Loading story…
Mozilla said Firefox 150 shipped with fixes for 271 security vulnerabilities identified during an early evaluation of Anthropic’s restricted Claude Mythos Preview model, a sharp increase from the 22 bugs previously found with Anthropic’s Opus 4.6 in Firefox 148. Mozilla CTO Bobby Holley said the findings created a major engineering burden and forced reprioritization, but argued the work was necessary because AI-assisted vulnerability discovery is rapidly improving and can now reason about source code at a level Mozilla compared to elite human researchers. Mozilla said the model did not uncover wholly new classes of flaws beyond human capability, but it found known types of bugs at much greater speed and scale, including issues traditional fuzzing might miss.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Bloomberg reported on April 22 that a small group of users obtained unauthorized access to Mythos through several methods, including via a third-party vendor connected to Anthropic. The model remained restricted to 40 organizations in Project Glasswing and was not publicly released.
An earlier Mozilla evaluation using Anthropic's Opus 4.6 identified 22 security-sensitive Firefox vulnerabilities, including 14 high-severity issues according to one report. Those flaws were patched in Firefox 148.
Mozilla said Firefox 150 includes protections or patches for 271 vulnerabilities identified during an early evaluation of Anthropic's Claude Mythos Preview. Mozilla described the volume of findings as a major operational burden and evidence of rapid progress in AI-assisted vulnerability discovery.
Mozilla and Anthropic reportedly began collaborating in February 2026 to use Anthropic frontier AI models to scan the Firefox codebase for security vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetechrepublic.com
Open sourcecybersecuritynews.com
Open sourcethecyberthrone.in
Open sourcego.theregister.com
Open sourcearstechnica.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic reported that **Claude Opus 4.6** identified **22 security vulnerabilities in Mozilla Firefox** during a **two-week** collaboration with Mozilla, with **14** categorized as **high severity**. The work began in Firefox’s **JavaScript engine** and expanded across the broader codebase, demonstrating that an AI model can rapidly surface memory-safety and other complex issues in a mature, heavily scrutinized open-source project; one example cited was a **use-after-free** class bug discovered early in the effort. Mozilla validated the findings and shipped fixes, with most issues addressed in **Firefox 148** (and some remediations deferred to a subsequent release, per reporting). Separate reporting discussed market and product implications of Anthropic’s *Claude Code Security* feature—an AI-assisted code-scanning capability that suggests patches and is positioned as an alternative to traditional rules-based static analysis—along with investor reactions affecting major security vendors. While related to AI-driven secure development, that coverage does not describe the Firefox vulnerability-discovery engagement itself and is better treated as adjacent industry context rather than part of the same specific event.
Jun 29, 2026
Mozilla released Firefox 146, addressing a series of high-impact security vulnerabilities, including several use-after-free flaws, privilege escalation issues, and a sandbox escape. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation bugs in components such as DOM: Notifications and Netmonitor. Several JIT miscompilation vulnerabilities in the JavaScript Engine were also patched, along with a same-origin policy bypass and spoofing issue in the Downloads Panel. The update also resolves memory safety bugs affecting both Firefox and Thunderbird, some of which could potentially be exploited for remote code execution. Mozilla rates the overall impact of these vulnerabilities as high, urging users to update to Firefox 146 promptly to mitigate risk. The advisories provide CVE identifiers and reference associated bug reports for further technical details.
Jun 29, 2026
Anthropic’s **Claude Code Security** was introduced as an AI-driven capability within *Claude Code* that scans source code for vulnerabilities and proposes patches for human review, positioning itself as more adaptive than traditional rules-based static analysis. Coverage noted that early investor reaction briefly pressured major security vendors’ valuations, but analysts assessed the longer-term market impact as likely to be more nuanced given the feature’s early-preview status and its role as an add-on within a broader coding assistant/agent rather than a standalone security product. Separately, Mozilla engineers reported using **Claude** to help identify a “slew” of new Firefox issues, while also highlighting that a meaningful share of observed Firefox crashes may not be software defects at all but *hardware-induced memory errors* (“bit flips”). Mozilla cited roughly **470,000** weekly crash reports (from opted-in users), with about **25,000** flagged as potential bit flips (and possibly higher due to conservative heuristics), underscoring that AI-assisted bug-finding can improve software quality but may not address instability rooted in faulty or error-prone hardware (including potential causes like **Rowhammer** or defective components).
Jun 29, 2026