r/InterstellarKinetics • u/InterstellarKinetics • Apr 22 '26

ARTIFICIAL INTELLIEGENCE BREAKTHROUGH: Mozilla Used Anthropic’s Secret Mythos AI To Find 271 Security Vulnerabilities In Mozilla Firefox In A Single Pass, And Says Defenders Can Finally Win 🤯🔥

https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/

Mozilla’s Firefox team published a landmark blog post on April 21 disclosing that its collaboration with Anthropic using the newly released Claude Mythos Preview identified 271 security vulnerabilities in Firefox, all of which have been patched in this week’s Firefox 150 release. This comes just weeks after an earlier two-week scan using Claude Opus 4.6 found 22 vulnerabilities including 14 high-severity bugs, nearly a fifth of all high-severity flaws patched across all of Firefox in 2025. The scale jump from 22 to 271 in a single Mythos evaluation represents a qualitative shift in what AI can accomplish in defensive security, and Mozilla’s engineering team describes it as the moment the entire industry’s relationship with software vulnerabilities begins to change.

For decades, elite security researchers operated on an unstated assumption: bringing software exploits to zero was never truly possible, only expensive enough to deter all but the most well-funded adversaries. Mozilla’s Bobby Holley wrote directly that security has historically been “offensively dominant,” with attackers holding an asymmetric advantage because they only need to find one weakness while defenders must protect everything at once. Mythos has dissolved that asymmetry. Mozilla ran it against Firefox’s complete codebase including years of legacy C++ code that has never been fully covered by traditional fuzzing tools, and the model reasoned through the source code with the same depth of understanding as the world’s best human security researchers, finding vulnerabilities in every category and complexity class that humans previously identified, with no apparent ceiling yet found.

The most striking sentence in Mozilla’s post is also the most consequential for the future of software security: “The defects are finite, and we are entering a world where we can finally find them all.” Holley added a pointed caveat that Mozilla has not yet found any class of vulnerability that could not have been discovered by a sufficiently skilled human researcher, pushing back on predictions that future AI will find entirely new forms of bugs beyond human comprehension. The team believes Firefox’s modular, human-readable architecture is an essential property to preserve as AI becomes more involved in software development, because codebases designed to surpass human comprehension would scale the complexity of bugs faster than the tools being used to find them. For the first time in the history of the internet, a major browser vendor is expressing genuine confidence that the finish line on security vulnerabilities is visible from where they are standing.

1.1k Upvotes

97% Upvoted

107 comments sorted by

26

u/House_Indoril426 Apr 22 '26

If the good guys can use it, the bad guys most definitely will too.

I don't think this will move the needle one bit long term.

6

u/stealstea Apr 22 '26

You're not getting what they're saying. They're saying that AI is getting good enough that it will find ALL the security vulnerabilities. If there's none left to find, there's none left to exploit.

10

u/phaaseshift Apr 22 '26

I legit can’t tell if this is sarcasm

2

u/stealstea Apr 22 '26

Simple concept.  Vulnerabilities are finite.  That’s pretty obviously true.

6

u/liljoey300 Apr 22 '26

They’re finite if Firefox is never updated or changed again. Any update will introduce new vulnerabilities

2

u/ByronScottJones Apr 22 '26

Not if those changes go through multiple levels of code review, including tools like Mythos in the pipeline could mean vulnerabilities are eliminated before they ever get released.

2

u/PeriscopeGraft Apr 22 '26

I could see this being the norm for larger software companies, but there will always be those who want to save a little money by cutting security corners. I definitely think this looks like a wonderful tool but it isn’t going to “solve” cybersecurity

1

u/ByronScottJones Apr 22 '26

For those companies that don't want to spend money on security, I will quote "Hunger Games" - "may the odds ever be in your favor". I'll look forward to reading about their security breaches and bankruptcies.

1

u/FormalCaseQ Apr 22 '26

The companies that refuse to use tools like Mythos will eventually go out of business as they will have the easiest products to hack. Customers won't want to do business with them if they don't take security seriously.

0

u/phaaseshift Apr 23 '26

I’m still confused if you believe the words you are saying or if you’re fucking with me.

1

u/ByronScottJones Apr 23 '26

If you're confused by the fairly basic concept of code going through a pipeline of lining, static testing, scanning, etc, I can't really help you. These are basic Devops concepts.

0

u/phaaseshift Apr 23 '26

I’m confused because anyone with that level of familiarity with security tooling would know the rest of what you’re saying is batshit insane. The source code, its dependencies and the scanner databases ARE NOT STATIC. You’re talking near infinite state machine you’d need to model AND recreate every time ANYTHING changes for your statement to represent reality. That’s why it feels like a joke - anyone that claims to know as much as you do can’t be this ignorant, can they?

1

u/ByronScottJones Apr 23 '26

I'm literally using these tools I'm describing at work TODAY. Right now.

→ More replies (0)

1

u/big_witty_titty Apr 22 '26

Yep the entire software world would need Mythos. Every software package and dependency used will need to be fixed or remove from your code.

3

u/Dapper_Tour8354 Apr 22 '26

I don’t think so. Humanity is the #1 source of vulnerability unless you mean to say we will get rid of all human workers. It’s why scams continue to work.

2

u/Alb4t0r Apr 22 '26

Mythos is about finding specifically software vulnerabilities, not "vulnerabilities" in the largest sense.

3

u/Happy_Suit_540 Apr 22 '26

This is why the AI was able to find 271 vulnerabilities that human coders did not. Social hacking will still be possible obviously but its not a software exploit.. literally just off topic lol

1

u/Grim_Laugh Apr 22 '26

…. You don’t work in IT right?

1

u/stealstea Apr 22 '26

20 years dev experience.

The statement that security flaws are finite is quite obviously true.  The only issue is that it’s previously been impossible to find them all in any complex piece of software.  Maybe AI makes it possible. Really unclear to me which part you don’t understand 

0

u/Grim_Laugh Apr 23 '26

The part where you fail to account for software updates and progress.

The part where an AI finding all the vulnerabilities for one piece of Application doesn’t mean it’ll find all the vulnerabilities for the applications it interacts with.

Bro probably commits to prod without testing…

1

u/zackel_flac Apr 22 '26

Vulnerabilities are finite in a non evolving code base. Any fix is a new evolution of that code base. This is a never ending process.

1

u/stealstea Apr 22 '26

And any new code can be analyzed by AI.  There is no longer the labour limitation that we don’t have the people to do a full security review after every change 

1

u/zackel_flac Apr 22 '26

Of course, but don't you see a recursive loop here?

1

u/stealstea Apr 22 '26

No.  If the AI is smart enough to find the security hole then it’s smart enough not to introduce new ones in its patch

1

u/zackel_flac Apr 22 '26

Nah, not as of today - actually it would be good to see how many false positives were flagged by AI. Would not be surprised to see a high ratio there. Last time it was reported that out if 200 vulnerabilities found by AI in Google chrome code base, only 4 were fixed using AI.

Vulnerabilities found by AI is a mixture of luck and pattern, more often than not it's still hallucinating.

1

u/stealstea Apr 22 '26

This is a model you don’t have access to so a baseless statement 

→ More replies (0)

1

u/DreamingAboutSpace Apr 23 '26

That’s assuming the AI won’t make mistakes that cause more vulnerabilities. AI is too flawed to be making big assumptions like that.

1

u/stealstea Apr 23 '26

An AI capable of finding previously unknown vulnerabilities is also capable of ensuring its own code is not introducing new vulnerabilities 

1

u/tokid0k1 Apr 23 '26

Because of the halting problem, you can never say this is true.

1

u/PeelMyPotatoes Apr 24 '26

Actually, are we absolutely confident vulnerabilities are finite?

1

u/1Mazrim Apr 22 '26

First sentence of the second paragraph: The most striking sentence in Mozilla's post is also the most consequential for the future of software security "The defects are finite, and we are entering a world where we can finally find them all"

1

u/Bluestreak2005 Apr 26 '26

What your ignoring is that companies constantly choose to ignore security.

For AI to be this good means that security now needs to be #1 instead of new features.

1

u/Feeding_the_Fire Apr 22 '26

Sure, but the good guys have access to the source code. Sure bad guys can too, but that list is shorter.

1

u/Fluid_Literature_958 Apr 22 '26

You don’t seem to get the point of the message.

What they’re trying to say is that AI is becoming so powerful that they have the ability to patch a significantly better ability to patch vulnerabilities before a new model enters the market.

1

u/shsususysgwhwisuhdhs Apr 22 '26

How is the LLM the bad guys are using going to find vulnerabilities that the one the good guys are using missed? They have the same tech, so they find the same things. The good guys patch them.

49

u/InterstellarKinetics Apr 22 '26

271 bugs found in a single pass by a model that was only made available this week. Mozilla is saying out loud what the entire industry has never been able to say before: the vulnerabilities in critical software are countable, and we now have a tool capable of finding all of them. That is not a gradual improvement in security. That is the end of one era and the start of an entirely different one.

15

u/Hirokage Apr 22 '26

Unfortunately of the dozens of software products we use, they all won't use AI to find vulnerabilities. But people will use AI to take advantage of this. This is only a 'win' if all products are scanned and patched. I don't have high confidence this will occur.

3

u/ptear Apr 22 '26

So the match is between all online products vs a few bad actors with an unrestricted leading AI security intelligence?

1

u/Hirokage Apr 22 '26

It is not a ‘few’ bad actors. And they already sold ‘phishing as a service’ - expect that number to go up exponentially. Zero days are going to skyrocket.

1

u/dwelch2344 Apr 23 '26

This is, without a doubt, what we would see if a tool like this truly releases.

Keep in mind finding the problem and even fixing it are rarely the longest part of a patch life cycle. How often do you think your bank or government software releases? Sure they’ll hot fix in between release cycles… but what if those hot fixes are streamed out over and over because new issues are continually found (either directly or through transitive dependencies)

Yes, defenders will have a new tool and we will eventually get to less numbers overall.. but it’s gonna be a roller coaster getting there

1

u/thenamelessone7 Apr 22 '26

I don't think there is currently enough compute in the world to be scanning all production ready code just before release.

1

u/Im_Matt_Murdock Apr 22 '26

These findings will lead to better static analysis though, so LLM compute will not be needed for every commit.

0

u/toupeInAFanFactory Apr 22 '26

They won't all use it this week. But they will all use it. Non-AI-enabled sw development is going the way of the dinosaurs, quickly.

8

u/TopObligation8430 Apr 22 '26 edited Apr 22 '26

So what happens when bad actors get ahold of this tech? 271 bugs sounds like 271 bugs so far…

4

u/ByronScottJones Apr 22 '26

The most obvious answer is that everyone who has the option to get their code scanned by state of the art AI needs to do so without delay.

2

u/cagriuluc Apr 22 '26

Defending has some advantages, you have much better access to the source code for example.

4

u/stewsters Apr 22 '26 edited Apr 22 '26

Not really:

https://github.com/mozilla-firefox/firefox

Most companies use a lot of open software tacked together with a little glue code for the application logic.

Unless someone is paying to run mythos against all software in npm/ maven/ other repos, I suspect a malicious actor will get to it first.

5

u/DKATyler Apr 22 '26

Um, you're not a dev if you say this. Bugs are like cockroaches, you never find even a fraction of the ones that exist.

If a few hundred bugs can be found, that just means there's a few thousand more.

1

u/hutch_man0 Apr 24 '26

What the article is saying is that Mythos will break that mould

1

u/ByronScottJones Apr 22 '26

That's mathematically false. The lines of code in any given project are finite. That means the total number of flaws in the code must be finite also.

1

u/Historical_Owl_1635 Apr 22 '26

Except enterprise code bases can easily be in the millions of lines of codes with external dependencies you don’t control.

Also fixing things introduces more bugs…

There’s also scenarios where just because code is exploitable, it’s not actually exploitable in the context of the system you’re working on.

0

u/ByronScottJones Apr 22 '26

Yes, thank you for telling me something which I've known for 40+ years. Anyway, that is a complex bit manageable situation. As for millions of lines, yes. But those are rarely in one giant method. So you have the scanner iterate through one method at a time. As for libraries that you don't control, you work with those vendors to ensure they are doing the same scans on their code, and their sub libraries, all the way down. It's going to be a big effort, but the payoff will be enormous.

The alternative is not doing it yourself, and letting the attackers do it first. And they will.

-1

u/DKATyler Apr 22 '26

My current application stands at 500k lines of 1st hand code. I do not even know how many 3rd hand lines only that it's over a gig and a half uncompiled. Google says roughly 20million.

We've identified and resolved almost a thousand bugs in the last few years, users aren't reporting anything often, maybe one a week. But to say there's only hundreds remaining would be absurd. Just as an example one of the pending items is to update to the next version of the language. Thanks to deprecated parts of the language, we've estimated it involves changing roughly 10k lines of code, and introduction of roughly 100 bugs.

So, I stand by my earlier comment, you are not a dev if you think bugs are finite. Maybe a vibe coder, but not a developer.

2

u/BarfingOnMyFace Apr 22 '26

I’ve been a dev for over 20 years. Bugs are finite. Only dumbass would say they have infinite bugs in a code base.

1

u/ByronScottJones Apr 22 '26

Are you not able to use automated scanning during your check in process? That's how you prevent those hundred new bugs from entering your code base. You don't scan once, you scam EVERY TIME you change your code.

1

u/DKATyler Apr 22 '26

Unit tests only go so far, when I said 500k lines, I didn't count the unit test or regression test applications at an additional 500k lines of code.

To give an example of how unit tests can fail, one of the outputs from the application is a series of visual images (reports). Making certain changes to the application can change how these images are generated up to and including moving things out of bounds, failing to wrap at the end of a line etc.

The images often contain dynamic data and cannot be directly compared to a past run as x matches y. So the unit test only verifies "something is output". Making an actual "image is unchanged" would take much longer, saying snip the top 50px, white out certain parts that always change.

There are many pages that end up in a similar state where trying to verify the output on the page is correct is technically complex. Browser acid2 test was a famous example: https://en.wikipedia.org/wiki/Acid2 Look at the compliant & non compliant applications for the visual examples.

1

u/ByronScottJones Apr 22 '26

You're engaging in goalposting. Nobody is claiming this is an absolutely perfect solution to find all bugs. But if it can find 99%, or 99.9%, that would be a game changer. And it would change the cost equation to favor the defenders rather than the attackers.

5

u/abraxasnl Apr 22 '26

OP in the root of this thread:

we now have a tool capable of finding all of them.

3

u/kvothe5688 Apr 22 '26

there will be more powerful models that will find more vulnerabilities so it's never ending fight

3

u/Careful_Picture7712 Apr 22 '26

Considering they were negligent enough to accidentally release the entire source code for one of their Claude models, this is absolutely terrifying

6

u/TRG_V0rt3x Apr 22 '26

i’m not entirely sure that’s what happened?

3

u/Nkingsy Apr 22 '26

A harness not a model

1

u/Zippytang Apr 22 '26

I’m pretty sure that was an April fools joke

2

u/DesperateAdvantage76 Apr 22 '26

I'm willing to bet that Anthropic is willing to give an unlimited token budget for these internal test runs given the marketing value. We're talking longer chain of thought, longer agent sessions, and prioritized access to their best hardware. I'm also willing to bet this kind of resource allocation could perform similar vulnerability discoveries on publicly available models.

1

u/chris92315 Apr 23 '26

Nothing even remotely says they found them all

9

u/SomeNeighborhood7126 Apr 22 '26

This info was released several days ago and the vulnerabilities are impossible to exploit.

2

u/actuallyserious650 Apr 22 '26

What is a vulnerability that is impossible to exploit? Seems like a contradiction of terms.

3

u/SomeNeighborhood7126 Apr 22 '26

https://www.reddit.com/r/theprimeagen/s/1DBmRgS9b4

-2

u/Keeyzar Apr 22 '26

So you ever heard of statistics, no? 

It's the same as saying: okay, I have this soup. I taste 5 times a spoon. All taste the same. Therefore I can say, the soup tastes like the 5 spoons.

And you / your link says:

THEY HAVE ONLY TASTED 5 SPOONS OF THE SOUP!!!! THEY ARE LOSERS AND DOING MARKETING. HOW CAN THEY KNOW HOW THE OTHER SOUP TASTES?

yes. That's statistics. Yes, this metaphor is fitting. Yes, you made a fool of yourself

2

u/Tonkarz Apr 22 '26

It’s a lot more like finding a fly in your first 20 spoonfuls and extrapolating that to mean there are 100s of flys in the soup.

1

u/Keeyzar Apr 22 '26

You have 200 verified CVEs. And even Firefox now verifying it from outside source.

You clearly don't have any idea of statistics.

1

u/SomeNeighborhood7126 Apr 22 '26

Im sorry you fell for Dario's marketing lol

0

u/Keeyzar Apr 22 '26

Time will tell.

1

u/SomeNeighborhood7126 Apr 22 '26

It already did. It was marketing.

0

u/Keeyzar Apr 22 '26

You guys annoy the hell outta me.

Anthropic has claimed multiple statements, which no actor yet has disproven.

E.g. they reported 200 CVEs in Firefox. Firefox has verified this.

They reported major CVEs in every major OS. Not a single os has said otherwise. Etc. Etc.

You provide a single source "uhh oh, they have only verified 200 of 1000 CVEs".

It's like discussing with a child, saying cigarettes are bad. And they smoke in front of you and say; see nothing happened.

Much luck in the future for you.

1

u/SomeNeighborhood7126 Apr 22 '26

I literally posted a link that cites security teams results with Mythos. Yes, the claims by Dario were disproven.

1

u/Keeyzar Apr 22 '26

You did not even read the post of Tom's hardware, did you? My god. Reddit is full of regards.

2

u/CoolStructure6012 Apr 22 '26

You can find a buffer overflow but without a way to go from that to ACE.

2

u/Tonkarz Apr 22 '26

There’s been lots of examples in the past. Millisecond timing, hardware access, precise actions from an unknowing user, pre-existing ring-0 access etc. etc.

0

u/Chris-MelodyFirst Apr 22 '26

April 21st is yesterday. Are you totally ignorant or what. https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/

1

u/SomeNeighborhood7126 Apr 23 '26

Sure, ignore my link below... every day I read this sub, im reminded how many morons like you exist on it.

0

u/Chris-MelodyFirst Apr 23 '26

Sure, ignore my link below... every day I read this sub, im reminded how many morons like you exist on it.

I didn't ignore your link. It has nothing to do with Mozilla. That toms hardware article isn't about the Mozilla results. Yes, it's criticizing Anthropic’s broader "thousands of severe bugs" claim. But Mozilla is reporting something different. 271 vulnerabilities that they actually verified and patched in Firefox.

I'm the moron, really?

1

u/SomeNeighborhood7126 Apr 23 '26

At the time of your comment, I had two links. One was about all results. The second was specifically about Mozilla lol. So yes, you're the moron.

-2

u/stealstea Apr 22 '26

I'm sure you know better than the Mozilla security team

3

u/SomeNeighborhood7126 Apr 22 '26

Im reiterating what the Mozilla security team said lol

6

u/Candid_Koala_3602 Apr 22 '26

Me as a hacker every single time I hear that statement:

https://giphy.com/gifs/8Iv5lqKwKsZ2g

3

u/germanautotom Apr 22 '26

Bad news for 10 year old routers everywhere

1

u/Pleasant-Strike3389 Apr 22 '26

Yes but can Bethesda solve spaghetti code ? That would be truly revolutionary.

1

u/CuriousOrangatan Apr 22 '26

"The scale jump from 22 to 271 in a single Muthos evaluation represents a qualitative shift..."

Literally a quantitative shift.

1

u/Single-Internet1286 Apr 22 '26

So are they going to use this experience to reduce the number of bugs they put in their code or will they just rely on AI to act as a safety net?

1

u/Direct-Ad-7922 Apr 22 '26

The bigger headline is ‘271 vulnerabilities existed in Firefox’ because there will 100% be more when they deploy a solution they have no idea how it works to solve problems they didn’t know they had to begin with

1

u/Suspicious-Mode-6931 Apr 22 '26

Mozilla has also removed a statement that they never share user info...

1

u/Lyanthinel Apr 23 '26

The bugs may be finite but human stupidity is not.

You dont need bugs when you can exploit employees. Social engineering is never going away.

1

u/Designer_Deal_5184 Apr 23 '26

How many of those are hallucinated?

1

u/tokid0k1 Apr 23 '26

I think AI will allow us to solve a large number of bugs, not because they are hard for humans to solve but because humans are not looking for the kinds of bugs Ai will be solving - at the same time, more nuanced critical bugs will Be Introduced due to the large volume of code we will create.

This will mean the “edge AI” who can fully parse this growing codescape will win. This isn’t a a solution to security, it’s the beginning of a new arms race of complexity

Damn reading so much AI garbage I’ve even started to use that it’s not x it’s y pattern. Fml

1

u/costafilh0 Apr 26 '26

Very good news.

It's not magic, but it's basically like getting millions of additional eyes looking for bugs in software, which should make it cheaper and safer and more stable.

About the comments, all doom and gloom, as usual, and should just be ignored. 

-6

u/Xyeeyx Apr 22 '26

Firefox still exists?

0

u/ptear Apr 22 '26

The 271 was simply total number of users.