Anthropic’s Mythos Fixes 271 Firefox Bugs

|

,

Lily Hay Newman from WIRED reports that Mozilla used an early version of Anthropic’s new Claude Mythos Preview model to comb through Firefox’s source code, and fixed 271 vulnerabilities bugs. The Firefox team does not believe AI will upend cybersecurity long term, yet it warns that software developers are likely in for a rocky transition.

Key takeaways from the WIRED piece:

  • A large leap in just two releases. Mozilla previously used Anthropic’s Opus 4.6 model to scan Firefox 148 and found 22 bugs. With Mythos Preview, the same kind of review in Firefox 150 surfaced 271 issues, according to Mozilla CTO Bobby Holley, who says the haul gave his team a sense of “vertigo.”
  • Reasoning through code, not just fuzzing. Mozilla explains that elite security researchers find bugs that automated fuzzers miss by reasoning through the source code. Holley writes that computers were incapable of this kind of work a few months ago and now excel at it, adding that Mythos Preview is every bit as capable as the world’s best human researchers.
  • No new category of bug, at least for now. Mozilla was encouraged to find that Mythos did not uncover any vulnerability class that an elite human researcher could not have found given enough time. The team pushes back on the idea that future AI models will reveal entirely new kinds of flaws, arguing that Firefox is designed to be reasoned about in a modular way.
  • Access stays narrow through Project Glasswing. Anthropic is limiting Mythos Preview through a restricted program called Project Glasswing, which includes select partners such as Amazon, Apple, Microsoft, and Mozilla. WIRED also notes that the National Security Agency has begun running Mythos Preview on classified networks.
  • A shift in the defender–attacker balance. Holley argues that a gap between machine-discoverable and human-discoverable bugs has long favored attackers, who need only find one flaw. Closing that gap, he says, could erode that advantage and help defenders catch up. Mozilla adds that the supply of defects is finite, suggesting a future where all of them may eventually be found.
  • A rocky transition ahead. The WIRED piece notes that the same technology could also power new forms of cyberattacks. Testing by the United Kingdom’s AI Security Institute reportedly showed Mythos could run complex cyber operations on its own, and Anthropic has acknowledged that some existing cybersecurity benchmarks no longer measure the capabilities of its newest models well.

Taken together, Neuwman’s article frames Mythos Preview as a milestone moment for defenders rather than a silver bullet. The reporters and Mozilla’s own team make clear that the shift will be bumpy, yet the direction is one where bugs may be found and patched faster than attackers can exploit them.

Acknowledgement: This post was generated using Claude AI as part of my AI Exploration process. For more information, please refer to the original article listed below.

Related Resource Link