Anthropic Mythos finds 271 Firefox security vulnerabilities but cURL creator calls it marketing

Mozilla Claims Breakthrough in AI-Assisted Vulnerability Detection

Mozilla has revealed detailed findings from its use of Anthropic Mythos, an AI model designed for finding security flaws, which identified 271 Firefox security vulnerabilities over two months 1

1

. The discovery helped Mozilla ship 423 Firefox bug fixes in April 2026, compared to just 31 exactly a year earlier 2

2

. This represents more than five times the 76 fixes issued in March and almost 20 times higher than the 21.5 monthly average from last year 5

5

. Mozilla Distinguished Engineer Brian Grinstead emphasized that "in terms of the bugs coming out on the other side, there are almost no false positives" 1

1

.

The team published details on 12 of the bugs, ranging from unusual sandbox issues to a 15-year-old error in HTML element parsing 2

2

. Mozilla CTO Bobby Holley declared that "defenders finally have a chance to win, decisively" and suggested zero-days are numbered 3

3

. The bug-hunting AI proved particularly effective at identifying sandbox vulnerabilities, which Mozilla's bug bounty program pays up to $20,000 for researchers to find 2

2

.

The Agent Harness Makes the Difference

Mozilla engineers attribute their success to two factors: improvements in the AI model itself and their development of a custom agent harness that guided Mythos through Firefox source code analysis 1

1

. The harness wraps around the large language model to guide it through specific tasks, providing instructions and tools that mirror what human Mozilla developers use, including specialized Firefox builds for testing 1

1

.

Grinstead explained that earlier attempts at AI-assisted vulnerability detection produced "unwanted slop" with plausible-sounding bug reports that often contained hallucinated details requiring significant human verification 1

1

. The new approach uses a second LLM to grade output from the first, providing developers with the same confidence level as traditional discovery methods 1

1

. For memory safety issues, the system leverages Mozilla's sanitizer build of Firefox, where successfully crashing the browser confirms a vulnerability 1

1

.

cURL Creator Questions the Hype Around Mythos

Not everyone shares Mozilla's enthusiasm about Anthropic Mythos. Daniel Stenberg, creator of the widely-used cURL project, concluded that the hype around the AI model was "primarily marketing" after it found just one confirmed vulnerability in his codebase 4

4

. Mythos initially flagged five potential security vulnerabilities in cURL, but after hours of investigation by Stenberg's security team, only one was confirmed as a low-severity issue planned for CVE publication 4

4

.

Stenberg noted that cURL has undergone extensive testing with AI-powered code analyzers over recent months, with tools like AISLE, Zeropath, and OpenAI Codex Security triggering between 200 and 300 bugfixes in the past 8-10 months 4

4

. He acknowledged that AI tools have improved at finding security flaws compared to traditional analyzers, but emphasized that "all modern AI models are good at this now" and that Mythos doesn't represent a significant advancement 4

4

.

Security Experts Debate Whether Model or Middleware Matters More

Security consultant Davi Ottenheimer raised concerns about Mozilla's methodology, noting that the organization never quantified what Opus 4.6 accomplished before attributing results to Mythos 5

5

. He demonstrated that Anthropic's lesser models Sonnet 4.6 and Haiku 4.5, when equipped with a harness called Wirken, produced eight findings in two minutes at approximately $0.75, with two matching bugs Mythos had identified 5

5

.

Ottenheimer criticized Mozilla for not providing transparent comparisons between Mythos and other models, stating there's "a fundamental philosophical failure" in treating readings as measurements without proper evidence 5

5

. Mozilla acknowledged that Opus 4.6 was already identifying "an impressive amount of previously unknown vulnerabilities" before Mythos deployment 5

5

.

What This Means for Software Security and Cybersecurity

The debate centers on whether Anthropic Mythos represents a genuine breakthrough in software security or if effective middleware makes any capable AI model sufficient for finding security flaws. Mozilla's Brian Grinstead acknowledged uncertainty about the broader implications, stating "it's useful for both attackers and defenders, but having the tool available shifts the advantage a little bit to defense" 2

2

. Anthropic CEO Dario Amodei suggested that fixing discovered bugs could leave defenders in a better position since "there are only so many bugs to find" 2

2

.

Holley noted that Mythos hasn't discovered any bugs that elite human researchers couldn't find, countering speculation about AI uncovering entirely new vulnerability categories 3

3

. Mozilla still relies on human engineers to write and review patches for every bug, as AI-generated fixes cannot be deployed directly 2

2

. The question remains whether bad actors using similar techniques with less capable models pose an immediate threat, and whether the industry's focus should shift toward developing better harnesses rather than pursuing more advanced AI models for high-severity software vulnerabilities detection.