AI Security
Mozilla Used Claude Mythos to Find 271 Firefox Bugs — Almost No False Positives
Mozilla built a custom agent wrapper around Anthropic Claude Mythos Preview and pointed it at the Firefox codebase. The result: 271 security vulnerabilities found, 180 rated sec‑high, with almost no false positives.
The Numbers: 271 Bugs, 180 Sec‑High
Mozilla shipped Firefox 150 with fixes for 271 security vulnerabilities discovered by Anthropic's Claude Mythos Preview. Of those, 180 carried Mozilla's highest internal severity rating: sec‑high — bugs exploitable through normal browsing. Another 80 landed at sec‑moderate, 11 at sec‑low. Ars Technica reported Firefox averaged just 20‑25 security fixes per month throughout 2025. In April 2026, the team shipped 423 total fixes, 271 tied directly to Mythos.
The Secret Sauce: A Custom Agent Wrapper
The model alone didn't produce these results. Mozilla built a custom agent wrapper — code that drives the LLM in a structured loop with access to Firefox's build systems, fuzzing infrastructure, and sanitizer builds. Mozilla Distinguished Engineer Brian Grinstead described it to:1 "the code that drives the LLM in order to accomplish a goal. It gives the model instructions, provides it tools, then runs it in a loop until completion." The wrapper transformed Mythos from a passive code reviewer into an active agent.
The Pipeline: Craft, Crash, Verify, Review
Mozilla's AI bug‑hunting pipeline runs in four stages. First, Mythos inspects a source file and crafts a test case — often HTML designed to trigger unsafe behavior. Second, the test runs against a Firefox sanitizer build. A crash equals a confirmed bug. Third, a second LLM grades the output. Fourth, a human engineer performs final review. The sanitizer build provides an unambiguous success signal — the binary crashes or it doesn't. That binary gate eliminated the hallucination problem. Business Insider noted one bug had gone undetected by fuzzers for years.
Almost No False Positives
Earlier AI bug‑finding produced what Mozilla engineers called "unwanted slop" — plausible‑sounding bug reports that were wrong. The Mythos wrapper changed the economics. Grinstead told 1 the reports now have "almost no false positives." Mozilla unhid 12 Bugzilla reports as evidence. The key insight: when your success signal is a sanitizer crash, there is nothing to hallucinate. The binary tells the truth.
From Opus to Mythos: 12x Acceleration
The jump from Opus 4.6 to Mythos Preview quantifies the acceleration. Opus found 22 bugs in Firefox 148. Mythos found 271 in Firefox 150 — a 12x increase between consecutive releases. Mozilla CTO Bobby Holley wrote on the Mozilla blog: "computers were completely incapable of doing this a few months ago, and now they excel at it." Mozilla plans to integrate AI analysis directly into the Firefox development pipeline.
Defenders Finally Get Leverage
Software security has been offensively dominant for decades. Attackers need one weakness. Defenders must protect everything. AI vulnerability discovery at scale — paired with deterministic verification — flips that asymmetry. Holley's closing line on the Mozilla blog: "Defenders finally have a chance to win, decisively." The organizations that build the wrappers first will find the bugs first.
Sources
- 1.Ars Technica(arstechnica.com)
- 2.Business Insider(businessinsider.com)
May 30, 2026
AWS Plans to Add SpaceXAI's Grok to Bedrock, But Enterprise Buyers Aren't Interested
Amazon Web Services is in talks to add SpaceXAI's Grok models to its Bedrock AI platform, according to a Business Insider exclusive. But enterprise security leads are calling it 'the revenge porn edgelord LLM' and demand is somewhere between 'no' and 'why would you ask me that.' The real play may be about locking SpaceXAI into Amazon's Trainium chips ahead of its IPO.
May 30, 2026
SentinelOne Cuts 8% of Workforce as AI Delivers Weeks of Work in Days
Mountain View cybersecurity firm SentinelOne is cutting approximately 230 jobs — 8% of its workforce — after CEO Tomer Weingarten said AI tools now complete work in weeks that previously took months. The layoffs come alongside lackluster earnings guidance that sent shares down 8%, as the cybersecurity sector grapples with AI-driven disruption on both sides of the threat landscape.
Related News
May 29, 2026
Anthropic to Widely Release Mythos-Level AI Models Within Weeks, 7 Weeks After Deeming Them Too Dangerous
Anthropic announced Thursday it plans to widely release Mythos-level AI models — capable of autonomously finding and exploiting zero-day vulnerabilities across every major operating system and browser — just seven weeks after deeming the technology too dangerous for public access. The company says it has made swift progress on safety safeguards, but developers and cybersecurity experts remain deeply unsettled.
May 29, 2026
Musk Says SpaceX-Anthropic Deal Is 180-Day Lease, Not 3-Year Commitment
SpaceX's IPO filing and Elon Musk are telling investors two fundamentally different stories about the company's marquee AI compute deal with Anthropic. The S-1 registration statement implies a ~$45 billion, 3-year commitment through May 2029, while Musk says the deal is just a 180-day lease with 90-day mutual cancellation — a maximum $7.5 billion obligation. The $37.5 billion gap in contracted revenue raises disclosure questions as SpaceX's IPO roadshow approaches on June 8.
May 29, 2026
Anthropic Hits $965B Valuation to Top OpenAI, Drops Claude Opus 4.8
Anthropic raised $65 billion in Series H funding at a $965 billion valuation, officially surpassing OpenAI as the world's most valuable AI startup. The company also released Claude Opus 4.8, its 'most honest' model yet, alongside new developer tools including dynamic workflows and effort control.