Firefox 150 fixed 271 security vulnerabilities in a single release.
That is a new record for Mozilla. Around the same time last year, a Firefox release was fixing roughly 31 vulnerabilities. The jump from 31 to 271 is not a rounding error. It is a change of order.
The reason has a name: Claude Mythos.
Mozilla had Mythos for months
Before Anthropic publicly introduced Mythos in April 2026, a small circle of major companies had already received preview access. AWS, Apple, Google, Microsoft, Mozilla and others were part of an internal program called Project Glasswing.
Mozilla ran the Mythos preview for several months. By the time Firefox 150 shipped, the combined security work included several striking numbers:
- All 271 reported vulnerabilities were fixed.
- 180 were marked sec-high by Mozilla, its internal top severity bucket for issues that can be exploitable during ordinary browsing.
- Three issues received formal CVE identifiers: CVE-2026-6746, CVE-2026-6757 and CVE-2026-6758. Many of the rest were internal findings, hardening work or problems in code paths not believed to be exploitable.
- The oldest bug had been sitting in the codebase for 15 years: an HTML parsing issue dating back to pre-2011 code.
Firefox CTO Bobby Holley put the result in a revealing way: the encouraging part was that Mozilla did not see any issue that a top human researcher could not have found.
In other words, Mythos was not doing something only an AI could do. It was doing work human researchers already know how to do, but at many times the pace.
Mozilla said the quiet part out loud
Mozilla chief engineer Brian Grinstead told TechCrunch that it was hard to overstate how much the dynamic had changed for the team, because these tools had suddenly become very good.
The more important line was about the repair process:
Every fix still had an engineer writing the patch and another engineer reviewing it. Mozilla could not automate that step away.
That is the real lesson. Mythos can find the holes. Humans still have to close them. For Mozilla's engineers, the immediate effect is not fewer bugs. It is a much larger queue of bugs that now have to be fixed.
The numbers support that shift. Firefox fixed 423 bugs in April 2026, compared with 31 in the same month a year earlier.
The translation is simple: AI has made finding bugs an order of magnitude faster, while fixing them still scales with people. The bottleneck has moved from scanning to remediation.
Why Anthropic is keeping Mythos closed
Mythos remains inside Project Glasswing. Only a small group of trusted partners can use the preview version. Anthropic's explanation is straightforward: in the wrong hands, the tool could surface deeply buried 0-days.
Palo Alto Networks' testing found that one Mythos penetration test covered the equivalent of a year of human work in less than three weeks.
That is why Anthropic is not rushing to make it public. In vulnerability research, speed decides who gets there first. If a Mythos-class system reaches attackers before defenders have the capacity to patch, the number of exploitable holes could rise faster than good actors can close them.
The Firefox 271 figure is already evidence that AI vulnerability hunters at this level are an irreversible technical shift. The remaining question is not whether they will matter, but who gets to use them first.
From Anthropic's perspective, maturing the system with a dozen trusted partners is much safer than an open release. From the open source ecosystem's perspective, however, projects such as OpenBSD, Apache and the Linux kernel are not on the Project Glasswing list.
The second half of this fight will be worth watching.
Sources: CocoLoop, How Anthropic's Mythos has rewritten Firefox's approach to cybersecurity (TechCrunch), Claude Mythos Finds 271 Firefox Vulnerabilities (SecurityWeek), Behind the Scenes Hardening Firefox with Claude Mythos Preview (Mozilla Hacks)