Anthropic's Claude Mythos AI Finds 271 Vulnerabilities in Firefox—Yes, It's Seriously Powerful

In brief

• Mozilla says Anthropic’s Claude Mythos identified 271 vulnerabilities in Firefox during testing.
• Anthropic is restricting the model to vetted partners through Project Glasswing because of cybersecurity risks.
• Researchers warn that the same capability could accelerate automated cyberattacks.

For decades, attackers have had the advantage in cybersecurity. Artificial intelligence may be about to change that.

In a blog post published on Tuesday, Firefox browser developer Mozilla said an early version of Anthropic’s Claude Mythos AI—which has drawn attention in recent weeks for its purported cybersecurity prowess—model helped identify 271 vulnerabilities in the browser during internal testing. Those bugs were patched this week.

The results highlight how advanced AI systems can analyze large codebases and locate weaknesses that previously required extensive manual review by human cybersecurity researchers.

“As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus,” Mozilla wrote. “For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up.”

Mozilla had earlier tested another Anthropic model that identified 22 security-sensitive bugs in a previous Firefox release. Despite these successes, Mozilla acknowledged that the cybersecurity industry has long treated the complete elimination of software exploits as an “unrealistic goal.”

“Until now, the industry has largely fought security to a draw,” the company wrote. “Vendors of critical internet-exposed software like Firefox take security extremely seriously and have teams of people who get out of bed every morning thinking about how to keep users safe.”

Mozilla said the new AI system can analyze source code and identify vulnerabilities in ways that previously depended on scarce human expertise. However, Mozilla said the company was encouraged to see that no bugs were found that couldn't have been discovered by "an elite human researcher."

"Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension, but we don’t think so," they said. "Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex."

The results, however, suggest AI tools could allow developers to uncover large numbers of vulnerabilities before attackers exploit them—though conversely, in the wrong hands, it could spell big trouble for software firms and users alike.

Launched in March, Mythos is Anthropic’s most model for reasoning, coding, and cybersecurity tasks. Internal company materials describe the system as part of a new model tier beyond the company’s earlier Opus series.