How Anthropic’s Mythos has rewritten Firefox’s method to cybersecurity

When Anthropic unveiled its new Mythos mannequin in April, it additionally delivered a stern warning to anybody growing software program. The mannequin was so highly effective at sniffing out software program vulnerabilities, the lab claimed, that it had found hundreds of high-severity bugs that might have to be mounted earlier than it could possibly be made public.

Now, security researchers for Mozilla’s Firefox browser are offering a better have a look at what that course of has seemed like in apply, and what Mythos’ powers imply for software program security at massive.

In a submit printed on Thursday, Mozilla mentioned Mythos has unearthed a wealth of high-severity bugs, together with some that had lain dormant within the code for greater than a decade.

That’s a big enchancment from what AI security instruments have been able to even six months in the past. Till now, AI bug-finding instruments have include extreme drawbacks, usually inundating security groups with low-quality reviews and false positives. However Mozilla’s researchers say the most recent era of instruments have turned a nook, significantly now that agentic techniques can assess their very own work and filter out dangerous outcomes.

“It’s troublesome to overstate how a lot this dynamic modified for us over just a few quick months,” the researchers wrote. “First, the fashions received much more succesful. Second, we dramatically improved our methods for harnessing these fashions.”

The outcomes are placing: In April 2026, Firefox shipped 423 bug fixes, in comparison with simply 31 precisely a 12 months earlier. The researchers have additionally printed particulars on 12 of the bugs, which vary from a pair of bizarre sandbox vulnerabilities, to a 15-year-old error in how the browser parses an HTML aspect.

“This stuff are literally simply instantly excellent,” Brian Grinstead, a distinguished engineer at Mozilla, instructed information.killnetswitch. “We see that on our personal inner scanning, we see that on exterior bug reviews, and we see that in all types of alerts throughout the business.”

The truth that the system helped reveal vulnerabilities in Firefox’s “sandbox” system is especially spectacular, given how intricate an assault that exploits it must be. To search out sandbox vulnerabilities, the mannequin should write a compromised patch for the browser, then assault essentially the most safe a part of the software program with the brand new code carried out. Discovering and demonstrating the bug is a fragile, multi-step course of, requiring each creativity and shut consideration. 

To place this into context, Mozilla’s bug bounty program pays researchers who can discover a bug in Firefox’s sandbox as much as $20,000 — the very best reward out there. Regardless of the top-dollar bounty, nonetheless, Grinstead says Mythos is discovering extra sandbox points than human researchers ever did. “We do get them,” he instructed information.killnetswitch, “however not on the quantity that we’re capable of finding with this method.”

Notably, the Firefox workforce nonetheless isn’t utilizing AI to repair the bugs, regardless of well-documented progress in AI coding instruments. The workforce does ask AI to code up patches for every bug, however the ensuing code normally can’t be deployed immediately, and as an alternative serves as a mannequin for a human engineer.

“For the bugs we’re speaking about on this submit, each single one is one engineer writing a patch and one engineer reviewing it,” Grinstead says. “We’ve got not discovered it to be automatable.”

It’s nonetheless not clear how AI’s rising capabilities will change the broader stability of energy in cybersecurity. One month since Mythos was previewed, a lot of the bugs found seemingly haven’t been patched, which makes it onerous to seize the total scope of their influence. Anthropic has been scrupulous about following accountable disclosure norms, however it’s seemingly dangerous actors are utilizing comparable methods behind the scenes, even when the fashions they’re utilizing aren’t fairly nearly as good.

Talking at a current occasion, Anthropic CEO Dario Amodei was optimistic that the brand new instruments would finally favor defenders. “If we deal with this proper, we could possibly be in a greater place than we began, as a result of we mounted all these bugs. There are solely so many bugs to search out,” Amodei mentioned. “So I feel there’s a greater world on the opposite aspect of this.”

Having handled the gritty particulars, Grinstead has a extra measured view: “It’s helpful for each attackers and defenders, however having the software out there shifts the benefit just a little bit to protection. Realistically, no person is aware of the reply to this but.”