Mozilla researchers detail how Anthropic's Mythos vulnerability-detection model uncovered thousands of Firefox bugs, including some dormant for over a decade

In April 2026, Firefox shipped 423 bug fixes using Mythos, compared to 31 fixes a year earlier. The bugs ranged from sandbox vulnerabilities to a 15-year-old parsing error in HTML element handling.

Mythos improved on earlier AI security tools by using agentic systems (AI that assess their own work and filter results) to reduce false positives and low-quality reports that previously overwhelmed security teams.

Firefox engineers found that Mythos discovered more sandbox vulnerabilities than human researchers, despite Mozilla's bug bounty program offering up to $20,000 for such finds. However, human engineers still write and review all patches; AI-generated code serves only as a model for manual implementation.