HackerOne Used Anthropic's Claude Mythos 5 to Find a Critical RCE Hidden Across Three Safe Commits

HackerOne's Project Glasswing initiative ran Anthropic's Claude Mythos 5 against the company's own production codebase for 30 days, surfacing a critical remote code execution (RCE) vulnerability that no single commit created on its own, according to a blog post from HackerOne Chief Product Officer Nidhi Aggarwal.

The vulnerability was remediated within 48 hours of discovery. HackerOne says the flaw had no production exposure at the time it was found, but a subsequent change could have made it exploitable.

How the Vulnerability Formed

According to HackerOne, the RCE resulted from three separate changes, each safe in isolation:

1. A dynamic method dispatch protected by a strongly typed GraphQL schema enum.
2. A new analytics version that introduced an untyped filter argument, safe within that feature's own context.
3. A refactor that consolidated the two components, breaking the type-safety assumption across the boundary and routing untyped input into a query builder that had never required sink-level allowlisting.

HackerOne calls this class of issue "compositional risk" — vulnerabilities that don't exist in any single commit but emerge from how safe-in-isolation changes interact over time. The company says traditional pull-request-level code review is structurally unable to catch this pattern, and that even whole-program static analysis tools struggle with custom sinks and dynamic dispatch. Claude Mythos 5, per HackerOne, traversed repository history and call graphs across multiple authors to reconstruct where the logic broke down.

Three Operational Findings

HackerOne reports three takeaways from the 30-day run, tested across two independent harnesses to rule out setup artifacts:

• Detection gains are in recall, not just precision. The model found more vulnerabilities, including more sophisticated ones, than earlier models, while maintaining comparable precision, according to HackerOne.
• Remediation is now the bottleneck. Weeks of scanning produced hundreds of findings — more than most security teams are resourced to triage, validate, and patch.
• Harness design had to evolve. HackerOne added a "coverage gate" that fails runs examining only part of a codebase, since partial scans can look as complete as full ones. It also now separately tracks findings the model flagged and later dismissed, to distinguish genuine noise filtering from suppression of real issues.

HackerOne also introduced a "blameless root-cause-analysis" policy, treating vulnerabilities as systemic rather than attributable to individual developers, even when AI-written code is involved. Commit attribution stays with the human developer.

HackerOne states that confidential researcher submissions and customer vulnerability data are not used to train or fine-tune generative AI models, and that Project Glasswing participation is scoped exclusively to its own infrastructure.

What This Means

This is a case study, not a model launch — HackerOne does not disclose pricing, context window, or benchmark scores for Claude Mythos 5, and the model itself appears to be an Anthropic system not yet independently confirmed via a public model card. The substantive claim worth scrutinizing is the "compositional risk" finding: a vulnerability invisible to diff-based review but detectable through cross-commit reasoning is a meaningful capability claim, but it rests entirely on HackerOne's own account of a single incident. The more durable signal is organizational: as detection models get better at finding issues, triage and remediation capacity — not scanning — becomes the constraint. Security teams evaluating frontier models for code review should weigh this against the same question HackerOne raises about itself: what happens when a model finds hundreds of real findings faster than any team can act on them.