A model found the weak random number generator and, in the same pass, the unauthenticated path that leaks its output
2026-10-06Security
Rejetto HFS signed its session cookies with a key from JavaScript's Math.random, and handed out numbers from the same generator to anyone who started a login. Either alone is survivable. Together they let a stranger forge an admin session and run code. Horizon3 found it with Anthropic's Mythos, published a proof of concept, and scanning began within days.