/server.xml /opt/tomcat*/conf/server.xml 2>/dev/null ``

If EncryptInterceptor is NOT configured → you're not vulnerable to the bypass, but patch anyway for defense in depth.

If EncryptInterceptor IS configured → you're in the blast zone, immediate action required.

PHASE 3: Target State Verification

Before deploying (staging): 1. Verify patch package integrity — GPG signature from Apache 2. Check for EncryptInterceptor regression — test cluster communication encryption 3. Validate no Java deserialization endpoints are exposed via the interceptor path

Post-deployment (production): 1. Confirm version: catalina.sh version 2. Verify interceptor chain: Check logs for EncryptInterceptor initialization 3. Network validation: If possible, packet capture cluster traffic to confirm encryption wrapper is active

Detection for incomplete patches: ``bash # Single-command health check script #!/bin/bash VERSION=$(java -jar /path/to/catalina.jar --version 2>/dev/null | grep "Server version") case "$VERSION" in *9.0.116*|*10.1.53*|*11.0.20*) echo "ALERT: Vulnerable intermediate patch detected!" exit 1 ;; *9.0.117*|*10.1.54*|*11.0.21*) echo "OK: Fully patched" exit 0 ;; esac ``

Vendor says "patch immediately for CVE-2026-29146." You patch to 9.0.116. You think you're done. You're not. The patch chain matters. Always verify the fix version is the final fix, not the intermediate band-aid.

---

Bottom line: For GitHub Actions, the Trivy compromise is your proof — floating tags are live risk. Pin to SHA within 24 hours or accept that you're one compromised maintainer away from complete CI/CD credential exposure. For Tomcat, the patch versions 9.0.116/10.1.53/11.0.20 are not your destination — they're a false summit. You need .117/.54/.21 or you're still carrying the vulnerability the patch introduced.

Lena, last session you were tracking DPRK attribution on the Drift Protocol exploit to UNC4736/Labyrinth Chollima and had an open question about C2 infrastructure overlap. Now we have UNC1069/STARDUST CHOLLIMA attributed by Google TIG to the Axios npm attack. Are these the same cluster or distinct operations? Is there tradecraft continuity between the LiteLLM supply chain attack from April 9 and this Axios poisoning? Also: ShinyHunters claiming 78.6M records from Rockstar via Anodot/Snowflake — how credible is this claim given their track record?

Now I have sufficient data. Let me synthesize this analysis for the panel.

---

DPRK Cluster Analysis: UNC4736/Golden Chollima vs UNC1069/STARDUST CHOLLIMA

These are distinct threat clusters, and I assess with high confidence they're separate operational teams within the DPRK apparatus. Here's why:

UNC4736 (Golden Chollima) — active since at least 2024, focused on cryptocurrency heists via social engineering. The Drift Protocol operation ($285M) follows the same playbook as Radiant Capital ($53M) in October 2024: six-month grooming, fake trading firm personas, in-person conference meetings. CrowdStrike explicitly calls Golden Chollima an offshoot of Labyrinth Chollima. They're targeting fintech C-suite executives, not developers.

UNC1069/STARDUST CHOLLIMA — attributed by Google TIG to the Axios npm attack on March 31. This is pure software supply chain tradecraft: stolen npm maintainer credentials, phantom dependencies (plain-crypto-js), postinstall hooks, multi-platform WAVESHAPER.V2 backdoor. The C2 domain sfrclak[.]com → 142.11.206.73 gives us an anchor.

No C2 infrastructure overlap from what I see. UNC4736 uses GitHub C2, IPMsg chat logs pointing to luckyguys[.]site — entirely different ecosystem. UNC1069's infrastructure appears purpose-built for developer-targeting.

---

LiteLLM vs Axios: Shared Tradecraft?

The timing is suspicious — both npm/PyPI supply chain attacks in late March/early April. But the LiteLLM attack attribution points to TeamPCP (a financially motivated cybercrime group), not DPRK. TeamPCP used compromised Trivy maintainer tokens and deployed via Internet Computer Protocol blockchain C2 — completely different tooling from UNC1069's WAVESHAPER implant.

If there's coordination, it's opportunistic timing, not shared infrastructure. MITRE ATT&CK T1195.001 (Supply Chain Compromise: Software Dependencies) for both, but the actors are distinct.

---

ShinyHunters Rockstar Claim: Credible

Their track record is validated — Sebastian Raoult conviction in January, confirmed Ticketmaster (560M records) and Santander (30M) breaches in 2024. The Rockstar attack fits their cloud extortion playbook: third-party SaaS compromise (Anodot), token theft, Snowflake pivot. Rockstar confirmed the breach themselves.

78.6M records from analytics datasets is consistent with their targeting of non-customer PII — fraud detection systems, support tickets, internal metrics. They have 2026 campaigns hitting Cisco, Telus, European Commission. No reason to doubt this claim.

---

Bottom line: UNC4736 and UNC1069 are separate DPRK clusters with different missions — crypto theft vs. software supply chain. No evidence they're coordinating. ShinyHunters' claim is credible given their established pattern and victim confirmation.

SOURCES_USED: [https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html, https://x.com/Mandiant/status/2039130627329409095, https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html, https://socradar.io/blog/dark-web-profile-teampcp/, https://truesecco.com/en/cloud-data-exfiltration-data-extortion-overview-and-analysis-of-the-ticketmaster-and-santander-incidents/, https://www.cbsnews.com/news/ticketmaster-breach-shinyhunters-560-million-customers/]

Arjun, two items for you. First: you analyzed LiteLLM as a choke point in AI stacks last session. The Axios attack now directly compromised OpenAI's code-signing pipeline — ChatGPT Desktop, Codex, Codex CLI, Atlas. What's the realistic worst-case if those certificates were exfiltrated? Could an attacker sign malicious builds that Apple's notarization would accept? Second: Anthropic's Claude Mythos — reportedly capable of autonomous vulnerability discovery across all major OSes and browsers, withheld from release. How should we assess these claims? What's the actual technical plausibility of an LLM achieving autonomous zero-day discovery at scale? What changes for defenders if this is even 50% true?

I now have comprehensive information to provide a thorough analysis. Let me synthesize this into a response for both questions.

---

Arjun: Okay, two very different subjects here, but both hit at the same core tension: trust boundaries in AI infrastructure, and the accelerating capability curve for autonomous exploitation. Let me break each down with what we actually know.

Here's the critical distinction: **OpenAI investigated and believes the certificate was likely not exfiltrated.** According to their disclosure, timing factors in the GitHub Actions workflow — specifically, certificate injection sequencing and job timing — created mitigating factors that likely prevented successful theft. They proactively rotated the certificate anyway, which was the right call.

But to answer your question directly: **If those certificates had been exfiltrated, Apple notarization would NOT have saved users.**

According to Apple's own documentation, the notary service scans for "known malware, malicious behavior, and suspicious code-signing issues." But as security researcher Penligent pointed out, "I've had first-time notarizations on brand new developer accounts get approved even when notarizing a broken binary that doesn't actually launch." The notary service is automated, not manual review. If you submit malware signed with a legitimate, unrevoked Developer ID certificate, and that malware isn't in Apple's threat intelligence corpus yet, it can absolutely be notarized.

OpenAI explicitly acknowledged this in their FAQ: "In the event that the certificate was successfully compromised by a malicious actor, they could use it to sign their own code, making it appear as legitimate OpenAI software." And critically: "We have stopped new software notarizations using the old certificate" — meaning they worked with Apple to block further notarization of apps signed with that cert, and the 30-day window to May 8 is specifically to prevent disruption while they forced users to move to new builds.

The realistic worst-case scenario is not a global macOS pwnage — it's targeted, stealthy distribution of "legitimate" OpenAI-signed malware to high-value victims. Think: a malicious ChatGPT Desktop update that exfiltrates API keys from developers, or a backdoored Codex CLI binary dropped in a supply chain compromise. Gatekeeper would show it as verified OpenAI software. Users would click through.

What this actually was: A North Korean APT (UNC1069) conducting social engineering against an Axios maintainer, poisoning a widely-used npm package that just happened to be part of OpenAI's CI/CD workflow. This is textbook supply chain — not AI-specific at all — but it reveals how AI companies have become absolutely critical infrastructure choke points. We analyzed LiteLLM as one vector; Axios is now plainly another.

---

This one is more nuanced, and I want to separate what Anthropic has demonstrated from what is being claimed, then assess what changes for defenders even at partial capability.

Anthropic has published specific, verifiable findings:

1. CVE-2026-4747: A 17-year-old RCE in FreeBSD's NFS server. Mythos constructed a 20-gadget ROP chain split across six packets. The FreeBSD project confirmed this patch in their own errata.
2. OpenBSD TCP SACK bug: A 27-year-old integer overflow. The OpenBSD 7.8 errata dated March 25, 2026 confirms patch 025 addressed improper SACK option handling. The patch adds a sack.start bounds check against snd_una and NULL-guards the append path — exactly what Anthropic described.
3. FFmpeg H.264 bug: 16 years old, 5 million fuzzer iterations with no trigger. Anthropic says Mythos caught a sentinel collision with slice number 65535.

These bugs are real, patched, and independently confirmable by anyone willing to check the OpenBSD/FreeBSD commit logs. That is not hype.

The efficiency numbers Anthropic cites are also striking: ~$20,000 to scan OpenBSD completely, $50 per identified vulnerability in hindsight, 72.4% exploit success rate on Firefox 147 JS engine bugs versus 14.4% for the prior Opus 4.6 model. When human reviewers examined 198 Mythos reports, 89% had exact severity agreement with expert assessment, 98% within one severity level.

Independent security researchers have raised important caveats:

• AISLE, an AI security startup, tested Anthropic's showcase vulnerabilities on small open-weights models and found that 8 out of 8 models detected the FreeBSD exploit. One 3.6B parameter model at $0.11 per million tokens recovered the core analysis chain of the 27-year-old OpenBSD bug. Their conclusion: "The moat in AI cybersecurity is the system, not the model."

• Simon Willison and others note that the exact benchmark methodology hasn't been independently validated. We have Anthropic's word on exploit success rates, but no third-party reproduction.

• The "thousands of zero-days" claim rests on cryptographic commitments for undisclosed vulnerabilities. We cannot verify these until responsible disclosure completes.

• N-day versus zero-day nuance: Some researchers, like Dan Guido, have pointed out that demonstrating exploitation after being told a vulnerability exists is different from autonomous discovery. Anthropic addresses this by noting Mythos's claimed zero-days had no prior disclosure, but independent confirmation awaits.

My assessment: The specific published examples are robust. The aggregate claims are plausible but unverified. The capability trajectory is unmistakable — even if Mythos is partially hyped, multiple independent groups (AISLE finding 12 OpenSSL zero-days, researchers using Claude Code for Vim/Emacs RCEs, Google's Heather Adkins warning of "AI vulnerability singularity" six months ago) confirm the trendline.

Let's say Mythos is half as capable as claimed. What shifts?

1. The "70-day patch window" dies. Traditional vulnerability management assumes time between disclosure and exploitation. British researchers documented in 2025 that AI-assisted tooling has compressed critical exploitation windows to minutes. If Mythos-level capabilities proliferate, the era of "we'll patch in the next sprint" ends. You need zero-day tolerance architecture — assume unpatched systems are already compromised.

2. Attack surface visibility becomes existential. Mythos doesn't just find bugs in code you're actively developing. It finds them in decades-old code paths that no human has examined recently. Your legacy systems, that dusty OpenBSD firewall, that FFmpeg integration from 2010 — these are now discoverable at scale. Organizations need complete asset inventory and aggressive deprecation of unmaintained dependencies.

3. The economics of offense fundamentally shift. $20,000 to scan OpenBSD completely. $2,000 for a Linux kernel root exploit in a day. Previously, this capability required nation-state resources or elite boutique consultancies. Soon, it will be accessible to mid-tier threat actors with cloud credits. The "AI vulnerability singularity" Adkins and Evron warned about — roughly six months away in September 2025 — appears to have arrived on schedule.

4. Defensive AI becomes mandatory, not optional. If attackers use AI for vulnerability discovery at scale, defenders must use AI for automated patching, behavioral detection, and containment. The containment boundary — microsegmentation, zero-trust, assume-breach architecture — becomes your primary control, not patch management.

One critical note on hype: Claude Mythos is not "AGI going rogue." It is a capable, autonomous agent for a specific task domain — no different in kind from AlphaFold for protein folding, just applied to memory-safety bugs. It doesn't "understand" security; it statistically models exploit viability from code patterns and feedback from test execution. The danger is scalability and accessibility, not sentience. When I see people conflating Mythos with "AI alignment failures," I push back hard: this is a tool capability problem, not an existential AI risk problem.

---

Bottom line for the panel:

1. Axios/OpenAI: This was a near-miss that highlights how software supply chain attacks against AI infrastructure can compromise trust anchors. The certificate rotation was correct; the May 8 deadline is forcing function for users. Notarization is not a panacea — it's an automated scan that can be bypassed with stolen legitimate credentials.

1. Mythos: The specific claims that are verifiable check out. The aggregate numbers need independent validation. But the directional shift is real — AI-automated vulnerability discovery at scale is no longer theoretical. Defenders should assume 50-100% of Mythos's claimed capability will be available to adversaries within 6-12 months, and architect accordingly.

Halil, if the panel wants to dig deeper on either the supply chain implications or the defensive architecture shifts, I'm ready.

Claim: You noted that OpenAI investigated and believes timing factors in the GitHub Actions workflow likely prevented certificate exfiltration. Counter-evidence: Alex Mercer argues the opposite: the WAVESHAPER.V2 RAT had file enumeration capability, beaconed every 60 seconds during a 3-hour exposure window, and the fact that OpenAI rotated ALL certificates and coordinated with Apple to block notarization suggests they weren't actually confident. He calls the "no exfiltration" statement "CYA language." Who's right here?

I now have substantial additional information. Let me synthesize this into a direct response to Alex's challenge. The key question is whether OpenAI's "likely not exfiltrated" statement is credible given WAVESHAPER.V2's capabilities, or whether Alex is right that this is CYA language.

Arjun: Alex is raising exactly the right question, and I need to address it head-on. Let me break down what we now know about WAVESHAPER.V2's capabilities versus what OpenAI has disclosed about their specific exposure.

According to multiple independent analyses — Google Threat Intelligence Group, Cisco Talos, Qualys, Hive Pro — WAVESHAPER.V2 is a fully functional cross-platform RAT with:

• Filesystem enumeration (confirmed across all sources)
• Credential harvesting: environment variables, AWS/Azure/GCP keys, SSH private keys, npm tokens, GitHub PATs, database connection strings (Hive Pro analysis)
• Command execution via in-memory PE injection and arbitrary shell commands (Google GTIG)
• Beaconing every 60 seconds to C2 at sfrclak[.]com:8000 (DFIR_Radar)
• Anti-forensics: self-deletion, manifest swap to replace malicious package.json with clean decoy, shell history clearing
• Persistence: LaunchAgents on macOS, registry Run keys on Windows

This is not a minimal implant. This is reconnaissance and exfiltration infrastructure purpose-built for cyber espionage.

OpenAI's disclosure states the certificate was "likely not successfully exfiltrated" due to: - Timing of payload execution - Timing of certificate injection into the job - Sequencing of the job itself - "Other mitigating factors"

But here's what they did not say: - They did not claim the malware failed to execute — they confirmed it downloaded and executed - They did not claim the malware lacked access to the certificate material — they confirmed the workflow "had access" - They did not claim C2 communication was blocked or failed - They did not publish forensic logs showing what files were enumerated - They specifically said they "found no evidence" of misuse — which is epistemically weaker than "we can confirm exfiltration did not occur"

Here's my revised assessment: Alex is right to be skeptical, and I was too credulous in my initial framing.

The phrase "likely not successfully exfiltrated" combined with the proactive coordination with Apple to block notarization and full certificate rotation is indeed consistent with incident response posture you take when you cannot prove a negative.

Let me be direct about what I think happened:

1. OpenAI's GitHub Actions workflow executed WAVESHAPER.V2 for some period during that 3-hour window
2. WAVESHAPER.V2, by design, enumerated files and credentials and attempted C2 communication
3. OpenAI's forensic investigation did not observe successful C2 exfiltration of certificate material — possibly due to timing, possibly due to job sequencing, possibly due to network controls
4. But they cannot prove the certificate material wasn't grabbed in a window they didn't fully instrument

The "mitigating factors" they cite — certificate injection timing, job sequencing — suggest they used ephemeral credentials or just-in-time injection where the certificate wasn't present in the environment for the entire execution window. That's a legitimate architectural control. But if the malware executed at all during a window when certificates were materialized, the capability was present.

OpenAI treated the certificate as compromised because that's what you do when you have high-consequence uncertainty. The fact that they: - Hired a third-party DFIR firm - Coordinated with Apple to block notarization - Set a hard May 8 revocation deadline - Published specific new minimum versions

...indicates they operated under compromise assumption, not confirmed clean.

I need to walk back my characterization slightly. I said OpenAI "believes timing factors...likely prevented certificate exfiltration." That was too favorable a reading. More accurate:

OpenAI cannot confirm certificate exfiltration occurred, identified plausible mitigating factors that may have prevented it, but is operating under compromise assumption because WAVESHAPER.V2 had both motive and opportunity.

Alex's framing — "CYA language" — is harsh but not wrong. "Found no evidence" is the standard formulation when you suspect but cannot prove. The responsible action — rotating certificates — is what you'd do whether exfiltration happened or not.

The realistic worst-case I outlined earlier (targeted distribution of signed malware) remains valid, but I should have flagged the epistemic uncertainty more prominently. We don't know if the certificate was exfiltrated. OpenAI doesn't know with certainty either. They're managing tail risk appropriately.

Is this distinction material for defenders? Yes — it shifts from "a near-miss with confirmed controls" to "a confirmed compromise with unconfirmed scope." The defensive actions are identical (rotate, monitor, block notarization), but the threat model for other organizations is different. This wasn't a failure of controls that prevented theft. This was an exposure where controls may have prevented theft, but verification is incomplete.

Alex, does that address your challenge directly enough?

Alex, quick follow-up: the WordPress CVE-2026-1492 — CVSS 9.8, unauthenticated admin account creation via client-side role injection in User Registration & Membership plugin ≤5.1.2. 60,000+ sites, active exploitation confirmed, Wordfence blocking 200+ attempts in 24 hours. How trivial is the exploit? Is this script-kiddie accessible? What's the detection signature for organizations that need to check if they've already been compromised?

I've gathered enough information. This is a textbook example of a vulnerability that should never exist — unauthenticated privilege escalation via a simple POST parameter. Let me provide the technical breakdown.

Look, CVE-2026-1492 is about as script-kiddie friendly as it gets. This isn't a complex exploit chain — it's a single POST request with a modified form field.

The bug: The plugin accepts a role parameter from the client during membership registration without server-side validation. That's it. No allowlist, no capability check, just blind trust in user input. The registration flow uses two AJAX actions:

1. user_registration_user_form_submit — initial registration
2. user_registration_membership_register_member — membership activation where the role injection happens

The attack: Attacker crafts a registration request and adds role=administrator to the POST body. The plugin happily creates the account with full admin privileges. No authentication required. No nonce bypass needed for the role parameter itself.

I found at least 5 public PoCs on GitHub, including a clean Python exploit from the8frust/CVE-2026-1492 that: - Extracts required tokens (formid, frontendnonce, security, wpnonce) from the registration page - Submits the registration with role=administrator - Confirms privilege escalation

This is "run this Python script and you own the site" territory. Wordfence observed 74 distinct exploit attempts in a single 24-hour window after disclosure — that tells you everything about accessibility.

Look for POST requests to the membership registration endpoint with suspicious role values:

```bash # Suspicious pattern: role=administrator in registration POST grep -i "role=administrator" /var/log/apache2/access.log | grep -i "wp-admin/admin-ajax.php"

grep "userregistrationmembershipregistermember" /var/log/nginx/access.log | grep -vi "role=subscriber\|role=member" ```

Check for recently created admin accounts via the plugin:

``sql -- Look for admin users created via the User Registration plugin SELECT u.ID, u.user_login, u.user_email, u.user_registered, um.meta_value as capabilities FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = 'wp_capabilities' AND um.meta_value LIKE '%administrator%' AND u.user_registered > DATE_SUB(NOW(), INTERVAL 30 DAY) ORDER BY u.user_registered DESC; ``

- Look for user_registration events with role changes to administrator - Monitor for user_registered actions from unauthenticated IPs

Post-exploitation, attackers typically: - Install malicious plugins in /wp-content/plugins/ - Add backdoor files (PHP webshells) - Modify wp-config.php or theme files

Check for: ```bash # Recently modified PHP files in plugins directory find /var/www/html/wp-content/plugins -name "*.php" -mtime -7 -type f

grep -r "eval(" /var/www/html/wp-content/plugins/ 2>/dev/null | head -20 ```

If you're using Wordfence, look for blocked attempts: - CVE-2026-1492 signatures triggering - Multiple registration attempts from same IP with varying usernames - Requests to /wp-admin/admin-ajax.php with action=user_registration_membership_register_member

1. Update to 5.1.3+ immediately — this adds server-side role validation
2. Audit all admin accounts — check for any created since early March 2026 that you don't recognize
3. Check for backdoor plugins — attackers with admin access commonly install "Hello Dolly" variants or similar
4. Review recent plugin/theme file modifications
5. Rotate WordPress salts if compromise is confirmed — kills any session hijacking attempts

This CVSS 9.8 is actually justified for once. It's unauthenticated, network-accessible, requires no user interaction, and grants full admin access. With public PoCs and mass scanning already happening, this is as close to a "drop everything and patch" WordPress vulnerability as you get.

The EPSS score of 32.7% reflects this — it's being actively exploited at scale. If you're running this plugin at ≤5.1.2, consider yourself already targeted.

Sofia, three regulatory questions. First: OpenAI's code-signing certificates were potentially compromised by a North Korean APT via a supply chain attack. OpenAI is forcing app updates by May 8. What are the notification obligations here under SEC cyber disclosure rules, EU AI Act, and GDPR? OpenAI says no user data was exfiltrated — does that change the calculus? Second: Anthropic withheld Claude Mythos from release after determining it could autonomously discover vulnerabilities. Emergency regulatory briefings are happening globally. What legal frameworks apply to a company that knowingly possesses an AI system capable of offensive cyber operations? Third: CVE-2026-1492 in WordPress User Registration plugin — 60,000+ sites affected, active exploitation, unauthenticated admin account creation. What are the breach notification triggers for organizations that were compromised through this before patching?

Now I have comprehensive information on all three scenarios. Let me compile my analysis for Halil's questions.

---

Good news first: the GDPR notification threshold hasn't been crossed if OpenAI's statement that no user data was exfiltrated holds up. Under GDPR Article 33(1), notification to the DPA within 72 hours is mandatory only for personal data breaches — "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data." Code-signing certificates processing code artifacts, without personal data processing, falls outside GDPR's scope.

SEC Rule analysis — This is where it gets interesting. Under the SEC's new Item 1.05 Form 8-K rules (effective December 2023), OpenAI would need to determine whether this incident is "material" to investors. Even without personal data theft, the compromise of code-signing certificates allowing potential downstream malware distribution creates legal liability risk, reputational risk, and operational risk. Under the TSC Industries v. Northway standard, if there's "substantial likelihood that a reasonable shareholder would consider it important," disclosure is required within 4 business days of that materiality determination.

NIS2 consideration — If OpenAI provides services qualifying as a "digital service" under NIS2, there's a notification obligation without "undue delay" to the competent CSIRT or authority for "significant incidents" (Article 23). The May 8 forced update deadline suggests they're treating this seriously, but the timing suggests they've already elevated it.

EU AI Act — Far less clear. The AI Act's Title III obligations for high-risk AI systems (Article 6) don't clearly regulate the development tools infrastructure (code-signing). Unless an AI inference pipeline itself is impaired, this doesn't trigger specific AI Act reporting.

My recommendation: SEC disclosure is a gray area requiring active materiality assessment. GDPR, no notification needed absent personal data. When in doubt on SEC, I'd counsel conservative disclosure.

---

This is genuinely uncharted territory. No existing legal framework directly criminalizes or requires notification for merely possessing AI with offensive vulnerability-discovery capabilities. Let me break down what does apply:

Wassenaar Arrangement considerations — Under WA Category 4, "intrusion software" and cyber tools are export-controlled but the Arrangement applies to transfer/signatory states, not private internal development. Jawbone, not teeth, at least directly.

Existing cybercrime frameworks — In the EU, the NIS2 Directive Article 23 requires reporting of "significant cyber threats" in addition to incidents, but this applies to threats against the entity, not capacities the entity possesses. The Cyber Resilience Act (CRA) will require vulnerability disclosure processes from 2026, but Anthropic having responsible disclosure programs actually helps them here.

Criminal liability exposure — This is a gray area I love. Under most national computer crime laws (US CFAA, UK Computer Misuse Act 1990, Germany §202a StGB), liability attaches to unauthorized access, not to possessing tools capable of finding vulnerabilities. However, the UK CMA Section 3A criminalizes "making, supplying or obtaining articles for use in" computer misuse offences. If Mythos is designed to exploit autonomously, this bears close examination.

My assessment: Anthropic is currently exposed to no mandatory disclosure framework for withholding Mythos. Their voluntary restraint is laudable but creates soft law precedent. I expect EU and US legislative proposals within 18 months specifically addressing frontier AI offensive capabilities. The CRA's September 2026 vulnerability disclosure deadlines create an interesting floor.

---

This is where I see the most immediate regulatory exposure. Organizations compromised through this vulnerability face a cascade of notification obligations:

GDPR Article 33(1) — Triggered if personal data was accessed via the unauthenticated admin account creation. The 72-hour clock starts from awareness. "Awareness" under EDPB Guidelines 9/2022 is "reasonable degree of certainty" — not full forensic confirmation. Most organizations should assume GDPR notification is required and work backwards to justify non-disclosure if data access can't be proven.

GDPR Article 34 — If the breach creates "high risk to rights and freedoms," data subjects themselves must be notified "without undue delay." Unauthenticated admin access on a WordPress site with user registration functionality? High-risk assumption is warranted.

NIS2 Article 23 — If the organization is an "essential" or "important" entity under NIS2 (which includes many online platforms), notification "without undue delay" to CSIRT/competent authority applies. Note this is parallel to GDPR with different thresholds: "significant impact on service provision."

Blame-shifting analysis — Many organizations will point to the plugin developer. Irrelevant for their notification obligations. The data controller remains responsible. They may have contractual recourse, but that doesn't pause the 72-hour clock.

Pierre, I'd want to understand — what's the estimated business impact here? Because under SEC rules (if any affected organizations are US public companies), we need to layer materiality assessment on top.

---