For 29 years, a single line of C code in one of the internet's most widely deployed proxy servers quietly leaked strangers' passwords. Human code reviewers missed it. Security auditors missed it. Penetration testers missed it. It survived three decades of releases, rewrites, and audits inside Squid, the open-source web proxy that sits between users and the internet on countless corporate networks, school systems, and public Wi-Fi hotspots — including, as the researchers who found the bug discovered, the one on a commercial flight they happened to be taking.
Then, in the spring of 2026, an AI model read the same code and flagged the flaw almost immediately.
The vulnerability, now tracked as CVE-2026-47729 and nicknamed "Squidbleed" after the infamous 2014 Heartbleed bug, was disclosed in June by researchers at Calif.io working in partnership with Anthropic. It was surfaced by Claude Mythos Preview, the frontier model behind Anthropic's defensive security effort Project Glasswing. The story is a compact case study in what AI-assisted vulnerability research can do at scale — and a pointed reminder of the double edge that comes with it.
A one-line bug, hiding since the Clinton era
Squidbleed is a heap buffer over-read, the same class of memory-disclosure flaw as Heartbleed. When triggered, it leaks bytes of Squid's internal memory — memory that can contain another user's cleartext HTTP request, including credentials, session tokens, or API keys — back to an attacker.
The root cause is almost quaint. It lives in the parser Squid uses to render FTP directory listings, code whose lineage traces to a commit created on January 18, 1997, added to support the whitespace quirks of NetWare file servers popular in the 1990s. The parser skips leading whitespace with a loop built around the C standard-library function `strchr`. The trap: when a malicious FTP server sends a listing line that ends right after the timestamp with no filename, the pointer lands on the string's null terminator — and `strchr`, per the C standard, treats that terminating NUL as part of the string it searches. It returns a valid pointer instead of stopping. The loop walks off the end of the buffer, and the code copies whatever memory follows back to the attacker as a "filename."
As Calif.io's writeup put it, "Few developers would guess that searching for `'\0'` succeeds, which may explain how a one-line bug survived close to 30 years of code review." Claude Mythos Preview, the researchers noted, "having trained on the entire C standard reference, treats this quirk as just another fact. When pointed at the right code, it spotted the bug almost immediately." The model's own logged verdict during the analysis was blunt: "Confirmed. strchr(w_space, '\0') returns non-NULL per C11 §7.24.5.2 (terminating NUL is part of the string). This is a real bug."
The impact is real but bounded, and it is worth being precise about it. Squidbleed only exposes traffic Squid can actually read — cleartext HTTP and TLS-terminating setups, not the HTTPS most people rely on, which Squid relays as an opaque encrypted tunnel. The attacker must already be a "trusted client" permitted to use the proxy, and must be able to route the proxy to an attacker-controlled FTP server on port 21. Both FTP and that port are enabled in Squid's default configuration. SUSE rated the flaw moderate, with a CVSS score of 6.5, and no in-the-wild exploitation had been reported as of disclosure. The fix is a two-character guard — checking for the null terminator before each vulnerable `strchr` call — merged into Squid's development branch in April and backported to version 7 in May.
The scale behind the single bug
Squidbleed matters less as an isolated CVE than as a data point in a much larger program. It emerged from Project Glasswing, Anthropic's initiative — launched with partners including AWS, Apple, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, and NVIDIA — to find and fix vulnerabilities in critical software before more capable models can be turned against it.
The reported numbers are striking. According to figures cited in coverage of the program, Anthropic and roughly 50 partners have used Claude Mythos Preview to identify more than 23,019 issues across more than 1,000 open-source projects, of which some 6,202 were rated high- or critical-severity. On independent sampling, partners reported a 90.6 percent confirmation rate — a low false-positive figure that matters enormously in practice, because it means maintainers are not being buried under noise. A tool that flags ten thousand things, ninety percent of them phantom, is worse than useless to an overworked open-source maintainer. A tool that flags ten thousand things and is right nine times out of ten changes the economics of software security.
That is the real argument Squidbleed makes: an AI model can sustain a depth and breadth of code analysis that human audit teams cannot afford to match. No security team was ever going to be paid to re-read a 1997 FTP parser for the ten-thousandth time. A model reads it as readily as any other file.
The uncomfortable symmetry
The irony sitting at the center of this story is hard to miss. The same class of frontier model that the U.S. government moved to restrict over cybersecurity concerns — Anthropic was ordered in June to suspend access to its most capable Mythos- and Fable-class models for foreign nationals, and the Five Eyes intelligence alliance warned that AI-powered cyberattacks are "months, not years" away — is the same class of model that just found a 29-year-old bug every human team missed.
That symmetry is the whole point, and the whole problem. A model capable enough to spot a buried memory-disclosure flaw at a glance is, by definition, capable enough to be pointed at code with the opposite intent. Defensive discovery and offensive discovery are the same capability wearing different hats. Project Glasswing's entire premise is a race: find and patch these flaws in the open, at machine speed, before someone with a machine and bad intentions finds them first. Squidbleed is a point on the board for the defenders. It is not proof the race is won.
What to watch
The near-term signal is downstream remediation. Squid ships in countless distributions, each maintaining its own build — Debian, for instance, packages the older Squid 5.7 — and the public disclosure thread was notably muddled about which release actually carried the fix, with maintainers correcting themselves more than once. Organizations running Squid should verify the patch is present in `FtpGateway.cc` rather than trusting a version number, and, as the researchers bluntly recommend, simply disable FTP support, which almost no modern network legitimately uses.
The larger thing to watch is whether Glasswing's confirmation rate holds as the program scales, and whether the coordinated-disclosure pipeline can keep pace with the discovery firehose. Finding 23,019 issues is one achievement; getting 23,019 issues responsibly triaged, patched, and shipped through fragmented open-source supply chains is a far harder one. And watch the other side of the ledger. If a defensive program can surface a bug this old this fast, the question is no longer whether adversaries will use the same tools — it is who patches faster once both sides are reading the same code.
"Few developers would guess that searching for '\0' succeeds, which may explain how a one-line bug survived close to 30 years of code review."— Calif.io, Security research firm, Squidbleed disclosure