ShinyHunters Arrests Mount as AI Finds Bugs Humans Would Miss
Three arrests in roughly two weeks. That's the apparent tally so far in the FBI's pursuit of ShinyHunters, the cybercrime crew brazen enough to breach the very agency now hunting them down. A third suspect, reportedly a Canadian national nabbed in Pennsylvania, was flagged by the FBI director via a cryptic post on X. The FBI itself won't confirm the specifics, but the New York Times is running with it, which makes this the first arrest on American soil if accurate.
For a group that prides itself on operational security, the geography is baffling. One suspect was picked up in the Netherlands, another detained in Jordan. Neither country is exactly a safe harbour. Being a talented hacker while living inside FBI jurisdiction is, charitably, a questionable life choice.
ShinyHunters claimed responsibility for the FBI breach not for financial gain but to defend their reputation. Earlier FBI statements around the Instructure/Canvas hack had implied the group engaged in intimidation and sextortion, and apparently that stung enough to provoke a direct attack on the bureau. Their logic: breach the FBI, prove you're elite, get better leverage over future extortion targets. The group reportedly pulled in around $70 million in the past year alone, so there is a functioning criminal business model underneath all the bravado.
The group skews younger and English-speaking, primarily from North America, the UK, and Western Europe. One person detained in Jordan is reportedly 16 years old. That age profile matters, because it shapes how law enforcement responds. Arresting teenagers creates complications. Monitoring them quietly and using that intelligence to work up the chain towards adults who can be prosecuted is often the preferred approach.
Will the brand survive? Probably. ShinyHunters has become more of a franchise than a fixed crew. Leadership changes, members get arrested, the name carries on.
Meanwhile, in AI-enabled vulnerability research, Anthropic's Mythos model has now been linked to a second bug that made it into active exploitation. This one was a critical authentication bypass in Rejetto HTTP File Server, and it is genuinely odd. Mythos analysed the open-source project's code and identified that its pseudorandom number generator was not only weak but was leaking its own output. That combination allowed the model to reverse-engineer session tokens and achieve full admin access followed by remote code execution.
A researcher at Horizon 3 published a proof-of-concept video demonstrating the exploit. The following day, it was already being used in the wild, with traffic traced to a Chinese IP address targeting systems in the US and Japan. The number of victims remains small for now, but the CVE is patched and people running Rejetto HFS should update immediately.
The uncomfortable part is that this is not the kind of bug a human researcher would typically stumble across. It required spotting a subtle mathematical weakness in how randomness was being generated and then working out how to exploit the leak. That is exactly the sort of tedious, precision-heavy analysis that AI handles well and humans find deeply unappealing at scale.
Anthropichas been restructuring its security access programme around all of this. There are now multiple tiers, from standard access through to red team and government-level access, each with progressively fewer restrictions on what the model will help with. They have also launched a critical infrastructure vulnerability programme and released an open-source scanner offering AI-driven security reports to major open-source projects.
The stated goal is getting defensive tools into the hands of defenders before attackers gain an insurmountable lead. Anthropic has suggested they expect defenders to hold the advantage within two years. That is an optimistic read of a threat landscape where attackers only need one success and defenders need to be right continuously.
The broader pattern holds. Security is rarely the priority with new technology until things start going wrong publicly. It happened with cloud, with mobile, and now with AI. The industry builds fast, ships faster, and then figures out what broke. Hopefully the pace of incidents starts to focus minds before the damage becomes genuinely systemic.