How Anthropic’s Mythos has rewritten Firefox’s approach to cybersecurity

When Anthropic unveiled its new Mythos mannequin in April, it additionally delivered a stern warning to anybody creating software program. The mannequin was so highly effective at sniffing out software program vulnerabilities, the lab claimed, that it had found hundreds of high-severity bugs that may have to be mounted earlier than it might be made public.

Now, safety researchers for Mozilla’s Firefox browser are offering a more in-depth take a look at what that course of has seemed like in follow, and what Mythos’ powers imply for software program safety at giant.

In a put up revealed on Thursday, Mozilla mentioned Mythos has unearthed a wealth of high-severity bugs, together with some that had lain dormant within the code for greater than a decade.

That’s a big enchancment from what AI safety instruments have been able to even six months in the past. Till now, AI bug-finding instruments have include extreme drawbacks, typically inundating safety groups with low high quality experiences and false positives. However Mozilla’s researchers say the most recent technology of instruments have turned a nook, notably now that agentic programs can assess their very own work and filter out unhealthy outcomes.

“It’s tough to overstate how a lot this dynamic modified for us over a number of quick months,” the researchers wrote. “First, the fashions bought much more succesful. Second, we dramatically improved our methods for harnessing these fashions.”

The outcomes are hanging: In April 2026, Firefox shipped 423 bug fixes, in comparison with simply 31 precisely a yr earlier. The researchers have additionally revealed particulars on 12 of the bugs, which vary from a pair of surprising sandbox vulnerabilities, to a 15-year-old error in how the browser parses an HTML aspect.

“This stuff are literally simply immediately excellent,” Brian Grinstead, a distinguished engineer at Mozilla, instructed Trendster. “We see that on our personal inside scanning, we see that on exterior bug experiences, and we see that in all types of alerts throughout the trade.”

The truth that the system helped reveal vulnerabilities in Firefox’s “sandbox” system is especially spectacular, given how intricate an assault that exploits it must be. To seek out sandbox vulnerabilities, the mannequin should write a compromised patch for the browser, then assault probably the most safe a part of the software program with the brand new code carried out. Discovering and demonstrating the bug is a fragile, multi-step course of, requiring each creativity and shut consideration. 

To place this into context, Mozilla’s bug bounty program pays researchers who can discover a bug in Firefox’s sandbox as much as $20,000 — the best reward obtainable. Regardless of the top-dollar bounty, nonetheless, Grinstead says Mythos is discovering extra sandbox points than human researchers ever did. “We do get them,” he instructed Trendster, “however not on the quantity that we’re capable of finding with this system.”

Notably, the Firefox staff nonetheless isn’t utilizing AI to repair the bugs, regardless of well-documented progress in AI coding instruments. The staff does ask AI to code up patches for every bug, however the ensuing code normally can’t be deployed straight, and as an alternative serves as a mannequin for a human engineer.

“For the bugs we’re speaking about on this put up, each single one is one engineer writing a patch and one engineer reviewing it,” Grinstead says. “We’ve not discovered it to be automatable.”

It’s nonetheless not clear how AI’s rising capabilities will change the broader stability of energy in cybersecurity. One month since Mythos was previewed, many of the bugs found possible haven’t been patched, which makes it exhausting to seize the total scope of their affect. Anthropic has been scrupulous about following accountable disclosure norms, nevertheless it’s possible unhealthy actors are utilizing comparable methods behind the scenes, even when the fashions they’re utilizing aren’t fairly nearly as good.

Talking at a current occasion, Anthropic CEO Dario Amodei was optimistic that the brand new instruments would in the end favor defenders. “If we deal with this proper, we might be in a greater place than we began, as a result of we mounted all these bugs. There are solely so many bugs to seek out,” Amodei mentioned. “So I feel there’s a greater world on the opposite aspect of this.”

Having handled the gritty particulars, Grinstead has a extra measured view: “It’s helpful for each attackers and defenders, however having the instrument obtainable shifts the benefit a bit bit to protection. Realistically, no person is aware of the reply to this but.”