Mythos found 271 Firefox flaws – but none a human couldn’t spot
- Reference: 1776832331
- News link: https://www.theregister.co.uk/2026/04/22/mozilla_firefox_mythos_future_defenders/
- Source link:
The FOSS outfit on Tuesday [1]reminded readers that it used Anthropic’s Opus 4.6 model to look for bugs in Firefox 148 and found 22 bugs.
Mythos found 271 vulnerabilities in Firefox 150.
[2]
Mozilla CTO Bobby Holley expressed mixed feelings about that result, which he described as giving the Firefox team “vertigo” as they confronted the need to fix so many flaws.
[3]
[4]
“For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up,” he wrote.
He also thinks the huge haul of bugs Mythos identified represent “light at the end of the tunnel” for security teams.
[5]
“Our work isn’t finished, but we’ve turned the corner and can glimpse a future much better than just keeping up,” he wrote, then turned on Bold text and declared “ Defenders finally have a chance to win, decisively. ”
He offered that prediction because he feels “Until now, the industry has largely fought security to a draw” while acknowledging it’s all-but impossible to eliminate all exploits.
“Instead, we aimed to make them so expensive that only actors with functionally unlimited budgets can afford them, and that the cost of burning such an expensive asset disincentivizes those actors against casual use,” he wrote.
[6]
Mythos changes the game, he feels, by improving on the fuzzing tools Mozilla uses to find bugs without human intervention.
“Elite security researchers find bugs that fuzzers can’t largely by reasoning through the source code,” he wrote. “This is effective, but time-consuming and bottlenecked on scarce human expertise.
“Computers were completely incapable of doing this a few months ago, and now they excel at it. We have many years of experience picking apart the work of the world’s best security researchers, and Mythos Preview is every bit as capable. So far we’ve found no category or complexity of vulnerability that humans can find that this model can’t.”
[7]Mozilla throws Thunderbolt at enterprise AI providers
[8]Nobody knows how many CVEs Anthropic's Project Glasswing has actually found
[9]Mozilla introduces cq, describing it as 'Stack Overflow for agents'
[10]Firefox taps Anthropic AI bug hunter, but rancid RAM still flipping bits
The CTO thinks Mythos’ abilities “can feel terrifying in the immediate term, but it’s ultimately great news for defenders.”
“A gap between machine-discoverable and human-discoverable bugs favors the attacker, who can concentrate many months of costly human effort to find a single bug. Closing this gap erodes the attacker’s long-term advantage by making all discoveries cheap.”
He then hit CTRL-B again, and busted out CTRL-I too, to note “ Encouragingly, we also haven’t seen any bugs that couldn’t have been found by an elite human researcher. ”
The CTO also poured cold water on those who assert “future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension.”
He doesn’t think that will happen, because “Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex.”
“The defects are finite, and we are entering a world where we can finally find them all.” ®
Get our [11]Tech Resources
[1] https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeicP7mKMrJHrpqrHvL9TwAAAgo&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeicP7mKMrJHrpqrHvL9TwAAAgo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeicP7mKMrJHrpqrHvL9TwAAAgo&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeicP7mKMrJHrpqrHvL9TwAAAgo&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeicP7mKMrJHrpqrHvL9TwAAAgo&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2026/04/16/mozilla_thunderbolt_enterprise_ai_client/
[8] https://www.theregister.com/2026/04/15/project_glasswing_cves/
[9] https://www.theregister.com/2026/03/24/mozilla_introduces_cq_stack_overflow/
[10] https://www.theregister.com/2026/03/06/firefox_bugs_anthropic_ai/
[11] https://whitepapers.theregister.com/
Re: Good, but also bad
Good if companies use it (or similar) to find and fix bugs first.
Bad if, as is more likely, a lot simply don't bother fixing and still keep adding crap for marketing reasons, etc.
On average I expect this is bad.
Just like other instances of AI, how much effort will go into fixing hallucinations : Day0 bugs that don't actually exist?
Icon -clearly psychedlic hallucinations Watson.
Over on LWN there's an article about a similar story of using AI against Python. The AI found around 500 bugs and 10-15% were false positives.
[1]https://lwn.net/Articles/1067234/
[1] https://lwn.net/SubscriberLink/1067234/e5312bed2037a102/
So only about 400 actual bugs, then. Phew, that's a relief!
Well, "hallucinations" 1 are not "bugs". They're a consequence of the design and operationalisation of the software. A feature, if you like (and one, interestingly, that they share with humans).
1 Terrible term – "confabulations" is probably more appropriate, or even "get shit wrong".
Non explotable bugs
We aare already fixing non exploitable bugs, this will detect a lot of bugs that potentially cannot be exploited.. how many Strings having passwords have I fixed in Java, and none are exploitable.. or log4j, can't be exploited in our config yet we had to fix it, etc etc
Microsoft will buy them, I think..
.. because there's no way they want to fix all the bugs they keep introducing by Bug Tuesday.
After all, who would continue to subscribe when the FOMO on security risks no longer applies?
Not sure what his statement means
Of course Mythos didn't find any bugs that humans COULDN'T have found. That's a tautology. They're both examining the same code, it is impossible for there to be bugs only Mythos could find and humans could never find no matter how closely they looked or for how long.
Re: Not sure what his statement means
I suppose the statement should be "Mythos found bugs that humans could have but didn't ".
Around these parts were highly sceptical about AI, and rightly so. But in this example, there was nothing stopping anyone going looking through the code themselves, but the relevant point is that either they hadn't looked, or they hadn't spotted the bugs.
Open source is a bit like peer review in science - yes, anybody can check, that isn't of itself an assurance. Hopefully AI can help FOSS devs and maintainers to find the bugs, I hope they don't use AI to try and write code.
Re: Not sure what his statement means
Until I see multiple detailed write-ups of what Mythos is being given and producing, with concrete PoCs that actually expose the issue, I'm still taking this with multiple container ships of salt. But this does expose the rather awkward hypothetical- at best (assuming any of this is true), we can build idiots that can kick down barns, but appear to be drawing a blank on systems that can write and maintain secure code.
Re: Not sure what his statement means
There are whole classes of bugs that are difficult for a human to find as they require so much information to be held in the head at the same time.
To use a slightly off-topic example: I have found this on a project where a very well respected DER (who was part of the DO-178x standard development team) failed to spot issues in requirements during their detailed reviews that tools written in Python were able to find (by comparing large datasets extracted from the requirements). It is not that the person isn’t brilliant, just that they are human!
Mythos has found no issues with our DO-178C DAL-A certifiable OS code.
Anon: because my company has not officially made any announcement.
Re: Not sure what his statement means
The pertinent question is, surely, how many (presumably expert) humans would it have taken to find all those bugs, and how long would it have taken to find them.
AI seems to be a great source of eyes
As needed for [1]Linus's Law to be effective.
AI will be be used by the bad guys as well as the good ones; but the ultimate losers will be the likes of Israel's NSO group and the world will be a safer place.
[1] https://en.wikipedia.org/wiki/Linus%27s_law
Stop twatting about with the UI
And sort the bugs.
"AI means developers finally have a chance to get on top of security"
No !
Developers have always had "the chance" to be on top of security, at the condition that their management gives them the time to do the job right (yeah, I know, fat chance).
The only thing this tool will do is allow manglement to shorten dev time even further because "when you're done, just hand it over to AI and it'll sort that out".
In other words, this is yet another "tool" that is just going to end up being a crutch to a brain function humans don't use anymore.
I have one question : how many of you remember all the phone numbers of your family and personal friends without checking your smartphone ?
I can't even remember my own wife's number. If I lost my smartphone, I wouldn't know where to call to get help (or how, given phone booths have all but disappeared).
How's that for being borged into the Collective ?
Re: "AI means developers finally have a chance to get on top of security"
> The only thing this tool will do is allow manglement to shorten dev time even further …
Will it though? What would be the point of finding bugs if you've no intention of fixing them? And you need devs for that.
Re: "AI means developers finally have a chance to get on top of security"
If there's one thing using Opus 4.6 has taught me, is it sure as hell has a relaxed attitude to implementing secure code. (Better than some LLMs, no worse than others.).
Purify moment
Reminds me of when Purify came out. We closed a crash that resisted for month in an afternoon. It was a game changer and significantly improved C/C++ software robustness.
Now to get lasting benefits you need to make that part of the process, run as part of CI, mute the false positives, and assign time for the team to keep ahead of the report stream. Where I was working then it did not happen and it remained a last resort tool. Where the tool will be used intermittently, the attackers will still have an edge, using the tool once in a clever way, finding a new zero-day.
Can you guess whether it will be the excuse to cut the dev team, or hire a new guy to run the new process ?
Note: for the younger audience, Purify is the closed source ancestor to Valgrind, finding memory usage bugs through object code instrumentation.
Good, but also bad
If this is true then it's a great tool to help identify and help sort out bugs and other security flaws in software quicker than previously possible. It's also potentially bad, as some companies will see this as an opportunity to replace existing staff with this tool, which would be foolhardy as you'd still need to fix the code. And if your software is fundamentally just badly designed - such as Windows - how long before someone manages to identify a few dozen hundred zero-days in the software and start targeting those for ransom/fun/spite?
Some companies are really going to have to up their game.