"This is not financially motivated, this is to preserve our reputation," ShinyHunters told reporters when asked about the FBI breach that exposed sensitive Bureau data, according to Reg cybersecurity editor Jessica Lyons.
FBI arrests in the ShinyHunters investigation
The FBI announced a further arrest in the probe of the ShinyHunters extortion group, bringing the publicly discussed tally to three, hosts said on The Register's Kettle Podcast. The FBI director posted a message on X and emailed reporters that "our agents in the field have arrested another suspected co‑conspirator of the Shiny Hunters group," Jessica Lyons recounted on air.
The New York Times reported the latest arrestee is a Canadian citizen taken into custody in Pennsylvania, which would mark the first U.S. arrest in the case if that confirmation holds. Earlier detentions include one in the Netherlands and another individual reportedly detained in Jordan; the Jordanian detainee was described by sources on the show as a 16‑year‑old.
What ShinyHunters claims it did and why
ShinyHunters publicly framed the late‑September breach of FBI systems as an effort to demonstrate skill and protect the group's reputation, not as a purely monetary operation. Lyons relayed that ShinyHunters claimed the hack stole "a ton" of data on agents and applicants — "they claim it was everyone's" — though she cautioned that extortion actors sometimes inflate scope to raise payouts.
The group has previously pressured the FBI to retract language used after an Instructure breach that implicated the criminals in "violent" or intimidation tactics, including alleged sextortion. ShinyHunters reportedly wanted those statements walked back to protect their brand and maintain leverage with extortion victims; Lyons described the group as largely English‑speaking and focused in North America, the UK and Western Europe.
Despite the group's public posturing, Lyons and host Brandon Vigliarolo noted that ShinyHunters runs a profitable extortion business: "by some accounts they are the most successful cybercrime business," she said, with an estimated $70 million extracted in the prior year.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAnthropic's Mythos: AI finding a hard‑to‑see Rejetto HFS flaw
On the AI front, the podcast discussed a separate story: Anthropic's Mythos model reportedly discovered a second vulnerability that immediate actors exploited in the wild. According to a Vulnchek security researcher tracking Mythos, the flaw was a "critical authentication bypass" in Rejetto HTTP File Server (HFS) that enabled full admin access and remote code execution.
Lyons explained the technical root: Mythos analyzed HFS source code, identified that the pseudo‑random number generator (PRNG) leaked its output, and reversed the generator to use that leak to bypass authentication. The vulnerability was demonstrated in a proof‑of‑concept video by researcher Zach Hanley; a patch and CVE followed, but exploitation was seen the next day.
Initial exploitation appeared narrowly targeted: the hosts said early activity showed a small number of victims in the U.S. and Japan, with at least one exploit source IP tied to China. The discussion emphasized that the specific math and reverse‑engineering involved made this kind of finding unlikely for many human researchers to discover unaided.
Anthropic's program changes and the defender debate
Tom Claburn described changes at Anthropic: the company restructured its security partner program, added tiers (including a "special government level") with different refusal thresholds, opened a critical‑infrastructure vulnerability program, and released an "OSS scanner" to provide prominent open‑source projects free AI‑enabled vulnerability reports.
Anthropic reportedly told partners it expects defenders to gain an advantage within two years — an optimistic claim noted on the podcast — but hosts cautioned that the attacker‑needs‑only‑one advantage remains a core challenge. They also raised the legal and operational question of whether companies that provide offensive discovery tools could face liability if findings are weaponized, with Claburn suggesting application, not mere discovery, would be the primary legal exposure.
What this means for defenders, policymakers, and open‑source maintainers
- Defenders and security teams: Expect a faster cadence of obscure, math‑heavy findings that AI models can surface; Lyons and Claburn argued defenders will need access to comparable tools and better patching pipelines to keep pace.
- Policymakers and regulators: The hosts said Anthropic's program restructures appear driven in part by pressure to show proactive measures and avoid legislative scrutiny — a dynamic that may prompt closer oversight of AI programs that provide vulnerability discovery capabilities.
- Open‑source maintainers: The release of an OSS scanner and a vulnerability disclosure pipeline creates both relief and urgency — maintainers whose dependencies include lesser‑observed components like Rejetto HFS may now face AI‑driven scrutiny and the need to patch quickly.
The two threads — high‑profile arrests tied to a branded extortion operation and an AI model surfacing technically subtle vulnerabilities — arrive together as a reminder: the human elements of motive, money and recruitment endure, even as tools change the arithmetic of discovery. The arrests may degrade one brand; the AI reports make clear that the next zero‑day may be written by a model, not a person.
