Mythos Finds 271 Firefox Vulnerabilities: A Wake-Up Call for AI Security Teams

For years, the cybersecurity industry has operated under an uncomfortable assumption: that attackers will always find vulnerabilities faster than defenders can patch them. The asymmetry is structural finding a single exploitable flaw in complex software requires either extraordinary human expertise concentrated over months, or automated fuzzing techniques that scale but miss the nuanced logic errors that elite researchers catch.

Anthropic's Mythos AI model may be changing that assumption. And the implications for enterprise security teams including those across the GCC managing complex, legacy-laden digital infrastructure are significant enough to warrant serious attention.

What Mythos Did With Firefox's Source Code

Mozilla, the organization behind the Firefox browser, was granted early access to Anthropic's Mythos Preview model under Project Glasswing a tightly restricted program currently limited to a small group of critical industry partners including Amazon, Microsoft, Nvidia, and Apple, alongside more than 40 organizations involved in building or maintaining critical software infrastructure.

The results of Mozilla's test are striking. Mythos Preview identified 271 security vulnerabilities in the unreleased source code of Firefox 150 simply by reading and reasoning through the code before the browser shipped. To understand the magnitude of that number, consider this comparison: Anthropic's Claude Opus 4.6 model, analyzing Firefox 148 just one month earlier, found 22 security-sensitive bugs.

That is not a marginal improvement. It is a step change.

Firefox CTO Bobby Holley was direct about what the results mean: "We have many years of experience picking apart the work of the world's best security researchers, and Mythos Preview is every bit as capable."

Why This Matters Beyond Firefox

The significance of the Mythos finding extends well beyond a single browser's vulnerability count. The vulnerabilities it identified could have been caught in two other ways: through automated fuzzing techniques, or through months of concentrated effort by elite human security researchers. Mythos eliminated both requirements finding what would have taken significant human time and cost in a single analysis pass.

Mozilla CTO Raffi Krikorian put the implication plainly in a recent essay: the traditional balance between attacker and defender in cybersecurity has been maintained partly by the difficulty of finding bugs. Both sides faced similar constraints. Mythos breaks that equation and the question is which side benefits more from the breaking.

The answer, according to Holley, is defenders but only if they move fast. "Every piece of software is going to have to engage with this, because every piece of software has a lot of bugs buried underneath the surface that are now discoverable," he told Wired.

That statement carries particular weight for the open source projects that underpin much of the modern internet including critical infrastructure software relied upon by enterprises across the Gulf. Open source codebases are publicly accessible, which means they are as readable by AI vulnerability scanners as by Firefox's own security team. Projects maintained by volunteer communities with limited security resources are now operating in an environment where their entire codebase can be analyzed for exploitable flaws at scale.

The Access Question And What It Means for the GCC

Mythos Preview is currently restricted. Access is limited to Project Glasswing partners major technology firms and critical infrastructure organizations hand-selected by Anthropic. The rationale is straightforward: a model capable of finding hundreds of vulnerabilities in major software simply by reading source code is also, theoretically, capable of accelerating exploit development if it reaches the wrong hands.

Anthropic has said the model was limited specifically because of concerns that its capabilities could turbocharge AI-aided hacking. Governments are taking those concerns seriously Australia's Home Affairs ministry confirmed this week it is actively working with Anthropic and other software providers to manage the emerging vulnerability risks Mythos represents. Central banks in Australia and New Zealand have said they are monitoring the release and coordinating with global regulators.

For enterprise security leaders across Saudi Arabia, the UAE, and the wider Gulf, the access restriction is both a relief and a prompt. The relief: the most capable version of this technology is not yet broadly available to threat actors. The prompt: the window between a model of this capability existing and it being accessible to defenders and attackers alike will not remain narrow indefinitely.

The Saudi NCA's push for proactive security posture assessments and the UAE's Cybersecurity Council directives on continuous monitoring are already pointing enterprise security teams in the right direction. Organizations that have mapped their software dependencies, maintained their vulnerability management programs, and built relationships with security vendors at the frontier of AI-powered detection will be better positioned when models of Mythos's capability become more widely available.

What Enterprise Security Teams Should Be Asking Now

The Mythos results raise a practical set of questions for every security team managing complex software environments.

What software are you running that has not been analyzed by AI-powered vulnerability detection? Legacy enterprise applications, internally developed tools, and open source dependencies are all candidates. The question is no longer whether AI can find vulnerabilities in your stack it is whether your team gets there before someone else does.

Is your vulnerability management program built for the pace AI-powered discovery enables? Mythos found 271 vulnerabilities in a pre-release browser build in a single analysis pass. Traditional monthly or quarterly patching cycles were not designed for a threat environment where the rate of vulnerability discovery is about to accelerate significantly.

Are you tracking Anthropic's Project Glasswing and equivalent programs from other AI labs? The shift from AI-assisted to AI-operated security analysis is happening now, at the frontier. Staying informed about capability developments is no longer optional for CISOs building 12 to 24 month security roadmaps.

Firefox's CTO believes Mozilla has rounded the curve that having had early access to Mythos, the browser's most deeply buried vulnerabilities have now been surfaced and can be addressed. For the vast majority of enterprise software environments, that curve has not yet been rounded. The window to get ahead of it is open. It will not stay open indefinitely.