Mozilla Uses Claude Mythos to Fix 423 Firefox Security Vulnerabilities in One Month

From 'AI Junk Reports' to a Genuine Security Weapon

Just a few months ago, AI-generated security vulnerability reports were still a burden for open-source projects — reports that appeared plausible but were actually wrong imposed enormous asymmetric costs on project maintainers: using LLMs to "find issues" in code was cheap and easy, but verifying and responding to those reports was slow and expensive.

This "asymmetric cost" problem is the core obstacle preventing AI security research from becoming practical. The marginal cost of using large language models to scan codebases and generate vulnerability reports is essentially zero, while the cost for security researchers to verify each report remains fixed and high. Take the CVE (Common Vulnerabilities and Exposures) system as an example: a false positive, from receipt, triage, and reproduction attempts to final closure, requires an average of several hours from a senior security engineer. This asymmetry is economically similar to the spam problem — sending costs approach zero, but receiving and processing costs are borne by the victim. For this reason, several major open-source foundations introduced policies between 2024 and 2025 explicitly requiring reproducible proof-of-concept (PoC) submissions alongside security reports to filter out low-quality AI-generated reports.

However, a recent in-depth technical article published by Mozilla has completely changed this perception. Using preview access to Anthropic's Claude Mythos, they identified and fixed hundreds of security vulnerabilities in the Firefox codebase — fixing 423 security bugs in April 2026 alone — compared to an average of only 20-30 per month throughout 2025.

Two Key Factors Driving the Transformation

The Mozilla team noted in their article that this dramatic change stems from the combination of two major factors:

A Leap in Model Capabilities

First, the model itself has become significantly more powerful. Claude Mythos Preview represents a qualitative improvement over previous models in code comprehension, vulnerability pattern recognition, and contextual reasoning.

The Firefox codebase is one of the most complex C/C++ engineering projects in the world, containing over 20 million lines of code spanning dozens of highly coupled subsystems including the Gecko rendering engine, the SpiderMonkey JavaScript engine, the network stack, and media decoders. Traditional static analysis tools (such as Coverity and CodeQL) face a "path explosion" problem when processing codebases of this scale — the number of code execution paths that theoretically need to be traced grows exponentially, causing tools to either time out or produce massive numbers of false positives. Claude Mythos Preview represents the capability frontier of a new generation of "long-context reasoning" models, able to maintain coherent semantic understanding within context windows of hundreds of thousands of tokens while simultaneously "seeing" a function's call chain, related memory allocation logic, and cross-file type definitions. This capability is critical for discovering vulnerabilities that require traversing multiple abstraction layers to trigger (such as type confusion and use-after-free).

Engineered Harnessing Techniques

More importantly, the Mozilla team's expertise in how to "harness" AI tools effectively proved crucial.