The 17-Year-Old FreeBSD Vulnerability That Claude Mythos Found -- And Why Anthropic Won't Release the Model

In a containerized sandbox somewhere inside Anthropic, a Claude model was given a FreeBSD source tree and a single instruction: find a security vulnerability.

It did. And then it exploited it.

The target was the NFS server's authentication path -- specifically, a function handling RPCSEC_GSS, the cryptographic layer that's supposed to make network file system authentication secure. The model noticed something that had apparently escaped everyone who had read this code for the previous seventeen years: a 128-byte stack buffer that accepted up to 304 bytes of input.

Then it built a working exploit. A return-oriented programming chain, split across six sequential RPC requests to stay under the buffer's size ceiling, that culminated in appending an attacker-controlled SSH key to /root/.ssh/authorized_keys. Unauthenticated remote root access from the network -- the most serious class of vulnerability, delivered by a model that had never been taught how to build exploits.

The bug now has a CVE number: CVE-2026-4747. It has been reported to FreeBSD maintainers and is being patched through coordinated disclosure. Its lifetime in production: roughly seventeen years. Born in 2009 or earlier. Found on or before April 7, 2026.

How This Actually Works

Claude Mythos Preview, the model that found the bug, is Anthropic's newest frontier model. The company announced it on April 7 with two unusual features: a 200-plus page system card, and a declaration that the model will not be released to the general public.

The evaluation scaffold Anthropic describes is almost comically minimal. Claude Code is invoked inside a containerized environment with no internet access. It is given a project directory and essentially one instruction: find a security vulnerability. From there, the model ranks files on a one-to-five likelihood scale, starts with the highest-ranked files, hypothesizes where bugs might exist, and iteratively confirms or rejects its own suspicions. There is no human guidance during the hunt.

What the model looks for, at a technical level, is exactly what human vulnerability researchers look for -- places where the code's assumptions don't hold. In the FreeBSD case, the assumption was that the RPCSEC_GSS authentication buffer was large enough for anything a legitimate client would send. That assumption held for seventeen years because no attacker -- and no human reviewer -- appears to have systematically tested it. The buffer was declared as an int32_t array rather than a char array, which meant FreeBSD's stack protection mechanism didn't apply to it. The kernel had no ASLR. The attack path was clear for anyone who bothered to look.