AI vulnerability discovery could change cybersecurity economics by making sophisticated code review dramatically cheaper. Mozilla’s Firefox engineering team evaluated Anthropic’s Claude Mythos Preview and identified 271 vulnerabilities fixed in version 150. An earlier collaboration using Opus 4.6 produced 22 security-sensitive fixes in version 148.
The scale creates immediate remediation work, but it also challenges the assumption that attackers will always have more incentive to search deeply for rare flaws than defenders can afford.
If advanced models can reason through large legacy codebases continuously, vulnerability discovery may shift from scarce expert labour toward repeatable infrastructure.
Mythos extends beyond conventional scanning
Fuzzing and static analysis are effective but leave gaps, particularly in logic that requires understanding relationships across source code. Elite researchers manually reason through those areas, a process limited by time and specialist availability.
Mozilla’s evaluation suggests Mythos can perform similar reasoning at much greater scale. The team reported no category or complexity of human-discoverable flaw that the model could not find, while noting that the bugs remained within categories an elite researcher could understand.
That distinction matters. The model is not described as inventing incomprehensible new attacks; it is reducing the cost of searching a finite body of software defects.
For legacy C++ systems, automated reasoning offers an alternative to rewriting everything in a memory-safe language such as Rust. Migration still improves protection against certain flaw classes, but stopping development for a complete replacement is unrealistic for many enterprises.
Discovery cost moves into verification and repair
Running frontier models over proprietary code consumes substantial tokens and infrastructure. Organisations need secure context systems that keep source code partitioned and protected.
False positives can waste scarce engineering time, so findings should be cross-checked with static analysis, fuzzing and reproducible tests. A model report becomes valuable only when a human team can confirm impact and produce a safe patch.
Finding 271 issues at once also creates prioritisation pressure. Teams must rank exploitability, exposure and potential harm rather than attempting every fix in arbitrary order. Release planning, disclosure and regression testing can become the new bottlenecks.
The short-term experience may feel worse because the visible backlog expands. The long-term benefit appears when repeated scans reduce hidden risk and prevent costly breaches or ransomware incidents.
A new standard of software care may emerge
Attackers have traditionally been able to concentrate months of effort on one valuable exploit. Cheaper automated discovery lets defenders search broadly and repeatedly, eroding that asymmetry.
As capable tools become available, expectations for software vendors will rise. Failing to run advanced audits on widely exposed products could eventually be viewed as negligence, particularly after a preventable incident.
That future requires access beyond a few model providers and major companies. Smaller maintainers need affordable scanning and support for remediation, or the security gap between well-funded and essential open-source projects may widen.
Dual-use controls remain important because the same model can help exploit an unpatched flaw. Responsible programmes should coordinate disclosure, limit access to live targets and give maintainers time to respond.
The Firefox results do not mean vulnerabilities will reach zero. New code, dependencies and configurations continue to create defects. They do show that expert-level reasoning can be applied at a volume previously impossible.
AI is therefore reversing one part of the cost equation: discovery no longer needs to be the rarest resource. Organisations still must fund validation and repair, but that is a healthier constraint than remaining unaware of flaws.
Defenders gain an advantage when they can find weaknesses continuously, understand them and fix them before attackers act. Mythos suggests that advantage is becoming technically plausible—provided enterprises are prepared for the remediation work that success produces.
