Anthropic's AI system Mythos Preview flagged 271 previously unknown zero-day vulnerabilities in Firefox 150 — an unusually large haul for a mature browser and, Mozilla says, the product of AI-assisted analysis rather than only manual auditing.
What was uncovered
Mozilla announced that Anthropic's vulnerability-hunting system, Mythos Preview, identified 271 previously unknown zero-day flaws in Firefox 150. The company said the scale of the findings surprised its engineers. The bugs range across components used in the browser and touch on code that underlies common web features.
Zero-day vulnerabilities are flaws attackers can exploit before vendors have issued fixes. They matter because exploits can be used to run malicious code or steal data with no prior warning. Finding 271 such issues in a single release is unusual for a mature, widely used browser.
Mozilla did not list every flaw in public detail when it confirmed the results, but made clear the count came from an AI-assisted analysis using Anthropic's Mythos Preview rather than only from traditional manual auditing.
How Mythos works — and why it's different
Mythos is an AI system designed to read and test large codebases for security holes at scale. Rather than relying only on human intuition and manual code review, Mythos automates many steps of vulnerability discovery. Key capabilities Mozilla and Anthropic described include:
- Generating targeted inputs and test cases to exercise code paths
- Exploring execution paths and flagging patterns that often lead to memory errors or logic bugs
- Proposing and reproducing problematic behaviour inside sandboxed environments to speed confirmation
Security researchers have used automated tools for audits for years, but recent AI models can reason about code and program behaviour in deeper ways than earlier scanners. That allows the tools to propose exploits and reproduce issues more quickly, reducing the time it takes to confirm a flaw.
What the industry sees as the balance shift
Observers say AI tools like Mythos change the economics of vulnerability discovery. When tools make it cheaper and faster to find bugs, defenders can locate and fix flaws more quickly. At the same time, attackers could employ similar techniques to hunt for bugs faster — a tension Mozilla and others have highlighted. Some coverage, including reporting by Ars Technica, argued Mythos could tilt the balance toward defenders if maintainers run the same checks at scale.
Implications for open source projects
Mozilla highlighted a particular danger for open source components. Public code repositories let AI tools trawl entire projects quickly. For small projects maintained by a few volunteers, that creates a risk: the code is easier to analyse, but the people fixing bugs may not have time or resources to respond at the same pace.
The company warned this creates a risk for small open source projects that may lack the people or resources to respond as quickly as AI tools can find bugs. That shortfall could leave widely used components exposed unless maintainers receive more support or automated checks become commonplace.
Why this matters: the scale of the findings shows AI can rapidly expose vulnerabilities in public codebases — which could benefit defenders if maintainers run the same checks and have the resources to act. But without that access and support, smaller projects risk being left behind while flaws are found at machine speed.
Related Articles
- Schematik: 'Cursor for Hardware' Built on Claude
- Data-centre delays threaten AI expansion
- Robot brain learns to tackle tasks it never saw
Mozilla says maintainers and organisations need access to similar tools and more support for smaller projects. Raffi Krikorian, Mozilla chief technology officer, wrote: "The programmer who gave 20 years of his life to maintain [open source] code that runs inside products used by billions of people? He doesn’t have access to Mythos yet. He should."
This article was created with AI assistance.
