[claude-mythos]

October 11, 2026

• Anthropic's OSS Scanner enrollment is open — opt-in periodic scans of open-source projects by Claude Mythos, with outputs fully model-generated and no human triage, and no 90-day disclosure clock given the false-positive risk. Maintainers enroll by PR with a YAML config and a Dockerfile that lets the agent audit offline. 116 pull requests submitted as of publication. The Hacker News (earlier coverage) · New Tools & Releases

in Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT

October 7, 2026

Pre-Auth File Read Hits Eight Atlassian Data Center Products

Atlassian's CVE-2026-21589 enables unauthenticated pre-auth file read across eight self-hosted products, with detection published within a day of disclosure. Attackers hijacked three country-code domain registries (.gh, .sl, .as) to mint counterfeit TLS certificates for Google and other major brands. LibreOffice and Apache OpenOffice execute arbitrary code via malicious Calc files when Java is enabled, with the Apache flaw remaining unfixed through version 4.1.16. Agent-to-agent prompt injection across MCP is exposing a structural weakness in multi-agent systems at Google, JPMorgan Chase, Rapid7, and US federal agencies, with downstream tasks executing without validation from intermediate agents.