Mozilla Uses Anthropic’s Claude Mythos to Patch 271 Firefox Vulnerabilities

Mozilla’s security team has leveraged Anthropic’s Claude Mythos AI model, part of the Project Glasswing initiative, to identify and remediate a record number of security bugs in the Firefox browser. In April 2026 alone, the team fixed 423 bugs—an unprecedented jump from the 20‑30 fixes per month seen in 2025—using a custom harness that guides Mythos through targeted tasks such as file I/O, test execution, and crash detection. The harness repeatedly runs until a sanitizer crash or other failure is observed, and a second language model grades the first model’s output to reduce hallucinations, resulting in almost no false positives.

During a two‑month scan, Mythos uncovered 271 vulnerabilities, of which 180 were classified as security‑high, 80 as security‑moderate, and 11 as security‑low. All were memory‑safety issues triggered by crafted HTML or code, including a 20‑year‑old XSLT flaw and a 15‑year‑old bug in the <legend> element. The AI‑generated test cases were fed into Mozilla’s fuzzing infrastructure for rapid triage, and the fixes were integrated into the 150 release, which saw 271 previously unknown bugs patched across subsystems such as JIT optimization, IPC race conditions, and sandbox escape vectors. The patching effort involved over 100 contributors who coordinated across builds 149.0.2, 150.0.1, and 150.0.2, and introduced prototype‑freezing hardening to block prototype‑pollution escapes.

The initiative demonstrates how generative AI can accelerate vulnerability detection in large, complex codebases. By embedding Mythos into the development pipeline, Mozilla has shown that AI‑driven scanning can surface legacy bugs before they become critical, offering a roadmap for other open‑source projects to adopt similar security research pipelines.