Mozilla fixes 271 Firefox vulnerabilities detected with Claude Mythos and opens a new stage for cybersecurity

Mozilla has fixed 271 vulnerabilities in Firefox after applying an early version of Claude Mythos Previewan artificial intelligence model from Anthropic aimed at advanced cybersecurity tasks. The bugs have been addressed in Firefox 150 and are part of a collaboration that shows the extent to which AI is beginning to change the search for errors in complex software.

The data is striking for its volume and context. Firefox is not a small or neglected project. It is a browser with a long history, a huge code base, and a consistent history of audits, reviews, automated testing, and vulnerability reporting programs. The fact that an AI system identified 271 problems in an initial evaluation does not mean that the browser was exceptionally insecure, but rather that analysis tools are entering a much more aggressive phase.

Mozilla had worked with advanced Anthropic models before. In a previous collaboration with Claude Opus 4.6, 22 sensitive security bugs were found in Firefox 148. Now, with Mythos Preview, the number has skyrocketed.

An AI capable of reviewing code on a large scale

Searching for vulnerabilities has always combined several techniques. On the one hand there are automated tools such as fuzzing, which test the software with unexpected inputs to cause failures. On the other hand, the manual work of expert researchers, who analyze logic, memory, access limits and error patterns that are difficult to detect with traditional methods.

Claude Mythos enters this second field, but on a machine scale. Mozilla maintains that this type of model can cover error areas that previously depended heavily on human specialists.. Not because it finds a class of bugs impossible for one person, but because it can review large amounts of code, reason about patterns, and detect problems with a speed that changes the pace of defense.

The nuance is important. AI does not completely replace security teams. Findings must be verified, prioritized, corrected and tested. But it can multiply the volume of problems detected in a short time, and that forces us to change the way in which software projects manage their security.

Firefox 150 arrives with bugs fixed

Mozilla has indicated that Firefox 150 includes fixes for vulnerabilities identified during this initial evaluation with Mythos Preview. More than 40 CVEs addressed in this release appear in public security advisories, although only a few are directly attributed to Claude in public documentation.

This may be due to how bugs are grouped, classified, and published. Not all internal bugs end up becoming a separate CVE, and not all issues found during an assessment are described in the same level of detail for security reasons. In any case, the figure of 271 corrected vulnerabilities is what Mozilla has communicated in relation to the work carried out with Mythos.

The other side: a defensive tool that also worries

The case of Firefox shows the positive side of these models– They can help find and close vulnerabilities before they are exploited. But it also leaves an uncomfortable question. If an AI can find so many flaws in a large, audited browser, what could it do in the hands of attackers with less protected targets?

Anthropic has limited access to Claude Mythos Preview and has not released it publicly. The decision fits with the risk that such a tool would accelerate the search for vulnerabilities in popular software, critical infrastructure or open source projects maintained by small teams. In defensive hands, it can serve to tighten systems. In offensive hands, it could reduce the time needed to discover exploitable flaws.

The challenge for open source

The impact can be especially strong in the open source ecosystem. Many critical projects depend on small teams, volunteers, or limited budgets. If new AI tools begin to find large-scale vulnerabilities, it will not be enough to detect more errors: human and economic capacity will be needed to fix them.

Mozilla, because of its size and experience, can absorb an avalanche of findings better than many small projects. Even so, the Firefox case serves as a warning for the entire sector. Software security will not depend only on having better models, but on creating processes to convert those findings into real patches without overwhelming maintainers.

A new career in security with AI

Using Claude Mythos to find 271 vulnerabilities in Firefox points to a stage where AI will be a regular part of software auditing. It will not suddenly eliminate zero days, nor will it make researchers’ work disappear, but it can change the deadlines. What previously required weeks or months of manual review could be significantly accelerated.

For Mozilla, the message is that defenders finally have much more powerful tools to anticipate. For the rest of the industry, the warning is twofold: these capabilities must be adopted as soon as possible, but also protected and prevented from becoming an accelerator of attacks.