AI Uncovers Squidbleed, a 29-Year-Old Squid Proxy Bug

Security researchers have disclosed Squidbleed (CVE-2026-47729), a memory-leak flaw in Squid Proxy that survived 29 years of releases, audits, and rewrites. The twist: it was found with the help of an AI model, Claude Mythos.

The bug matters less for its severity than for how it was caught. An AI, pointed at decades-old code, flagged a subtle flaw that generations of human reviewers had missed.

What Squid is, and what went wrong

Squid is a widely used open-source web proxy — software that sits between users and the internet, forwarding and caching their web requests. It's been running quietly in corporate networks and universities since the 1990s.

Squidbleed is a heap over-read: under the right conditions, Squid can return chunks of its own internal memory that it shouldn't. Because that memory can contain other users' web requests, the leak can expose sensitive data like passwords and session tokens carried in cleartext HTTP traffic.

Security researchers have compared it to Heartbleed, the infamous 2014 bug that leaked memory from a huge swath of the internet. Squidbleed is far narrower in reach, but the shape is similar: quiet, unintended memory disclosure.

The exposure is limited — on purpose

Here's the reassuring part. The conditions required to trigger Squidbleed are specific, which sharply limits real-world exposure.

Most web traffic today is HTTPS (encrypted), which the proxy relays as an opaque tunnel it can't read into. That means the bug primarily affects cleartext HTTP and certain TLS-terminating setups — a shrinking slice of modern traffic. The vulnerable path also runs through Squid's FTP gateway, an old file-transfer feature most networks barely use anymore.

Why this matters: a bug's severity depends as much on how easily it can be triggered as on what it leaks. Squidbleed's narrow trigger conditions are the main reason it isn't a five-alarm fire.

The AI angle is the real story

The discovery came from the security firm Califio, working in partnership with Anthropic and using Claude Mythos Preview to investigate Squid's aging FTP handling code.

Asked to examine that part of the codebase, the model reportedly flagged the suspicious pattern almost immediately — a single-line quirk buried in code that had been shipped, reviewed, and rewritten for nearly three decades.

Why this matters: this is a concrete example of AI doing useful, hard security work — not writing marketing copy, but reading gnarly legacy C code and spotting a real flaw. It suggests AI models are becoming genuine tools for auditing the vast, aging codebases that quietly run the internet.

Already fixed

The good news for defenders: the fix is small and already available. Maintainers added a simple safeguard to the vulnerable code, merged into the development branch earlier this spring and into the current major release.

For network operators, the most robust protection is even simpler: turn off Squid's FTP feature. Modern browsers dropped FTP support years ago, and most networks carry almost none of it, so disabling it removes the exposed surface entirely.

That's the practical takeaway. If you run Squid, updating to a patched version and disabling FTP handling closes the door.

Who should care

For system administrators, the action item is clear: check your Squid version, apply the update, and disable FTP if you don't need it. It's a low-effort fix for a bug that's now public.

For the broader security industry, Squidbleed is a proof point. Legacy open-source infrastructure — the unglamorous software holding up much of the internet — is riddled with old code that no one has the time to fully re-audit. AI models that can read it fast and cheaply could change that math.

For AI companies, it's a validation of a growing use case. Anthropic has been positioning its models for security research, and a real, credited CVE discovery is far more persuasive than a demo.

What's next

Expect more of this. As AI-assisted code auditing matures, security teams will increasingly point models at old, critical software to hunt for exactly the kind of long-buried flaw Squidbleed represents.

The open question is how the disclosure ecosystem adapts. If AI can surface vulnerabilities faster than maintainers can patch them, the pressure shifts to coordinated disclosure and rapid fixes — the same challenge human researchers already navigate, now at greater speed.

The bottom line

Squidbleed is a manageable bug with a limited blast radius and an available fix. Its lasting significance is the method: an AI model found, in moments, a flaw that hid in plain sight for 29 years.

If you run Squid, patch it and disable FTP. And if you work in security, take note — AI-assisted auditing just moved from promising idea to credited discovery.