Mozilla Found 271 Firefox Vulnerabilities With Claude Mythos — Nearly Zero False Positives
Mozilla says it has found 271 vulnerabilities in Firefox using Claude Mythos Preview, with almost no false positives — a signal-to-noise ratio that has convinced the organisation’s engineering leadership to treat AI-assisted vulnerability detection as a permanent part of the security pipeline.
Ars Technica reported that Mozilla’s CTO made the claim in a recent public statement, describing the AI-assisted results as having “almost no false positives” and saying the company has “completely bought in” on the approach. The declaration that zero-days are “now solved” as a problem class is a strong claim; the underlying finding — 271 confirmed vulnerabilities with near-zero noise — is the concrete data behind it.
What Mythos Brings to Security Work
Claude Mythos Preview shipped April 7 with a 245-page system card. Anthropic positioned it explicitly for high-consequence professional use cases, including cybersecurity. The model was simultaneously made available to the NSA for offensive cyber work and to defensive security programmes like Project Glasswing, the $104M coalition backed by Amazon, Apple, Google, Microsoft, and NVIDIA.
The Firefox use case is distinct from both of those deployments. Mozilla is using Mythos as a static and dynamic analysis tool over a large, mature codebase — not for novel exploit development or red-team exercises. Firefox’s C++ and Rust codebase is among the most security-audited open-source projects in existence. Finding 271 confirmed issues suggests Mythos is surfacing a category of vulnerability that conventional automated tools miss, rather than rediscovering known problem patterns.
The False Positive Problem
For security tooling, false positive rate matters more than discovery rate. A tool that generates 10,000 findings requires 10,000 engineer-hours of triage, most of it wasted. Traditional static analysis tools — Coverity, CodeQL, Semgrep — are typically tuned to low false-positive operating points that still require significant manual review.
Mozilla’s “almost no false positives” claim, if it holds at scale, describes a qualitatively different operating point. It implies Mythos can be integrated earlier in the development pipeline — or run at higher coverage — without generating noise that overwhelms the team doing remediation.
Implications for the Security Industry
The Firefox result is a single data point from a single organisation on a single codebase. But it’s a credible one. Mozilla has the engineering depth to evaluate findings rigorously, and Firefox’s security history provides a meaningful baseline for comparison.
If the near-zero false positive rate holds across other large codebases, the economics of vulnerability research shift. Bug bounty programmes, internal red teams, and managed security services all price their work against the cost of finding bugs manually. A tool that finds 271 confirmed vulnerabilities in a mature, well-audited codebase — without drowning reviewers in noise — compresses that cost by an order of magnitude.
Anthropic has not publicly disclosed pricing for Mythos in security research contexts. Claude Security Beta, which launched separately as a codebase scanner that drafts patches rather than just flagging findings, is positioned for that market segment. Whether Mozilla used Claude Security Beta, direct Mythos API access, or a custom deployment has not been disclosed.