Firefox developer Mozilla revealed that an early version of Anthropic’s Claude Mythos AI identified 271 vulnerabilities in the Firefox browser during internal testing, all of which were patched this week.

The findings point to how advanced AI systems are starting to scan large codebases at a scale that once depended on long hours of manual work by cybersecurity researchers. Mozilla said even hardened software targets could now be examined more deeply in a shorter time.

“As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus,” Mozilla wrote. “For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up.”

Earlier testing using another Anthropic model had uncovered 22 security-sensitive bugs in a previous Firefox release. Despite that progress, Mozilla noted that eliminating software exploits entirely has long been considered unrealistic.

“Until now, the industry has largely fought security to a draw,” the company wrote. “Vendors of critical internet-exposed software like Firefox take security extremely seriously and have teams of people who get out of bed every morning thinking about how to keep users safe.”

Mozilla said the new system can review source code and flag weaknesses in ways that previously required highly specialized human expertise. Internal results showed the model did not uncover bugs beyond the reach of top-tier researchers.

“Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension, but we don’t think so,” the company said. “Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex.”

Launched in March, Claude Mythos is described by Anthropic as its most advanced model for reasoning, coding, and cybersecurity tasks, positioned above its earlier Opus series. Pre-release testing suggested it could identify thousands of unknown vulnerabilities across operating systems and browsers.

Access to the system remains limited through a restricted initiative known as Project Glasswing, which allows select firms, including Amazon, Apple, and Microsoft, to scan software for security flaws.

Security researchers warn that the same capability could be used offensively. AI tools that can analyze code at scale may also automate the discovery of exploitable bugs across widely used software systems.

Testing by the U.K.’s AI Security Institute showed the model could carry out complex cyber operations on its own, including completing a multi-stage corporate network attack simulation without human input. Those results have drawn attention from governments and intelligence agencies.

Despite earlier tensions with Donald Trump’s administration over the use of Anthropic’s technology, the National Security Agency has deployed Claude Mythos Preview on classified networks, according to people familiar with the matter. The move signals growing interest among U.S. agencies in AI tools that can detect critical software vulnerabilities.

Anthropic has also acknowledged that current cybersecurity benchmarks are struggling to keep pace with its latest models, raising questions about how to measure AI performance in this field.

Mozilla said the results suggest a possible turning point, where defenders may begin to narrow the long-standing gap with attackers.

“We are extremely proud of how our team rose to meet this challenge, and others will too,” the company wrote. 

“Our work isn’t finished, but we’ve turned the corner and can glimpse a future much better than just keeping up. Defenders finally have a chance to win, decisively.”

Crypto protocols have warned that an increase in AI use has led to a flood of bogus bug bounty submissions, putting a strain on teams trying to identify real threats to their protocols. 

Bug bounties are a system to reward “good” hackers for submitting reports about potential vulnerabilities and are popular in the crypto industry. AI has now made it easier to sift through large amounts of code to find possible bugs, though AI is also known to hallucinate. 

“AI is changing the way that bug bounty programs must operate,” said Barry Plunkett, co-CEO of Cosmos Labs, on Tuesday, responding to a bug bounty hunter who accused the protocol of ignoring their vulnerability report. 

“Our program has seen a 900% increase in submission volume from last year, on the order of 20-50 per day,” he said, adding that it’s led to a huge increase in both valid and invalid reports. 

Kadan Stadelmann, a blockchain developer and chief technology officer at Komodo Platform, told Cointelegraph he has also seen a notable increase in bug bounty submissions and payouts across organizations. 

“There has definitely been an increase in low-quality bug bounty submissions, some of which have been false positives, potentially suggesting AI sourcing. One potential explanation is that AI has caused a decrease in the cost to produce a report, resulting in an influx of submissions.” 

In January, Daniel Stenberg, the creator of the open-source data transfer tool curl, which is used in many apps, including blockchain infrastructure, announced he was ending his bug bounty program because of an influx of “AI slop in vulnerability reports,” and he was exhausted from sifting through them.

HackerOne, one of the largest bug bounty platforms in the world, reported in January that there were 85,000 valid bounty submissions in 2025, up 7% from the previous year.

AI could be both the cause and the solution

Plunkett said Cosmos Labs has already started to adapt its approach as a result of the uptick in bug bounty submissions by tightening how it scores submissions, prioritizing trusted researchers with a proven track record and working with other bug bounty providers that offer more advanced triage.

Meanwhile, Stadelmann said bug bounty programs have proven integral to defending decentralized systems, and adopting AI to assist in sifting through the noise could be a solution.

“Blockchain teams will have to create AI deterrents to sift through incoming bug bounties. The smaller the team, the bigger the problem of increased bug bounties will become. Software engineers won’t have the capacity to examine everything,” he said.

“This is where defensive AI systems to automatically sift through incoming bug bounties will be crucial. Teams dependent on bug bounties will need to develop stricter standards on their bug bounty programs as a means of lowering the number of incoming reports.”

Related: Crypto hackers stole $17B over past 10 years: DefiLlama