Claude Mythos Found 271 Firefox Vulnerabilities. Mozilla Already Patched Them.

Mozilla and Anthropic ran a coordinated vulnerability research engagement using Claude Mythos Preview against Firefox 150. The scope: evaluate how many issues Mythos could identify in a mature, actively-maintained codebase that has been subjected to professional security audits for years.

The result: 271 vulnerabilities. Mozilla says they've patched all of them. Help Net Security reports that the issues spanned memory safety, privilege escalation, and logic flaws across Firefox's C++ codebase. The engagement is now being cited as evidence that 'the zero-day era has an expiration date' — meaning AI-driven vulnerability discovery is moving faster than the traditional exploit development cycle.

For context: Firefox has been in development since 2002. It's one of the most-audited codebases in open source software, with professional security researchers and automated fuzzers running against it continuously. Finding 22 high-severity bugs in a single audit is considered exceptional. Finding 271 total issues — including ones that professional auditors had missed — in what is effectively one automated run is a different category of capability.

Earlier reporting noted that Claude (a standard version) found 22 vulnerabilities in ~6,000 C++ files during a prior Mozilla collaboration, with 14 being high-severity. Mythos found 271. That's more than a 10x scale-up in discovery rate.

This is exactly the use case Project Glasswing was built around. The consortium — Apple, Amazon, Google, Microsoft, Cisco, CrowdStrike, Anthropic, and others — is specifically focused on using Mythos to find and patch vulnerabilities in critical software before adversaries do.

The Firefox result functions as a live demonstration. It's not a benchmark or a synthetic eval. It's production code, found by the model, patched by the developer. That's the full loop working. And it's the kind of result that shifts government agencies from skeptical to eager.

If you're a developer: expect AI-assisted security scanning to become standard practice, not optional. The bar for 'we had a security audit' is going to shift. Human auditors + Mythos-class models is the new baseline for anything that handles sensitive data.

If you're following the DoD/Anthropic story: this result is exactly the evidence that moves 'possible deal' toward 'signed deal.' The Pentagon wants AI that finds zero-days faster than adversaries can exploit them. Mythos just demonstrated that capability publicly.

If you're a security professional: the compression of the exploit window is real. What Mythos did to Firefox in one session used to take teams of researchers months. The tools are shifting faster than most security programs have adapted to.

• Mozilla says it patched 271 Firefox bugs found by Anthropic's Mythos — The Next Web, April 22, 2026 • Claude Mythos finds 271 Firefox flaws, Mozilla believes zero-day era has expiration date — Help Net Security, April 22, 2026 • Claude Mythos signals a new era in AI-driven security — CSO Online, April 22, 2026