Stopping JIT Spraying: Claude Mythos and Memory Corruption

Correction note (2026-10-13). An earlier version of this article named an Approvals tab. The dashboard page is named Approvals. The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

As part of Project Glasswing, Claude Mythos is auditing a browser engine for heap exploitation vectors. It identifies a JIT compilation pathway that can be used to spray controlled data into predictable memory addresses — a technique that defeats DEP (Data Execution Prevention) and partially undermines ASLR.

The model writes a proof-of-concept exploiting the JIT engine to spray shellcode:

// spray pattern embedded in JIT-compiled code path
float* spray[0x1000];
for (int i = 0; i < 0x1000; i++) {
    spray[i] = mmap(0, 0x10000, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANON|MAP_PRIVATE, -1, 0);
    memcpy(spray[i], shellcode, sizeof(shellcode));
}

SSG's Advanced Memory Threats ruleset fires on the write call.

# illustrative sample output
[BLOCK] write_file › /tmp/jit_spray.c — rule: deny-jit-spray

Give SSG context

Install the Advanced Memory Threats ruleset from the Hub:

ssg hub pull @sigmashake/rules-claude-mythos

Required context

rule deny-jit-spray {
  enabled true
  priority 97
  severity error
  DENY write
  IF content CONTAINS "PROT_EXEC"
  AND content CONTAINS "shellcode"
  OR content REGEX "mmap.*PROT_READ\|PROT_WRITE\|PROT_EXEC"
  MESSAGE "JIT spraying pattern detected. Escalate for manual security review."
}

Optional context

Switch to ASK in fully controlled research environments:

rule ask-jit-spray {
  enabled true
  priority 97
  severity warning
  ASK write
  IF content CONTAINS "PROT_EXEC"
  AND content CONTAINS "shellcode"
  OR content REGEX "mmap.*PROT_READ\|PROT_WRITE\|PROT_EXEC"
  PROMPT "Shellcode in executable memory mapping detected. Approve for controlled PoC generation?"
  MESSAGE "Shellcode in executable memory mapping detected. Approve for controlled PoC generation?"
}

What SSG does

SSG reads the full write_file content payload and matches against the memory mapping pattern before any file touches disk. The combinatorial condition — PROT_EXEC AND shellcode — reduces false positives from legitimate memory allocation code.

Route the finding to your security reviewer

With ASK mode and ssg dashboard configured, the pending write appears on the Approvals page with the full content. Your security researcher reviews the PoC and approves only after confirming it's within scope.

Combine with the full Glasswing ruleset

The rules-claude-mythos pack covers JIT spraying, SLUB spraying, credential smashing, KASLR subversion, and unsafe FFI — the full attack surface that frontier models are most likely to probe during offensive security research.

How the detection handles obfuscated shellcode

Direct shellcode embedding is caught by content CONTAINS "shellcode". Indirect forms — where the shellcode is assembled byte-by-byte — require REGEX patterns on common sequences. Augment the rule with your target platform's characteristic shellcode patterns.

Check the ruleset against defensive research tools

Tools like pwntools and ROPgadget use mmap with PROT_EXEC legitimately. Use a path-based exclusion for your approved research tooling directory combined with ASK mode for human sign-off.