Hardening Firefox with Claude

Mozilla used Claude Mythos Preview and other AI models to find a large number of latent security bugs in Firefox, some of which included sandbox escapes.

The key was a harness that, rather than relying on static analysis, generated reproducible test cases to verify hypotheses. The model was used to find vulnerable points, create code that reproduces the bugs, and even explain the impact.

The results are as follows.

• 271 bugs were fixed in Firefox 150.
• Additional fixes were also included in 149.0.2, 150.0.1, and 150.0.2.
• The published samples included vulnerabilities across various subsystems such as JIT/Wasm GC, IPC races, XSLT, WebTransport, RLBox, and HTML table/layout.
• Existing hardening measures, such as prototype freezing, actually blocked several escape attempts.

Mozilla built this pipeline on top of its existing fuzzing infrastructure, parallelizing it across multiple ephemeral VMs to explore file by file. Afterward, it integrated the entire security operations workflow, from triaging by filtering out known issues and duplicates to connecting fixes to releases.

Over 100 people participated in this work, including writing code, reviewing, testing, triaging, and releasing. Mozilla plans to expand this analysis going forward by attaching it to CI, so that patches are automatically scanned as they come in.