| CVSS 9.8 (out of 10) | Active exploitation confirmed | Patch to 6.9.5 / 7.0.2 immediately

I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.

The coverage of Anthropic’s Mythos Red Team report has followed a predictable arc: a sensational headline, reactions ranging from alarm to dismissal, and little engagement with what the research actually demonstrates. That is worth correcting, because what Mythos reveals is not primarily a story about AI finding vulnerabilities. It is a story about why trusting software is no longer a viable strategy, and what the architectural response should be. 

[CRITICAL] | Active RAT | Malicious npm versions removed | Assess all systems that ran npm install during exposure window