Mozilla fixed 271 Firefox bugs with one model
Two weeks after gaining access to a frontier model in April 2026, Mozilla found and fixed 271 security bugs in Firefox. The same capability cuts both ways.
In April 2026, two weeks after gaining limited access to Anthropic's Claude Mythos Preview, Mozilla announced it had found and fixed two hundred and seventy-one security vulnerabilities in Firefox using the model. It is the most hopeful entry on the record, and it carries the same warning as the alarming ones.
What Mozilla did
Firefox is one of the most scrutinised pieces of software on earth, tested constantly by a large security team and a global community. In a fortnight with a capable model, that team found and closed 271 real vulnerabilities. Most organisations do not find that many in years. The model did not replace Mozilla's engineers; it multiplied them, turning a small team into one that could look everywhere at once.
The same capability, pointed the other way
This is the encouraging mirror of the incidents that make headlines. The same capability that let a model find a 27-year-old flaw in OpenBSD, or chain an exploit into a frontier lab, let Mozilla clear 271 of its own bugs in two weeks. The tool is neutral. What decides the outcome is who picks it up, and whether they use it on their own product before someone else does.
One team with the model found more in a fortnight than most find in years.MATT Research
The pattern
The lesson is simpler than dangerous-or-safe: the same capability is available to whoever asks first. A defender who runs it against their own product turns a once-a-year audit into something continuous. One who waits leaves the first move to an attacker. That is the whole idea behind continuous assurance: run the attacker's tools on your own product, on every release, and keep the rules holding as the code changes. This account follows Mozilla's announcement ↗; it is linked from the Record.
Questions
Did Mozilla really fix 271 Firefox bugs with an AI model?
Yes. In April 2026, about two weeks after gaining limited access to Anthropic's Claude Mythos Preview, Mozilla announced it had found and patched 271 security vulnerabilities in Firefox using the model.
Does this mean AI replaces security engineers?
No. It multiplied Mozilla's existing team and did not replace it. The model let a skilled team look in far more places at once; people still decided what to fix and how. The result was reach, and people kept the judgement.
Why is a defensive story on an incident record?
Because it is the same capability as the attacks, pointed the other way. The model that helped Mozilla clear 271 bugs is the model that found flaws elsewhere. The record is about the capability, not only the damage.
What is the takeaway for other companies?
Run the tool on your own product first. The advantage goes to whoever looks first, so testing your live product continuously with the same class of model an attacker would use is now the safer default.
How is this different from a normal security audit?
Scale and speed. A traditional audit is a snapshot by a small team over a fixed window. A capable model lets a team test far more, far faster, which makes continuous testing on every release practical, where it used to be aspirational.