Mozilla on Thursday published a behind-the-scenes account of how it used Anthropic's Mythos model to find 271 security vulnerabilities in Firefox over two months, and said the results contain "almost no false positives." Of the 271 bugs, 180 are rated sec-high, Mozilla's top tier for internally reported flaws, with 80 sec-moderate and 11 sec-low. The disclosure is meant to answer skeptics who treated last month's claim by Mozilla's CTO that "zero-days are numbered" as standard AI hype.
To back the numbers, Mozilla unhid 12 of the 271 Bugzilla reports — normally kept private for months after a rollup patch ships — so outside researchers can inspect the test cases. Each report includes the HTML or other code that triggers an unsafe memory condition, and meets the same bar Mozilla applies to any Firefox security bug. One researcher who reviewed the dozen called them "pretty impressive."
The 271 figure lands in a market that has spent a year drowning in low-quality, AI-generated vulnerability reports. Mozilla Distinguished Engineer Brian Grinstead said earlier attempts at the same idea produced "unwanted slop" — plausible-sounding bug reports, often at unprecedented scale, that fell apart on review. The shift, he said, came from two things: better models, and a custom agent harness that wraps Mythos in Mozilla-specific tooling.
Key facts
- 01Mozilla used Anthropic's Mythos to find 271 Firefox vulnerabilities over two months, and says false positives are nearly zero.
- 02Severity split: 180 sec-high, 80 sec-moderate, 11 sec-low. The only higher tier, sec-critical, is reserved for zero-days.
- 03Mozilla unhid 12 of the 271 Bugzilla reports on Thursday to counter skepticism after its CTO claimed 'zero-days are numbered.'
- 04The setup pairs Mythos with a custom agent harness and a second LLM that grades the first model's output before a bug is accepted.
- 05Claude Opus 4.6 was used alongside Mythos in a smaller share of the discoveries.
Grinstead described the harness as "the code that drives the LLM in order to accomplish a goal. It gives the model instructions (e.g., 'find a bug in this file'), provides it tools (e.g., allowing it to read/write files and evaluate test cases), then runs it in a loop until completion." The harness hands Mythos the same sanitizer build of Firefox that Mozilla's human engineers use for testing. If a generated test case crashes that build, the agent has a deterministic success signal.
“Of the 271 bugs Mythos surfaced in two months, 180 carry Mozilla's sec-high rating — exploitable just by browsing to a web page — with another 80 sec-moderate and 11 sec-low.”— Jaeden Schafer
The team typically points the agent at a single source file with the prompt "we know there's an issue in this file, please go find it." Mythos drafts a test case, sends it through Mozilla's existing fuzzing infrastructure, and iterates until the sanitizer trips. A second LLM then grades the first model's output, and only high-scoring findings are forwarded to engineers. Mythos drove most of the 271 discoveries, with Claude Opus 4.6 contributing a smaller share.
"In terms of the bugs coming out on the other side, there are almost no false positives," Grinstead said. "That's the key thing that has unlocked our ability to operate at the scale we've been operating at now." The implicit claim is that the bottleneck on AI-assisted bug discovery was never raw model intelligence, but the surrounding plumbing that converts a guess into a verified, reproducible crash.
Mozilla's severity breakdown matters more than the headline 271. Sec-high vulnerabilities can be exploited through normal user behavior — visiting a web page is enough — and the only higher classification, sec-critical, is reserved for live zero-days. A run rate of 90 sec-high bugs per month, found and fixed before disclosure, would be a meaningful change in the economics of browser exploitation if it holds up across longer timeframes and other codebases.
None of the 271 bugs received a CVE, which initially fueled skepticism. Mozilla, like many large vendors, does not request CVEs for internally discovered flaws and instead bundles them into single patches, with the underlying Bugzilla entries hidden for months to protect slow-patching users. The Thursday post is, in part, a response to critics who read the missing CVEs as a tell that the bugs were not real.
Skepticism is unlikely to fully subside. Critics will note that 12 unhidden reports out of 271 is itself a curated sample, and that Mozilla's enthusiasm benefits Anthropic at a moment when AI vendors need credibility on security. Grinstead pushed back on that read, saying the team has "completely bought in on this approach" and adding, "There's no sort of marketing angle here ... We are trying to get a message out about this technique in general and not any specific model provider, company, or anything like that."
The motivation for going public, he said, was to break the pattern of empty AI bug reports clogging open-source projects. "People are a bit burned from the last year of these slop commits so we felt it was important to show some of our work, open up some of the bugs, and talk about it in a little more detail as a way to hopefully spur some action or continue the conversation." That framing is consistent with Mozilla's earlier disclosure, covered here last week, that the Mythos pipeline drove an unusually large April patch cycle for Firefox.
What is not yet clear is how much of the result generalizes. Firefox is unusually well-instrumented — a mature sanitizer build, a deep fuzzing stack, decades of internal tooling — and the harness exploits all of it. Projects without that scaffolding may need to invest heavily before an agent like Mythos produces comparable signal-to-noise, and the cost of that custom harness work is the part Mozilla has said the least about.
If Mozilla's numbers hold, the interesting story is not Mythos itself but the harness pattern around it: a defender-controlled loop where a model proposes, deterministic tools verify, and a second model grades. That architecture is reproducible, and it shifts the AI-security debate away from "can a model find bugs" toward "who has the engineering budget to wrap one properly." On that question, well-resourced incumbents — browsers, operating systems, hyperscalers — start with a structural advantage over the attackers buying the same model access by the token.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
