Anthropic's Claude Mythos AI Finds 271 Vulnerabilities in Firefox -- Yes, It's Seriously Powerful

“Until now, the industry has largely fought security to a draw,” the company wrote. “Vendors of critical internet-exposed software like Firefox take security extremely seriously and have teams of people who get out of bed every morning thinking about how to keep users safe.”

Mozilla said the new AI system can analyze source code and identify vulnerabilities in ways that previously depended on scarce human expertise. However, Mozilla said the company was encouraged to see that no bugs were found that couldn't have been discovered by "an elite human researcher."

"Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension, but we don’t think so," they said. "Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex."

The results, however, suggest AI tools could allow developers to uncover large numbers of vulnerabilities before attackers exploit them—though conversely, in the wrong hands, it could spell big trouble for software firms and users alike.

Launched in March, Mythos is Anthropic’s most advanced model for reasoning, coding, and cybersecurity tasks. Internal company materials describe the system as part of a new model tier beyond the company’s earlier Opus series.

Testing conducted before the model’s release showed it could identify thousands of previously unknown vulnerabilities across major operating systems and web browsers.

Anthropic has limited access to the system through a restricted program called Project Glasswing, which gives select technology companies—including Amazon, Apple, and Microsoft—the ability to use the model to scan software for weaknesses. It reflects a growing effort within the cybersecurity industry to use AI systems to identify and patch vulnerabilities before attackers can exploit them.

However, the same technology could also enable new forms of cyberattacks. Security researchers say AI systems capable of analyzing code at scale could automate the discovery of exploitable vulnerabilities across widely used software.

After the launch of Mythos, testing by the U.K.’s AI Security Institute found that the AI could autonomously execute complex cyber operations, including completing a multi-stage corporate network attack simulation without human assistance. Those capabilities have drawn attention from governments and intelligence agencies alike.

Despite a call from President Donald Trump's administration to stop using Anthropic’s technology due to a clash over its use in war and surveillance matters, on Monday, the National Security Agency was revealed to be running Claude Mythos Preview on classified networks, according to sources familiar with the deployment. The use of Mythos underscores the growing interest among U.S. security agencies in the model’s ability to identify critical software vulnerabilities.

The model’s performance has also exposed limits in existing AI evaluation systems. Earlier this month, Anthropic acknowledged that several cybersecurity benchmarks are no longer sufficient to measure the capabilities of its newest models.

Mozilla said the results point to a potential shift in cybersecurity, where defenders may begin to close the long-standing advantage attackers have held.

“We are extremely proud of how our team rose to meet this challenge, and others will too,” Mozilla wrote. “Our work isn’t finished, but we’ve turned the corner and can glimpse a future much better than just keeping up. Defenders finally have a chance to win, decisively.”

In brief