Loading...
Loading...
Mozilla used Anthropic’s Claude Mythos Preview and other LLMs to discover and fix an unprecedented number of latent security bugs in Firefox, then published a sample of the reports to show how AI can help harden complex software. The findings span JIT/WebAssembly issues, long‑standing DOM and XSLT bugs, IPC race conditions enabling UAFs and sandbox escapes, serialization/deserialization hazards, DNS/HTTPS parsing edge cases, and event-loop reentrancy problems. Mozilla says rapidly improving mode
Mozilla's use of Claude Mythos and other LLMs to find and fix many latent Firefox security bugs shows AI can materially improve software hardening. Tech teams need to understand AI-assisted security workflows and risks when integrating LLMs into vulnerability discovery.
Dossier last updated: 2026-05-13 15:20:53
Mozilla says the EU's Digital Markets Act (DMA) has driven roughly 6 million users to choose Firefox instead of Safari or Chrome, with a 113% increase on iOS and a 12% rise on Android. The company credits differences in how Apple and Google implemented mandatory browser choice screens—iOS prompts users the first time they open Safari, while Android shows the screen on first boot or after a factory reset—for the disparity. Mozilla also reports user retention is five times higher than before the DMA. Other browser makers, including DuckDuckGo, Brave, Opera, Aloha and Vivaldi, have reported uplifts. Mozilla and DuckDuckGo are urging the UK to adopt DMA-style screens for browsers and search, and seek enforceable rules and annual prompts.
Mozilla used Anthropic’s Claude Mythos Preview and other LLMs to discover and fix an unprecedented number of latent security bugs in Firefox, then published a sample of the reports to show how AI can help harden complex software. The findings span JIT/WebAssembly issues, long‑standing DOM and XSLT bugs, IPC race conditions enabling UAFs and sandbox escapes, serialization/deserialization hazards, DNS/HTTPS parsing edge cases, and event-loop reentrancy problems. Mozilla says rapidly improving model capabilities plus better prompting/stacking techniques produced high‑quality, actionable reports that materially improved browser security and urges other projects to adopt similar defender‑oriented AI practices while balancing disclosure and patching timelines.
Mozilla used access to Anthropic's Claude Mythos preview to automatically generate and triage AI-driven security bug reports, enabling engineers to find and fix hundreds of long-standing vulnerabilities in Firefox. Improved model capability plus refined prompting and orchestration techniques turned noisy LLM outputs into high-quality signals, surfacing issues including a 20-year-old XSLT bug and a 15-year-old <legend> element flaw. Firefox’s defense-in-depth blocked many of the attempts, but the program scaled remediation: Mozilla’s monthly fixes rose from roughly 20–30 in 2025 to 423 in April 2026. The outcome shows how advanced generative models can materially aid security research and harden major open-source software when paired with careful engineering.
SubQ – a major breakthrough in LLM intelligence