Anthropic, the company behind Claude, has built an AI called Mythos that's exceptionally good at finding software vulnerabilities. Because it could be dangerous if misused, it's only being offered to select companies as Claude Mythos Preview. One of those companies is Mozilla, which just reported that the AI discovered 271 security vulnerabilities in the latest Firefox 150.
Since February 2026, Mozilla's Firefox team has been using cutting-edge AI models to find and fix security flaws. They partnered with Anthropic to scan Firefox using Opus 4.6, which found 22 vulnerabilities in Firefox 148, released in February 2026.
As part of their ongoing collaboration, Mozilla got early access to Claude Mythos Preview. When they used it to explore Firefox 150—officially released on April 22, 2026—the initial assessment turned up a staggering 271 vulnerabilities.
Mozilla commented on the massive haul, saying, "As capabilities like Mythos reach more defenders, many teams are feeling the same sense of unease that ours did when this discovery first landed. In 2025, a single vulnerability like this would have been a red alert. To have this many at once makes you wonder if you can even keep up."
They added, "Our experience should be a beacon of hope for teams that shake off the dread and get to work. It may require rethinking every other priority to focus relentlessly on this challenge, but there is light at the end of the tunnel. We are incredibly proud of our team for facing this head-on, and other teams will be too. Our work isn't done, but we've reached an inflection point and can glimpse a much brighter future beyond the status quo. Defenders have finally gotten a chance at a decisive victory."
Until now, the tech industry has seen a roughly even fight between attackers and defenders on security. Vendors of critical public-facing software like Firefox take security extremely seriously, with teams that wake up every morning thinking about user safety.
Mozilla explained their historical approach: "For years, everyone has quietly acknowledged that getting to zero vulnerabilities is an unrealistic goal. Instead, we've aimed to make exploiting vulnerabilities prohibitively expensive, so that only attackers with virtually unlimited budgets can use them, and the cost of wasting such a high-value asset deters casual misuse."
Skilled security researchers find bugs by exhaustively analyzing source code, catching things automated fuzzing tools miss. It's effective but time-consuming and labor-intensive, something only a limited number of people can do. Just a few months ago, computers couldn't perform this kind of analysis, but Claude Mythos Preview matches that capability. As of this writing, there hasn't been a type or complexity of vulnerability that humans can find that Claude Mythos Preview can't.
Mozilla said, "This might feel terrifying in the short term, but ultimately it's good news for defenders. Attackers can spend months and significant resources to find a single bug, but defenders can't afford that and have to rely on machines. Until now, machines' bug-finding ability was low, creating a gap with human capability that gave attackers an edge. Closing that gap reduces the discovery cost for all bugs and undermines attackers' long-term advantage."
Fortunately, no bugs have been found that even skilled human researchers couldn't discover. Some critics predict future AI models will find entirely new forms of vulnerabilities beyond our current understanding, but Mozilla isn't buying it. "We don't think so," they explained. "Software like Firefox is designed modularly so humans can reason about its correctness. It's complex, but that complexity isn't unbounded."