The Behind-the-Scenes Story of Hardening Firefox with Claude Mythos Preview

Mozilla improved model performance and its agentic harness to reduce noise and increase signal in AI-generated security reports, building a pipeline to find real vulnerabilities in Firefox at scale.

Initially, they experimented with static analysis using GPT-4 and Sonnet 3.5, but got a lot of false positives. They then shifted to an approach that attached a harness on top of fuzzing infrastructure to create and run reproducible test cases, dynamically validating bug hypotheses.

This pipeline first applied Claude Opus 4.6, then swapped in Claude Mythos Preview, which led to even bigger results. In Firefox 150, 271 bugs identified by Mythos Preview were fixed. Related fixes were also included in 149.0.2, 150.0.1, and 150.0.2.

Representative cases include the following.

• A fake object primitive leading to elimination of WebAssembly GC struct initialization in the JIT
• A parent process UAF and sandbox escape via an IPC race condition
• A NaN deserialization issue and a fake object primitive in the parent process
• A 20-year-old XSLT rehash bug
• A 16-bit layout bitfield overflow exploiting rowspan=0

Many of the disclosed bugs were sandbox escapes, targeting paths where already-compromised code in the content process escalated to the privileged parent process. Mozilla applied structural defenses such as prototype freeze, and the harness logs also confirmed the effectiveness of prior hardening work.

In the FAQ at the end, it's noted that Firefox 150 had 3 internal rollups, and across the entire April release, 423 security bugs were fixed. Mozilla plans to attach this scan to CI going forward, so it automatically checks whenever a patch lands on the tree.