Anthropic’s Claude Mythos uncovered 271 Firefox vulnerabilities during a security evaluation with Mozilla, and all of them were patched in Firefox 150. The batch included one bug that had remained in the codebase for 27 years. Mozilla said the first issue appeared within 20 minutes after the model began scanning the Firefox JavaScript engine: a “Use After Free” memory flaw.
Mozilla becomes the first partner to publish Glasswing results
The work was part of Anthropic’s Project Glasswing, announced in April 2026. The idea is to place Mythos Preview in the hands of organizations able to fix security issues before comparable tools reach attackers. Anthropic said the initiative includes 12 major tech companies, among them Apple, Microsoft, Google, and AWS. The company also committed $100 million in support and $4 million in donations to open-source security groups.
Mozilla is one of the first partners to publicly disclose outcomes from the program. According to Firefox’s patch notes, the update closed all 271 vulnerabilities identified during the Mythos Preview assessment. This was not the first collaboration between the two sides. In an earlier review using Claude Opus 4.6, the model submitted 112 reports over two weeks, leading to confirmation of 22 vulnerabilities. Of those, 14 were rated high severity, accounting for nearly one-fifth of all high-severity Firefox fixes in 2025.
Mozilla’s view: same boundary, different speed
Mozilla’s assessment rested on two points that sit side by side. First, the company said it has not found any class or level of vulnerability that human researchers can discover but the model cannot. Second, it also said it has not seen any flaw that elite human researchers would be unable to find. In Mozilla’s reading, AI and top-tier human security researchers are still operating within the same capability boundary.
Mozilla also pushed back on the idea that future AI systems will uncover entirely new categories of vulnerabilities outside current human understanding. Its argument is that software such as Firefox is complex, but not beyond reasoning. The browser is built in modular form, which means humans can still analyze and verify it.
What changes is the math of code coverage
The sharpest shift came from time and scale. Firefox’s codebase contains roughly 6,000 C++ files. Even strong security teams would need long stretches of work to cover large amounts of legacy code in a systematic way. Mythos completed a broad scan in a matter of weeks, raising the pace by dozens of times.
That difference matters because some flaws survive not because humans are incapable of finding them, but because there is never enough time to work through every old component on the list. Mozilla’s tone was cautiously positive. Mythos Preview is still limited to organizations using it for defense, yet Anthropic has also warned that no one knows how long that gap will last.