Editor’s note: we are releasing this disclosure earlier than planned due to the discovery of unauthorized Mythos access by actors outside the original “Glasswing” limited release, and the immediate relevance of that leak to the CLASP attack pattern.
I am disclosing a novel attack pattern that weaponizes the very patch systems we’ve built to defend ourselves, to distribute compromised code globally within hours. It has suddenly become quite viable due to the release of advanced AI models like Anthropic’s Mythos and OpenAI’s GPT 5.4-Cyber this month.
“Chained Leveraged Attack on Supply Patching” (CLASP) chains together existing techniques that are already in use but in a novel way, to drive immediate global deployment of malware directly into critical production systems with minimal review and testing.
If SolarWinds taught us that “trusted updates can betray you,” CLASP teaches that “urgent updates can be weaponized against you at scale.”
Due to the high risk and timely nature of this, I have submitted disclosures of this pattern to NCSC (ref 140426-JWE), CISA, CERT/CC (VRF#26-04-PMPYS), and Isle of Man CSC before publishing.
This post expands on the CLASP security advisory at clasp.info. The advisory is the canonical reference; this post is the extended discussion.
At a glance
What: Four-stage chain: dormant malware in a dependency + legitimate High/Critical CVE disclosed in the same or dependent package → forced emergency patching → defenders install the compromise themselves → detonation at attacker’s chosen time.
Why now: Mythos Preview (Anthropic, 7 April) and GPT-5.4-Cyber (OpenAI, 14 April) make trigger-CVE discovery feasible on demand. Mythos was accessed without authorization on day one. Over 99% of the thousands of high/critical vulnerabilities Mythos has surfaced remain unpatched (Anthropic), and more capable models from both labs are publicly anticipated within weeks.
Defense: None. A successful supply-chain compromise will not be caught during a High/Critical patch release cycle. The malware will be brought into your systems.
Immediately: Verify physical offline backups. Rehearse bare-metal recovery. Review dependency inventory. Brief the incident response (IR) team and verify insurer coverage.
The Novel Combination
CLASP combines two components:
Malware hidden in a supply chain compromise of a popular component.
A legitimate High/Critical vulnerability disclosure in the same package, or in a package that depends on the compromised one.
The attacker can disclose the trigger CVE themselves -- shrinking the window in which the Stage-1 plant could be found -- or ride a CVE disclosed independently in the same ecosystem. Coordination is easier still if the attacker is a maintainer or trusted community contributor rather than an outsider.
CLASP does not require AI to execute. The xz utils near-miss of 2024 demonstrated the pre-plant half of the chain with entirely human tradecraft -- “Jia Tan” spent years building maintainer trust before planting the backdoor, and the trigger was natural adoption into Debian stable, not an engineered CVE. What frontier AI changes is the economics: on-demand vulnerability discovery makes it feasible for an attacker to maintain a stable of pre-planted dependencies and generate a Critical-rated CVE in any one of them on an attacker-chosen timeline. The capability moves from APT-only (years of patient tradecraft per target) to sophisticated criminal operators (weeks of preparation for any target in the stable). That is why the chain needs naming now rather than next year.
Mythos-class capability makes both components newly cheap to produce. Mythos went from 0% to 100% completion on professional cybersecurity challenges in a single year.
These aren’t theoretical capabilities. Mythos has already surfaced:
A 27-year-old denial-of-service vulnerability in OpenBSD’s TCP SACK implementation -- OpenBSD, the operating system whose entire identity is “we audit everything, forever”
A 17-year-old unauthenticated root RCE in FreeBSD’s NFS server (CVE-2026-4747)
A 16-year-old vulnerability in FFmpeg’s H.264 codec, embedded in nearly every video pipeline on Earth
271 vulnerabilities fixed in Firefox 150 from a single Mythos Preview evaluation -- in a codebase Mozilla had scanned with Opus 4.6 two release cycles earlier, yielding the 22 bugs fixed in Firefox 148
Full control-flow hijack (tier-5 in Anthropic’s OSS-Fuzz benchmark) on ten separate, fully-patched targets
Thousands of additional high- and critical-severity vulnerabilities across operating systems and browsers, of which over 99% remain unpatched
Mozilla tried to soften the Firefox 150 result: “Encouragingly, we also haven’t seen any bugs that couldn’t have been found by an elite human researcher.” Elite humans had decades of attention on OpenBSD, FreeBSD, and FFmpeg. They didn’t find them. A codebase audited for 27 years isn’t a cleared codebase -- it’s a codebase cleared against last year’s capability. Firefox 150’s 271 new CVEs, found in code that had just been AI-swept with Opus 4.6, show the asymmetry compounds with every model release.
Mythos is not alone. OpenAI shipped GPT-5.4-Cyber seven days later, with a $10M grant program and critical-infrastructure partners already onboarded (BofA, BlackRock, JPMorgan, Cisco, Cloudflare, CrowdStrike, NVIDIA, Palo Alto, Zscaler). That program wasn’t built in a week. Two frontier labs publicly shipping on-demand vulnerability discovery within two weeks of each other means what’s in-house at each lab exceeds what’s public -- and a sophisticated adversary doesn’t need the best model that exists, only the best model they can access.
The Attack Chain
Stage 1: Compromise the supply chain. Dormant malicious code is planted in a popular codebase, designed to pass automated tests. It waits. This has already happened, repeatedly, and is accelerating:
SolarWinds (2020): compromised build system reached 18,000 organizations
Codecov (2021): tampered bash uploader exfiltrated CI/CD secrets
3CX (2023): compromised desktop app distributed via official update channel
xz utils (2024): years-long social engineering to backdoor a core Linux library, caught by accident
tj-actions/changed-files (March 2025, CVE-2025-30066): compromised upstream dependency cascaded into a widely-used GitHub Action, exfiltrating CI/CD secrets from tens of thousands of repositories
Axios (March 2026, CVE-2026-25639): North Korean state actor hijacked the maintainer account of the most downloaded HTTP library in npm -- 100 million weekly downloads. Malicious versions were live for three hours. Three hours was enough.
Stage 2: Create Urgency via Legitimate Disclosure. Disclose a real High or Critical CVE in (ideally) the same package, or in a package that has a dependency on the compromised code. This will cause the rapid deployment of the compromised code with minimal review and testing to production systems. CISA issues directives. Global security teams scramble to patch within hours.
This is the part that makes the whole chain work. Speed overrides verification. “Patch now, validate later” becomes the only rational response to a real threat. And it IS rational -- that’s what makes it so effective.
Stage 3: Ride the Patch Rush. The emergency update distributes the compromise into production at scale. Organizations with the most mature security posture and automated patching pipelines deploy fastest. The compromised code is installed by the defenders themselves. Many organizations have legal and contractual SLAs around High/Critical patch deployments that mandate fast deployment.
Stage 4: Detonate on the attacker’s schedule. The payload activates when and where the attacker chooses -- everywhere at once, selectively, or in waves. Simultaneous detonation breaks the defense ecosystem: when one organization gets hit, IR firms mobilize and peers share intel. When everybody gets hit simultaneously, companies are on their own. The attack is payload-neutral -- ransomware, espionage backdoor, disruption, whatever fits the attacker’s goal.
The payload doesn’t have to stay static. Once running inside your environment it can call external AI models, download small local models, use your GPU. It becomes an adaptive agent with your credentials and network access -- not a worm running the same exploit everywhere, but something that learns your environment as it moves through it.
Organizations with the best patching processes are most vulnerable.
The advisory states it flatly, and every instinct in a mature security program rebels against it -- which is why it’s the right sentence to lead with. Fast patching is a virtue. The CLASP chain is precisely what turns that virtue into a distribution channel for the attacker. SLA-driven emergency patching compresses verification windows to hours. The organizations that patch fastest are the ones that have automated the trust step -- scanner says Critical, pipeline pulls latest, production rolls forward. That automation is an achievement under normal conditions. Under CLASP, it is the delivery system.
If you read that and want to argue with it, that’s the point. Bring the argument. The organizations that dismiss it without argument are the ones most exposed.
How CLASP Differs from SolarWinds
SolarWinds is the closest real-world analogue. Every difference makes CLASP worse.
SolarWinds succeeded because organizations trusted the update channel. CLASP succeeds because organizations are legally, contractually, and operationally obligated to trust and act on it immediately.
SolarWinds relied on stealth, patience, and selective activation to preserve access over time. CLASP replaces stealth with urgency. Instead of slow, covert propagation, the forcing function is an externally validated High/Critical disclosure that compels defenders themselves to deploy the compromised artifact at speed.
The attacker’s logic for swapping stealth for urgency is mechanical. Every week between a Stage-1 plant and Stage-2 deployment is a week in which a maintainer, auditor, or AI-assisted scan could find the dormant code. A legitimate High/Critical CVE in the same or dependent package collapses that window to hours -- the compromised artifact is deployed before anyone has time to look at it.
SolarWinds limited blast radius to avoid detection. CLASP gives the attacker a menu: stealthy selective activation, simultaneous global detonation, or hybrid -- single trigger or staggered waves, their choice.
The menu maps to intent. A state or APT actor picks stealth for long-dwell espionage, holds damage triggers in reserve for critical systems during geopolitical conflict, or mixes both -- most installs stay dormant, a pre-selected subset detonates on cue. A ransomware crew has the opposite incentive: maximum simultaneous damage out of the gate, because extortion leverage scales with the number of victims on fire at once.
Simultaneous detonation is the headline case because it shifts the consequence from espionage to systemic resilience failure -- IR capacity, vendor support, and cloud provider assistance all constrained at the same moment. But it’s an option the attacker chooses, not a constraint the attack imposes.
SolarWinds required deep, long-term access to a specific vendor. CLASP lowers the bar by allowing coordination between a supply-chain compromise and a separate, legitimate vulnerability disclosure -- particularly viable if the attacker is a maintainer or trusted community contributor. Advanced AI models dramatically reduce the effort needed to do both convincingly and in parallel.
Emergency patching is now a high-risk activity, not a purely defensive one. IASME (Cyber Essentials) recently briefed that the 14-day patch window must be reduced to patch-as-available because AI is generating vulnerabilities faster. The window for review is shrinking at exactly the moment the cost of skipping review is rising.
The Defender-Only Framing Has Already Failed
Both Mythos and GPT-5.4-Cyber are gated to “verified defenders” under the strictest capability-restriction regimes any frontier labs have published. Those regimes are already not holding.
Public models already reproduce the capability. Seven days after Mythos’s announcement, Vidoc Security Lab reproduced key findings (FreeBSD, Botan) using public GPT-5.4 and Claude Opus 4.6 through the opencode harness. Vidoc’s own summary: “the key building blocks are already accessible outside Glasswing, while reliable operationalization remains the real moat.”
The gating failed on day one. On April 7, 2026, day-of-launch, a Discord group monitoring unreleased AI models guessed the Mythos URL from Anthropic’s naming conventions and obtained shared accounts and API keys belonging to authorized third-party contractors. Anthropic’s monitoring didn’t catch it. They used Mythos freely for fourteen days until Bloomberg reported the breach on April 21 (paywalled; free summary via TechCrunch). The users were hobbyists, not a nation-state -- one told Bloomberg they were “interested in playing around with new models, not wreaking havoc.” This time.
Anthropic didn’t lose Mythos directly. They lost it through a third-party vendor, through shared credentials, through the distributed-trust model every enterprise runs on. If the most safety-conscious frontier lab under the strictest Responsible Scaling Policy ever published can’t keep its most dangerous model gated for more than a single day against curious Discord users, the operational assumption for CLASP is that these capabilities are available to anyone watching for the weak link.
The Stage-2 inventory is already built. Mythos has disclosed “thousands of additional high- and critical-severity vulnerabilities,” “over 99%” still unpatched (Anthropic’s own words). A CLASP attacker doesn’t need to find or manufacture a trigger CVE. Thousands are already sitting unpatched in the infrastructure that runs the internet.
To be clear: this is not a critique of Anthropic or OpenAI. Their gating, Responsible Scaling commitments, and public disclosure of capability are exactly what make systemic threat modeling like CLASP possible to write. Mozilla’s transparent reporting on the Firefox 150 sweep is the same pattern. The risk is not in the labs doing this work -- it is in the assumption that capability gating alone can keep these tools out of adversary hands when the distributed-trust surface around any lab is this wide.
The Patch Flood Is Its Own Attack Surface
The AI-surfaced bugfix wave is, simultaneously, the best chance to clean decades of latent vulnerabilities and the most target-rich moment to plant the next generation of dormant compromises. AI-surfaced vulnerability reports have already overwhelmed maintainer review bandwidth to the point that major projects are withdrawing from open bug-bounty channels: curl ended its nine-year HackerOne bug-bounty program on January 31, 2026, citing “an explosion in AI slop reports” and a drop in the confirmed-vulnerability rate from above 15% to below 5%. That’s not a forecast. That’s the leading edge of the flood already washing over maintainers.
When thousands of AI-surfaced fix pull requests hit a maintainer’s queue inside a compressed review window, the human capacity to actually audit each incoming change collapses. That is exactly the condition a patient attacker wants. The legitimate fix traffic provides cover for a new, deliberately-planted backdoor to slip into the same repo unnoticed. Every CLASP deployment then has a fresh Stage-1 inventory to pull from on the next rotation.
This is why the transition period deserves operational treatment as a period of heightened pre-plant activity, not just heightened patching. Review discipline on incoming commits -- especially non-fix commits that ride in alongside the fix -- is the defensive practice this moment most demands. AI-assisted commit review, pairing an AI auditor against the AI-surfaced PR, is a defender counter-move that compresses exactly the asymmetry the attacker is exploiting.
Defenses: None
You will not catch the Stage-1 plant during the Stage-2 emergency patch cycle. xz utils maintainers couldn’t find a backdoor in their own codebase for two years. FFmpeg survived five million automated tests with a hidden bug for sixteen. Your team has hours. The malicious code WILL be deployed into your network.
You also can’t leave the published High/Critical unpatched. CISA is issuing directives. Your systems are exposed. You HAVE to patch. The attacker is counting on it.
Traditional supply-chain hygiene -- canary environments, reproducible builds, dependency pinning -- raises the bar for lazy attacks. It won’t stop a well-planned CLASP. Stop pretending it will.
Why SBOM, SLSA, and signed commits help but don’t close the gap
Provenance tooling -- SLSA, Sigstore, signed commits, multi-party review -- is effective against anonymous infrastructure compromise. The attacker who steals a maintainer token and pushes unsigned code is stopped at the signature check. It’s less effective against the xz model: a patient actor who becomes a trusted maintainer, earns commit rights, and signs the malicious commit themselves. Provenance tells you who committed the code, not whether they should be trusted. CLASP assumes the trust half has already been subverted; the patch-cycle half is what scales delivery.
Transitive dependencies deepen the problem. An SBOM can confirm a direct dependency is pinned and signed while a third-layer dep pulled by that package is the actual source of the payload. “We have SBOM” is not the same as “we are fine.”
New Security Posture: Assume Compromise, Optimize Recovery
This requires a different posture than prevention: Offline Backups & Fast Recovery.
Get backups physically offline. Not cloud snapshots on a platform an attacker can reach with admin credentials. Not immutable snapshots on a storage platform that can be deleted if an attacker gets admin credentials. Physically disconnected. Backup hard drives or tapes on a shelf. Rotated daily. It’s old-fashioned because it’s the only strategy an AI-powered exploit chain can’t reach.
Treat infrastructure as disposable. Rebuild from known-good base images plus offline backups on new machines. Not from yesterday’s image (which might be compromised). If you can’t rebuild critical systems from bare metal using only what’s air-gapped, you have a DR plan with major holes in it.
Practice rebuilding regularly. Most organizations test DR annually at best, and it’s painful every time. That tells you it won’t work under pressure. Quarterly at minimum. Build the muscle so recovery is a practiced process, not a panicked improvisation.
The outsourced-resilience problem. IR retainers, managed-detection services, cloud DR providers, and consulting firms are all shared resources. A CLASP-class event saturates all of them simultaneously -- which means outsourced resilience is a posture that fails exactly when it is most needed. Recovery capability has to live in-house, on staff, funded as a headcount line rather than a retainer line, before the event starts.
Plan for external help being unavailable. If CLASP hits thousands of organizations simultaneously, your IR retainer is already on six other calls. Your cloud provider may be down. The consulting firm you’d normally call may be compromised themselves. You need to have the internal skills to stand up critical infrastructure internally, on your own hardware if cloud services are affected by a global-scale attack.
Plan for AI help being unavailable too. If your recovery plan is “ask the AI,” that breaks when the AI services are overloaded or compromised themselves. Do you have in-house AI that runs when your external providers are down? What if your internal AI is inside the blast radius of the exploit you’re recovering from? AI is an amplifier, not a substitute -- you need humans on staff who know the system.
Fund in-house recovery as a headcount line. If the board treats recovery expertise as a retainer that can be cut in lean quarters, the organization has adopted the riskiest possible posture. Retainers fail exactly when they are needed; salaried recovery engineers do not.
Monitor behaviour after emergency updates. CPU, GPU, outbound traffic -- quantities, patterns, destinations. Anything outside normal baselines should trigger alerts. Crank up sensitivity for at least a week or two after every emergency patch to make sure nothing unexpected is happening. This will create more false positives, but it’s a necessary defensive detection step.
Know your dependency tree. Maintain a Software Bill of Materials (SBOM) so when a supply chain compromise IS disclosed, you can assess exposure in minutes, not days.
Map your kill switches. Most organizations’ incident response plan for a major compromise is “turn everything off.” That’s not a plan. Map your network interconnects. Know exactly how to isolate segments. Factor in that TCP/IP and self-healing systems will try to route around blocked paths -- you need to disable the interconnects, not just block traffic.
Talk to your insurer. Ask them this: does our policy cover simultaneous, AI-orchestrated attack across our entire infrastructure via a compromised supply chain update? If they can’t answer clearly, you’ve got a gap. If they’ve never been asked that question before... that tells you something about how ready the industry is.
The Responsible Disclosure Challenge
I’ve followed responsible disclosure my entire career. When I found SQL injection across Adobe Dreamweaver’s entire platform stack (CVE-2006-2042), I notified Adobe and worked with their developers for a year before publishing.
But this scenario doesn’t have a vendor. There’s nobody to notify. No patch to develop. The vulnerability isn’t in any software -- it’s in the way we trust and distribute software updates.
I briefed four agencies on April 13-14, 2026 before publishing: CISA (US), CERT/CC, the UK NCSC, and the Isle of Man Cyber Security Centre.
They can’t patch this any more than I can. But systemic authorities need to factor the specific chain into their threat modelling, advisory processes, and coordination frameworks for mass-incident response.
I’m publishing fast because the barrier to execution has already dropped. Mythos was accessed by unauthorized users within 24 hours of announcement. Its findings have been reproduced on public models. The Stage-2 inventory is already thousands deep. Open-source cyber models follow within months. Waiting for general availability would mean publishing after the first successful CLASP operation, not before.
Concurrent Thinking
Major security vendors have published on adjacent aspects of this problem in the weeks leading up to this disclosure:
Talos (Dave Liebenberg, April 3, 2026, “Do not get high(jacked) off your own supply (chain)”) surveys the recent supply chain attack spike and recommends fundamentals. Treats supply chain attack as a category rather than a chain with exploitable structure.
Rapid7 (Wade Woolwine, April 23, 2026, “AI is Changing Vulnerability Discovery and your Software Supply Chain Strategy has to Change with it”) frames AI as widening the disclosure-to-remediation gap and recommends deeper inventory and pipeline hygiene. Identifies the speed problem without identifying pre-plant + emergency patch as a chained delivery mechanism.
Proofpoint (Sumit Dhawan, April 22, 2026, “The Patch Cycle Is No Longer the Security Clock”) argues patch cycles are too slow against AI-compressed weaponization of public CVEs. Different axis -- exploitation speed -- from CLASP’s patch-as-payload-vector.
The analyses circle the territory CLASP names. The specific chain -- pre-plant + engineered/selected emergency CVE + forced patch delivery -- is not synthesized in any of them.
Q&A
Is this a new type of attack?
No. Supply chain attacks are well-documented (SolarWinds, xz utils, Axios). CVE-driven emergency patching is routine. What CLASP describes is a new form of delivering a supply chain attack at speed and scale after the compromised code has already been pulled into the main codebase. The novel element is using a legitimate vulnerability disclosure as the forcing function to drive global deployment of pre-planted malware, exploiting the very urgency that defenders rely on to stay safe.
Why disclose this publicly now?
Because the barrier to execution has already dropped. Mythos-class capability has been accessed by unauthorized users within 24 hours of announcement. Its findings have been reproduced using public models. The inventory of unpatched zero-days is already thousands deep. Open-source frontier-cyber models will follow within months. Waiting for general availability to publish would mean publishing after the first successful CLASP operation, not before.
What should I do right now?
Get backups physically offline. Test your ability to rebuild from bare metal. Map your kill switches. Review your dependency tree. Monitor behaviour after emergency patches. Talk to your insurer. The New Security Posture section has the full list.
How likely is this to actually happen?
This feels like the next logical step nation-state operators will explore once AI-assisted vulnerability discovery and supply-chain access converge. Every stage of this chain has already happened individually. The only thing that hasn’t happened is someone executing them in sequence, at scale, on purpose. Given what we now know about AI-powered exploit chaining, I don’t think the question is whether. It’s whether we’re ready.
For the advisory summary, threat-model brief, and board questions, see clasp.info. For the systemic context across the next 18-24 months, see Pressure Tested.
Brian Gallagher has over 45 years of experience in consulting and cybersecurity, including published CVEs and other advisories. He consults for multiple national governments, serves on the Isle of Man’s national AI Advisory Group (AIAG), was part of the incident response team at Johns Hopkins University, and was once paid by a city police department to hack into their own computer system after they lost access to it (best job ever!).
Acknowledgments: Thanks to Jeff Ames, CTO of Computer Network Defence Ltd, for peer review prior to publication.
Disclosure:
The author briefed IOM CSC, NCSC (ref 140426-JWE), CISA, and CERT/CC (VRF#26-04-PMPYS) on the attack pattern described in this article before publication.
Disclosures to Anthropic and OpenAI have been sent.
Publication was accelerated due to the imminent broader availability of Mythos-class AI capabilities.