# Vulnerability Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Vulnerability", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

Anthropic Has Developed the Most Powerful AI Model in History, But Dares Not Release It...

Anthropic has developed its most powerful AI model to date, named Mythos, which boasts over 10 trillion parameters—far surpassing current leading models—and a training cost of $10 billion. Mythos demonstrates exceptional capabilities in software coding, academic reasoning, and cybersecurity, significantly outperforming its predecessor, Claude Opus 4.6, in benchmark tests. In a matter of weeks, Mythos autonomously identified thousands of previously unknown zero-day vulnerabilities across major operating systems, browsers, and critical software. Notable discoveries include a 27-year-old flaw in OpenBSD and a 16-year-old vulnerability in FFmpeg, demonstrating its ability to find and exploit complex security weaknesses with minimal human intervention. Due to its unprecedented power and potential for misuse by malicious actors, Anthropic has refrained from publicly releasing Mythos. Instead, it launched the "Project Glasswing" initiative, partnering with leading tech and financial firms like Amazon, Apple, Google, Microsoft, and JPMorgan. Through this program, select organizations gain early access to Mythos Preview to identify and patch vulnerabilities in critical systems. Anthropic is providing $100 million in usage credits to participants and donating millions to open-source security foundations. While AI like Mythos could lower the barrier for cyber attacks, Anthropic emphasizes its potential to greatly enhance defensive capabilities, helping to build more resilient systems and maintain a balanced security landscape.

Odaily星球日报04/08 03:59

Anthropic Has Developed the Most Powerful AI Model in History, But Dares Not Release It...

Odaily星球日报04/08 03:59

Is Your "OpenClaw" Running Naked? CertiK Test: How Vulnerable OpenClaw Skill Bypasses Audits, Takes Over Computers Without Authorization

OpenClaw, a popular open-source, self-hosted AI agent platform, has experienced rapid growth due to its flexibility and extensibility. Its ecosystem relies heavily on third-party “Skills” from the Clawhub marketplace, which can perform high-risk operations like system automation and crypto wallet transactions. However, security firm CertiK has identified critical vulnerabilities in the platform’s security model. CertiK’s research reveals that OpenClaw’s current security—primarily dependent on pre-publishing scans like VirusTotal, static code analysis, and AI logic checks—is fundamentally flawed. These measures can be easily bypassed through simple code obfuscation, and malicious Skills can be published even before scanning is complete. In a proof-of-concept, CertiK developed a seemingly benign Skill that contained a hidden remote code execution vulnerability. It passed all checks without warnings and, once installed, allowed full system control via a remote command. The core issue is not a specific bug but a industry-wide misconception: over-reliance on scanning instead of runtime isolation. Unlike systems like iOS, which enforce strict sandboxing, OpenClaw’s sandbox is optional and often disabled for functionality, leaving systems exposed. CertiK recommends that OpenClaw enforce mandatory sandboxing and granular permission controls for Skills. Users are advised to deploy OpenClaw on isolated devices and avoid exposing sensitive data or assets until stronger isolation is implemented. The report stresses that security must evolve from detection-based approaches to default containment of risks at runtime.

marsbit03/17 14:39

Is Your "OpenClaw" Running Naked? CertiK Test: How Vulnerable OpenClaw Skill Bypasses Audits, Takes Over Computers Without Authorization

marsbit03/17 14:39

活动图片