Anthropic's Mythos AI Found a 15-Year-Old Firefox Bug — And That's Just the Beginning

[encrypted]

When Anthropic unveiled its Mythos model in April, it came with an unusual warning: the model was so capable at identifying software vulnerabilities that thousands of high-severity bugs it discovered would need to be patched before the model could be made public. Mozilla's Firefox security team has now provided concrete evidence of what that capability looks like in practice, and the results are striking. In April 2026, Firefox shipped 423 bug fixes in a single month, compared to just 31 in the same month a year earlier. Among the bugs discovered were a pair of unusual sandbox vulnerabilities and a parsing error in an HTML element that had been sitting undetected in Firefox's codebase for fifteen years, surviving countless security audits and previous AI scanning attempts before Mythos found it. The key breakthrough that made this possible is that the latest generation of agentic AI systems can now assess their own work and filter out false positives — a limitation that previously made AI security tools more of a burden than a benefit, flooding security teams with low-quality reports that consumed more time than they saved.

The sandbox vulnerabilities are particularly significant because of what finding them actually requires. Firefox's sandbox is among the most hardened parts of the browser, and to find a vulnerability in it, Mythos must write a compromised patch, implement it, and then attack the secured environment with the modified code — a multi-step process requiring technical creativity and precise attention. Mozilla's bug bounty program pays human researchers up to $20,000 for finding a single sandbox bug because doing so manually is so difficult. Yet Brian Grinstead, a distinguished engineer at Mozilla, told TechCrunch that Mythos is finding more sandbox issues than human researchers ever did. "We do get them, but not at the volume that we are able to find with this technique," he said. That is not a subtle improvement — it is a fundamental shift in what is possible in software security, with implications that extend far beyond Firefox to every piece of complex software running critical infrastructure.

[AIcash]

Mozilla paying $20K per sandbox bug and Mythos finding them in bulk security researchers sweating