Anthropic AI helped Firefox find 271 vulnerabilities

Mozilla engineers ran Anthropic’s Claude Mythos Preview against the Firefox codebase during an evaluation for Firefox 150. The team reported they identified and fixed 271 vulnerabilities.

The evaluation followed an earlier collaboration that used Anthropic’s Opus 4.6 model, which produced 22 security-sensitive fixes in Firefox 148.

Engineers matched model output with known threat databases and integrated findings into their testing pipeline. The pipeline cross-checked AI-flagged issues against static analysis tools and fuzzing results to reduce false positives.

The team reported the Mythos Preview model matched the reasoning ability of top security researchers in their tests. They reported no class of flaw that humans could identify which the model could not, and they did not encounter bugs beyond existing categories of software defects.

Running large models against proprietary code required significant compute and secure infrastructure. Teams built protected vector database environments to handle large context windows while keeping corporate logic isolated from external access.

Model outputs required validation because large models can produce false positives. Triaging AI-flagged items consumed engineering time.

Dynamic analysis such as fuzzing remained central to security testing. Fuzzers were effective on many code paths but struggled with some logic. Senior security researchers continued to find certain logic flaws by manually reviewing source code.

Uncovering hundreds of issues at once created an intense remediation phase. Teams needed to reassess priorities and apply engineer hours to fix the flagged vulnerabilities. Mozilla reported that in the current regulatory environment addressing such flaws reduces the risk of data breaches and ransomware.

For many organizations, rewriting large legacy C++ codebases in memory-safe languages like Rust is financially impractical. Automated reasoning tools provided a way to find vulnerabilities in long-lived code without pausing development for a full rewrite.

Mozilla’s evaluation raised questions about how companies manage software risk and vendor due diligence as automated audits are adopted.