Mozilla says Anthropic’s Mythos Preview and other AI models helped it identify and deliver 423 Firefox security bug fixes in just one month

Mozilla claims to have fixed more than 400 bugs with the help of Anthropic Mythos
The tool had to be “exploited” on Firefox to obtain the best results
Mythos moves away from the typical “junk slop” provided by AI fuzzing tools

Anthropic’s latest cybersecurity tool, Mythos, continues to make waves as Mozilla announces that the AI model helped it deliver over 400 Firefox security bug fixes in April 2026 alone.

Mythos was touted by Anthropic as “a new frontier model” that could “reshape cybersecurity” and is capable of identifying zero-day vulnerabilities in operating systems and browsers.

Mozilla previously touted the tool as “just as good” as “the world’s best security researchers,” and is now looking to back that claim up with hard evidence.

The myth destabilizes Firefox

Mozilla’s bug-fixing performance with Mythos comes down to two things, the company said.

The first being improvements to AI tools such as Mythos, and the second being Mozilla’s custom-developed “harness” that allowed Mythos to analyze Firefox code without producing the “junk slop” typical of previous AI bug fuzzing tools.

“When it comes to bugs that appear on the other side, there are almost no false positives,” Mozilla engineer emeritus Brian Grinstead said in an interview. The exploit Mozilla developed for Mythos would give the AI tool access to a similar workflow used by a human team.

Mythos then receives files that contain issues and is given the task of creating a test case for exploiting the bugs, which is then run by fuzzing tools to look for potential vulnerabilities.

A chart showing the number of security bug fixes released by Mozilla for the FIrefox web browser per month.

(Image credit: Mozilla)

Some of the vulnerabilities that Mythos managed to identify had been present for 15 to 20 years and required a complex chain of several bugs to result in a complete compromise of Firefox. Typically, such an exploit chain takes weeks to identify and is notoriously difficult to spot using traditional fuzzing techniques.

Of course, Mythos is not a silver bullet for cyber defense and certainly should not be viewed as such. As Mozilla has demonstrated, it cannot simply be deployed to instantly patch every vulnerability in software. It needs direction and guidance from humans to operate on such a scale.

Google logo on black background next to text