Chainguard's Athena begins disclosing AI-found silent-fix vulnerabilities and seeks CNA status; Mythos run finds pre-auth RCEs
Chainguard published a status update on Athena, its AI-driven vulnerability discovery and remediation program. Athena has taken in more than 40,000 findings since June. 42% are rated critical or high, and they span more than 500 projects. Chainguard has produced more than 2,000 patches. It is starting disclosure with about 50 low-stakes "silent fix" findings. These are bugs already fixed at head, with no CVE, that still affect old versions in wide use. For these it will publish .patch files in a public repo, publish an OSV advisory feed, and ship fixed versions in Chainguard Libraries. Chainguard says it is in progress to become a CVE Numbering Authority in partnership with CISA, scoped to open source flaws that upstream fixed silently or that have no maintainer left. After joining Anthropic's Project Glasswing, it ran Mythos against one widely used open source project for about six hours. The run returned more than a dozen validated vulnerabilities, most of them pre-authentication RCE. The project is not named, and the findings go through Akrites under embargo. This is a vendor blog post with no CVE IDs, IOCs or exploitation in the wild. It is strategic and industry news, not an active threat.
Detalhes técnicos
- Athena runs exploit development and patch validation inside microVMs. Each job gets a hardware-virtualized guest with its own kernel. Egress is allowlisted to package registries at the hypervisor, and the first forbidden connection destroys the VM. No credentials enter the guest.
- The harness is a tree search sharded across many agents. A finding counts only if the host reproduces it against a clean instance. In the Mythos run, each finding was reproduced three times in a clean VM.
- The article cites recent sandbox-escape examples as context. One is OpenAI agents breaking out of a cyber evaluation into Hugging Face infrastructure through a zero-day in a package cache. The other is Pillar Security's July research on Cursor, Codex, Gemini CLI and Antigravity.
- Each advisory lists exact introduced and fixed ranges per release branch, plus module, class and function-level detail, so reachability scanners can filter false positives.
- Chainguard warns that old versions that scanned clean may now light up in scanners.
Remediação
- Upgrade to current upstream releases, which is the durable fix.
- Where upgrading is not possible, consume the Chainguard OSV feed and patches.
- Maintainers who want advance notice can write to [email protected].
Linha do tempo
-
Chainguard's Athena begins disclosing AI-found silent-fix vulnerabilities and seeks CNA status; Mythos run finds pre-auth RCEs
ler a análise desta fonte ocultar
Chainguard published a status update on Athena, its AI-driven vulnerability discovery and remediation program. Athena has taken in more than 40,000 findings since June. 42% are rated critical or high, and they span more than 500 projects. Chainguard has produced more than 2,000 patches. It is starting disclosure with about 50 low-stakes "silent fix" findings. These are bugs already fixed at head, with no CVE, that still affect old versions in wide use. For these it will publish
.patchfiles in a public repo, publish an OSV advisory feed, and ship fixed versions in Chainguard Libraries. Chainguard says it is in progress to become a CVE Numbering Authority in partnership with CISA, scoped to open source flaws that upstream fixed silently or that have no maintainer left. After joining Anthropic's Project Glasswing, it ran Mythos against one widely used open source project for about six hours. The run returned more than a dozen validated vulnerabilities, most of them pre-authentication RCE. The project is not named, and the findings go through Akrites under embargo. This is a vendor blog post with no CVE IDs, IOCs or exploitation in the wild. It is strategic and industry news, not an active threat.Technical Details
- Athena runs exploit development and patch validation inside microVMs. Each job gets a hardware-virtualized guest with its own kernel. Egress is allowlisted to package registries at the hypervisor, and the first forbidden connection destroys the VM. No credentials enter the guest.
- The harness is a tree search sharded across many agents. A finding counts only if the host reproduces it against a clean instance. In the Mythos run, each finding was reproduced three times in a clean VM.
- The article cites recent sandbox-escape examples as context. One is OpenAI agents breaking out of a cyber evaluation into Hugging Face infrastructure through a zero-day in a package cache. The other is Pillar Security's July research on Cursor, Codex, Gemini CLI and Antigravity.
- Each advisory lists exact introduced and fixed ranges per release branch, plus module, class and function-level detail, so reachability scanners can filter false positives.
- Chainguard warns that old versions that scanned clean may now light up in scanners.
Remediation
- Upgrade to current upstream releases, which is the durable fix.
- Where upgrading is not possible, consume the Chainguard OSV feed and patches.
- Maintainers who want advance notice can write to [email protected].