{"id":"AIBD-1237","title":"Mozilla fixes 271 vulnerabilities in Firefox 150 that an early version of Anthropic's Claude Mythos Preview identified in an initial evaluation, after a scan with Claude Opus 4.6 had led to 22 fixes in Firefox 148","summary":"Mozilla says that Firefox 150 fixes 271 vulnerabilities that an early version of Claude Mythos Preview identified in an initial evaluation: 180 rated high, 80 moderate and 11 low.","date_observed":"2026-04-21","date_basis":"event","date_precision":"day","benefit_status":"reported","account":"Mozilla began working with Anthropic in February 2026. A scan of Firefox with Claude Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148. Mozilla then applied an early version of Claude Mythos Preview to Firefox. Firefox 150, released on 21 April 2026, fixes 271 vulnerabilities identified during that initial evaluation. In May, Mozilla's engineers wrote that 180 of the 271 were rated high, 80 moderate and 11 low, and that the model's reports produced few false positives. The same post says that Mozilla fixed 423 security bugs in its April releases in all, since its security team also hunts for bugs by fuzzing, by manual inspection and with other models, and that further fixes from the evaluation shipped in 149.0.2, 150.0.1 and 150.0.2. Anthropic cites the result in its Project Glasswing update. Privacy Guides reported the announcement on 22 April 2026. The count of 271 is Mozilla's own, and Mozilla has not described most of the individual bugs.","category":"protective response","unexpected":false,"purpose":"Mozilla applied Claude Mythos Preview to Firefox's code to find security vulnerabilities before attackers do.","system":"Claude Mythos Preview","model_version":"early version of Claude Mythos Preview","developer":"Anthropic","deployer":"Mozilla (Firefox security team)","location":null,"domain":"Cybersecurity / vulnerability research","segment":"Technology","registry_ids":{},"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed 271 vulnerabilities that the model identified, 180 of them rated high, in one release."},{"group":"societal","depth":null,"reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}],"ai_role":{"status":"assessed","statement":"Mozilla says that the model identified the 271 vulnerabilities and that its reports produced few false positives. Mozilla's engineers triaged the reports, wrote the fixes and shipped them. The count is Mozilla's own."},"evidence":[{"kind":"report","citation":"Mozilla, The zero-days are numbered, Mozilla blog, April 2026.","title":"The zero-days are numbered","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","date":null,"written_by":"deployer","quote":"As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week's release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation."},{"kind":"report","citation":"Mozilla, The zero-days are numbered, Mozilla blog, April 2026. On the earlier scan.","title":"The zero-days are numbered","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","date":null,"written_by":"deployer","quote":"which led to fixes for 22 security-sensitive bugs in Firefox 148"},{"kind":"report","citation":"Grinstead, B., Holler, C. et al., Behind the scenes: hardening Firefox with Claude Mythos Preview, Mozilla Hacks, May 2026.","title":"Behind the Scenes: Hardening Firefox with Claude Mythos Preview","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","date":null,"written_by":"deployer","quote":"Of the 271 bugs we announced for Firefox 150: 180 were sec-high, 80 were sec-moderate, and 11 were sec-low."},{"kind":"report","citation":"Grinstead, B., Holler, C. et al., Behind the scenes: hardening Firefox with Claude Mythos Preview, Mozilla Hacks, May 2026. On the other bug hunting.","title":"Behind the Scenes: Hardening Firefox with Claude Mythos Preview","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","date":null,"written_by":"deployer","quote":"That's because our security team hunts for new bugs every day by attacking Firefox with a combination of (a) fuzzing systems (b) manual inspection and (c) this new agentic pipeline across a variety of models.","supports_benefit":false},{"kind":"report","citation":"Anthropic, Project Glasswing: an initial update, 2026.","title":"Project Glasswing: An initial update","url":"https://www.anthropic.com/news/glasswing-initial-update","date":null,"written_by":"makers","quote":"Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview"},{"kind":"news report","citation":"Privacy Guides, 22 April 2026, relaying Mozilla's announcement.","title":"Mozilla Used Mythos to Fix 271 Firefox Bugs","url":"https://privacyguides.org/news/2026/04/22/mozilla-used-mythos-to-fix-271-firefox-bugs","date":"2026-04-22","written_by":"deployer","quote":"Mozilla has announced that Firefox 150 (set to be released this week) will include fixes for 271 bugs found using Anthropic's"}],"replication":{"produced_by":["A large language model applied to a browser's code in an agentic pipeline that finds bugs, writes test cases and describes their impact","A maintainer whose security team deduplicated, triaged and fixed the reports"],"must_hold":["The maintainer must triage reports and ship fixes before attackers find the same flaws","The pipeline must deduplicate against known issues and produce few false positives"],"echoes":[]},"paired_incident":null,"headline":"Mozilla fixes 271 Firefox flaws that *Claude Mythos Preview* found","metric":"271 vulnerabilities","comparator":{"against":"the scan of Firefox with Claude Opus 4.6","before":"fixes for 22 security-sensitive bugs in Firefox 148","after":"fixes for 271 vulnerabilities in Firefox 150","basis":"measured","quote":"which led to fixes for 22 security-sensitive bugs in Firefox 148","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/"},"later":{"status":"scaled","date":null,"note":"In May 2026 Mozilla wrote that further fixes from the evaluation shipped in 149.0.2, 150.0.1 and 150.0.2.","quote":"In addition to fixing the 271 bugs identified by Claude Mythos Preview in the 150 release , we've shipped more of these fixes in 149.0.2 , 150.0.1 , and 150.0.2 .","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/"},"learns_from_data":{"value":"shown","note":"Anthropic describes Claude Mythos Preview as a model that it tested on finding and exploiting vulnerabilities.","quote":"During our testing, we found that Mythos Preview is capable of identifying and then exploiting zero-day vulnerabilities","url":"https://red.anthropic.com/2026/mythos-preview/"},"benefit_categories":["privacy_protection"],"size":{"reach":{"band":1,"fact":"One organization, Mozilla, fixed the flaws in Firefox.","quote":"As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week's release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation.","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","reason":null},"duration":{"band":5,"fact":"A fixed flaw stays fixed in the browser's code, a hazard removed for good.","quote":"Of the 271 bugs we announced for Firefox 150: 180 were sec-high, 80 were sec-moderate, and 11 were sec-low.","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","reason":null},"distribution":{"band":null,"fact":null,"quote":null,"url":null,"reason":"The benefit went to one software project, and no groups are compared."},"frequency":{"band":1,"fact":"One evaluation found the flaws, and Mozilla fixed them in one release.","quote":"As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week's release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation.","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","reason":null}},"value":null,"developer_country":"United States","deployer_country":"United States","unrated_because":null,"brief_notes":null,"brief":null,"confidence":"claimed","shade":"low","claim_status":"The deployer's account","claim_basis":"Sources: the makers' report, two reports from the deployer and the deployer's news report. For the benefit itself, the cited sources include no independent source and no finding by an external body.","case_jurisdictions":[],"design":null,"certainty":null,"certainty_reasons":[],"profile":{"case_id":"AIBD-1237","source_ids":["AIBD-1237-source-0001","AIBD-1237-source-0002","AIBD-1237-source-0003","AIBD-1237-source-0004","AIBD-1237-source-0005","AIBD-1237-source-0006"],"families":{"strategic assessments":{"state":"unresolved","record_ids":[]},"evaluations":{"state":"unresolved","record_ids":[]},"monetary observations":{"state":"unresolved","record_ids":[]},"institutional decisions":{"state":"unresolved","record_ids":[]}},"fields":{"actors[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"developer":"Anthropic","deployer":"Mozilla (Firefox security team)"}}},"actors[].ownership_control":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"ai_contribution":{"state":"value_present","value":{"kind":"record_fields","fields":{"ai_role":{"status":"assessed","statement":"Mozilla says that the model identified the 271 vulnerabilities and that its reports produced few false positives. Mozilla's engineers triaged the reports, wrote the fixes and shipped them. The count is Mozilla's own."}}}},"ai_relationship":{"state":"value_present","value":{"kind":"record_fields","fields":{"category":"protective response","ai_role":{"status":"assessed","statement":"Mozilla says that the model identified the 271 vulnerabilities and that its reports produced few false positives. Mozilla's engineers triaged the reports, wrote the fixes and shipped them. The count is Mozilla's own."}}}},"assessments[].alternatives":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].assessor_date":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].depth":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed 271 vulnerabilities that the model identified, 180 of them rated high, in one release."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"assessments[].display_confidence":{"state":"value_present","value":{"kind":"structured","data":{"confidence":"low","evidence_word":"claimed","claim_status":"The deployer's account","basis":"Sources: the makers' report, two reports from the deployer and the deployer's news report. For the benefit itself, the cited sources include no independent source and no finding by an external body.","interpretation":"Existing display rule preserved; the richer outcome-specific confidence question still needs review."}}},"assessments[].rationale":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed 271 vulnerabilities that the model identified, 180 of them rated high, in one release."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"assessments[].rubric_version":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].status_basis":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"assessments[].target":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed 271 vulnerabilities that the model identified, 180 of them rated high, in one release."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"availability":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"brief":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"case_kind":{"state":"value_present","value":{"kind":"structured","data":{"classification":"deployment","answer":"A deployment. Mozilla ran the model against a real, released browser and shipped the fixes.","scope":"The period and activity described in the case."}},"display":{"answer":"A deployment. Mozilla ran the model against a real, released browser and shipped the fixes.","inferred":false},"source_refs":["AIBD-1237-source-0001"]},"case_links[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"claims[].evidence_links":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"claims[].evidence_strength":{"state":"value_present","value":{"kind":"structured","data":{"answer":"The deployer's account. Sources: the makers' report, two reports from the deployer and the deployer's news report. For the benefit itself, the cited sources include no independent source and no finding by an external body.","evidence_word":"claimed","claim_status":"The deployer's account"}},"display":{"answer":"The deployer's account. Sources: the makers' report, two reports from the deployer and the deployer's news report. For the benefit itself, the cited sources include no independent source and no finding by an external body.","inferred":false},"source_refs":["AIBD-1237-source-0001","AIBD-1237-source-0002","AIBD-1237-source-0003","AIBD-1237-source-0004","AIBD-1237-source-0005","AIBD-1237-source-0006"]},"claims[].missingness":{"state":"value_present","value":{"kind":"text","text":"The count of 271 is Mozilla's own, and Mozilla has not described most of the individual bugs. Its team also hunts for bugs by fuzzing, by inspection and with other models, and fixed 423 security bugs in April in all, so the model's share of Firefox's hardening is not separated."},"display":{"answer":"The count of 271 is Mozilla's own, and Mozilla has not described most of the individual bugs. Its team also hunts for bugs by fuzzing, by inspection and with other models, and fixed 423 security bugs in April in all, so the model's share of Firefox's hardening is not separated.","inferred":false},"source_refs":["AIBD-1237-source-0003"]},"claims[].proposition":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"cross_border_flows[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"decisions[].action_outcome":{"state":"unresolved","family":"institutional decisions"},"decisions[].grounds":{"state":"unresolved","family":"institutional decisions"},"decisions[].institution_task":{"state":"unresolved","family":"institutional decisions"},"decisions[].success_criterion":{"state":"unresolved","family":"institutional decisions"},"deployment_stage":{"state":"value_present","value":{"kind":"structured","data":{"classification":"pilot","answer":"The system was used in a pilot. Mozilla applied an early version of the model in an initial evaluation.","scope":"The period and activity described in the case."}},"display":{"answer":"The system was used in a pilot. Mozilla applied an early version of the model in an initial evaluation.","inferred":false},"source_refs":["AIBD-1237-source-0001"]},"economics[].amount":{"state":"unresolved","family":"monetary observations"},"economics[].costs[]":{"state":"unresolved","family":"monetary observations"},"economics[].counterfactual":{"state":"unresolved","family":"monetary observations"},"economics[].currency_price_basis":{"state":"unresolved","family":"monetary observations"},"economics[].gross_net":{"state":"unresolved","family":"monetary observations"},"economics[].measure_type":{"state":"unresolved","family":"monetary observations"},"economics[].period_unit":{"state":"unresolved","family":"monetary observations"},"economics[].realization":{"state":"unresolved","family":"monetary observations"},"economics[].recipient_payer":{"state":"unresolved","family":"monetary observations"},"economics[].return_payback":{"state":"unresolved","family":"monetary observations"},"economics[].valuation_method":{"state":"unresolved","family":"monetary observations"},"evaluations[].ai_uplift":{"state":"unresolved","family":"evaluations"},"evaluations[].comparator":{"state":"unresolved","family":"evaluations"},"evaluations[].design":{"state":"unresolved","family":"evaluations"},"evaluations[].effect":{"state":"unresolved","family":"evaluations"},"evaluations[].exposure":{"state":"unresolved","family":"evaluations"},"evaluations[].id":{"state":"unresolved","family":"evaluations"},"evaluations[].measurement_method":{"state":"unresolved","family":"evaluations"},"evaluations[].metric":{"state":"unresolved","family":"evaluations"},"evaluations[].reproduction_materials":{"state":"unresolved","family":"evaluations"},"evaluations[].setting_sample":{"state":"unresolved","family":"evaluations"},"evaluations[].uncertainty_limitations":{"state":"unresolved","family":"evaluations"},"external_references[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"follow_up[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"later":{"status":"scaled","note":"In May 2026 Mozilla wrote that further fixes from the evaluation shipped in 149.0.2, 150.0.1 and 150.0.2.","quote":"In addition to fixing the 271 bugs identified by Claude Mythos Preview in the 150 release , we've shipped more of these fixes in 149.0.2 , 150.0.1 , and 150.0.2 .","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/"}}}},"human_oversight":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"id":{"state":"value_present","value":{"kind":"record_fields","fields":{"id":"AIBD-1237"}}},"infrastructure_dependencies[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].beneficiaries":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].beneficiary_count":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].claim":{"state":"value_present","value":{"kind":"record_fields","fields":{"account":"Mozilla began working with Anthropic in February 2026. A scan of Firefox with Claude Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148. Mozilla then applied an early version of Claude Mythos Preview to Firefox. Firefox 150, released on 21 April 2026, fixes 271 vulnerabilities identified during that initial evaluation. In May, Mozilla's engineers wrote that 180 of the 271 were rated high, 80 moderate and 11 low, and that the model's reports produced few false positives. The same post says that Mozilla fixed 423 security bugs in its April releases in all, since its security team also hunts for bugs by fuzzing, by manual inspection and with other models, and that further fixes from the evaluation shipped in 149.0.2, 150.0.1 and 150.0.2. Anthropic cites the result in its Project Glasswing update. Privacy Guides reported the announcement on 22 April 2026. The count of 271 is Mozilla's own, and Mozilla has not described most of the individual bugs."}}},"outcomes[].distribution":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].duration":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].id":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"outcomes[].stakeholder_group":{"state":"value_present","value":{"kind":"record_fields","fields":{"ratings":[{"group":"organizational","depth":2,"reason":"Mozilla fixed 271 vulnerabilities that the model identified, 180 of them rated high, in one release."},{"group":"societal","reason":"No outcome for Firefox users beyond the fixes is documented, and no source reports that any of the flaws was exploited."}]}}},"outcomes[].status":{"state":"value_present","value":{"kind":"record_fields","fields":{"benefit_status":"reported"}}},"outcomes[].tradeoffs":{"state":"value_present","value":{"kind":"text","text":"No costs or harms are reported in the sources."},"display":{"answer":"No costs or harms are reported in the sources.","inferred":false},"source_refs":["AIBD-1237-source-0001","AIBD-1237-source-0002","AIBD-1237-source-0003","AIBD-1237-source-0004","AIBD-1237-source-0005","AIBD-1237-source-0006"]},"outcomes[].unexpected":{"state":"value_present","value":{"kind":"record_fields","fields":{"unexpected":false,"purpose":"Mozilla applied Claude Mythos Preview to Firefox's code to find security vulnerabilities before attackers do."}}},"places[]":{"state":"value_present","value":{"kind":"record_fields","fields":{"developer_country":"United States","deployer_country":"United States"}}},"purpose":{"state":"value_present","value":{"kind":"record_fields","fields":{"purpose":"Mozilla applied Claude Mythos Preview to Firefox's code to find security vulnerabilities before attackers do."}}},"record_dates":{"state":"value_present","value":{"kind":"record_fields","fields":{"date_observed":"2026-04-21","date_basis":"event","date_precision":"day"}}},"replication.attempts[]":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"replication.conditions":{"state":"value_present","value":{"kind":"record_fields","fields":{"replication":{"produced_by":["A large language model applied to a browser's code in an agentic pipeline that finds bugs, writes test cases and describes their impact","A maintainer whose security team deduplicated, triaged and fixed the reports"],"must_hold":["The maintainer must triage reports and ship fixes before attackers find the same flaws","The pipeline must deduplicate against known issues and produce few false positives"],"echoes":[]}}}},"sector":{"state":"value_present","value":{"kind":"record_fields","fields":{"domain":"Cybersecurity / vulnerability research","segment":"Technology"}}},"sources[].access_version":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"sources[].citation_locator":{"state":"value_present","value":{"kind":"record_fields","fields":{"evidence":[{"kind":"report","citation":"Mozilla, The zero-days are numbered, Mozilla blog, April 2026.","title":"The zero-days are numbered","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","written_by":"deployer","quote":"As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week's release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation."},{"kind":"report","citation":"Mozilla, The zero-days are numbered, Mozilla blog, April 2026. On the earlier scan.","title":"The zero-days are numbered","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","written_by":"deployer","quote":"which led to fixes for 22 security-sensitive bugs in Firefox 148"},{"kind":"report","citation":"Grinstead, B., Holler, C. et al., Behind the scenes: hardening Firefox with Claude Mythos Preview, Mozilla Hacks, May 2026.","title":"Behind the Scenes: Hardening Firefox with Claude Mythos Preview","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","written_by":"deployer","quote":"Of the 271 bugs we announced for Firefox 150: 180 were sec-high, 80 were sec-moderate, and 11 were sec-low."},{"kind":"report","citation":"Grinstead, B., Holler, C. et al., Behind the scenes: hardening Firefox with Claude Mythos Preview, Mozilla Hacks, May 2026. On the other bug hunting.","title":"Behind the Scenes: Hardening Firefox with Claude Mythos Preview","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","written_by":"deployer","quote":"That's because our security team hunts for new bugs every day by attacking Firefox with a combination of (a) fuzzing systems (b) manual inspection and (c) this new agentic pipeline across a variety of models.","supports_benefit":false},{"kind":"report","citation":"Anthropic, Project Glasswing: an initial update, 2026.","title":"Project Glasswing: An initial update","url":"https://www.anthropic.com/news/glasswing-initial-update","written_by":"makers","quote":"Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview"},{"kind":"news report","citation":"Privacy Guides, 22 April 2026, relaying Mozilla's announcement.","title":"Mozilla Used Mythos to Fix 271 Firefox Bugs","url":"https://privacyguides.org/news/2026/04/22/mozilla-used-mythos-to-fix-271-firefox-bugs","date":"2026-04-22","written_by":"deployer","quote":"Mozilla has announced that Firefox 150 (set to be released this week) will include fixes for 271 bugs found using Anthropic's"}]}}},"sources[].id":{"state":"value_present","value":{"kind":"identifiers","identifiers":["AIBD-1237-source-0001","AIBD-1237-source-0002","AIBD-1237-source-0003","AIBD-1237-source-0004","AIBD-1237-source-0005","AIBD-1237-source-0006"],"role":"Existing evidence items, in their original order"}},"sources[].language":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"sources[].relationship":{"state":"value_present","value":{"kind":"record_fields","fields":{"evidence":[{"kind":"report","citation":"Mozilla, The zero-days are numbered, Mozilla blog, April 2026.","title":"The zero-days are numbered","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","written_by":"deployer","quote":"As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week's release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation."},{"kind":"report","citation":"Mozilla, The zero-days are numbered, Mozilla blog, April 2026. On the earlier scan.","title":"The zero-days are numbered","url":"https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/","written_by":"deployer","quote":"which led to fixes for 22 security-sensitive bugs in Firefox 148"},{"kind":"report","citation":"Grinstead, B., Holler, C. et al., Behind the scenes: hardening Firefox with Claude Mythos Preview, Mozilla Hacks, May 2026.","title":"Behind the Scenes: Hardening Firefox with Claude Mythos Preview","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","written_by":"deployer","quote":"Of the 271 bugs we announced for Firefox 150: 180 were sec-high, 80 were sec-moderate, and 11 were sec-low."},{"kind":"report","citation":"Grinstead, B., Holler, C. et al., Behind the scenes: hardening Firefox with Claude Mythos Preview, Mozilla Hacks, May 2026. On the other bug hunting.","title":"Behind the Scenes: Hardening Firefox with Claude Mythos Preview","url":"https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/","written_by":"deployer","quote":"That's because our security team hunts for new bugs every day by attacking Firefox with a combination of (a) fuzzing systems (b) manual inspection and (c) this new agentic pipeline across a variety of models.","supports_benefit":false},{"kind":"report","citation":"Anthropic, Project Glasswing: an initial update, 2026.","title":"Project Glasswing: An initial update","url":"https://www.anthropic.com/news/glasswing-initial-update","written_by":"makers","quote":"Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview"},{"kind":"news report","citation":"Privacy Guides, 22 April 2026, relaying Mozilla's announcement.","title":"Mozilla Used Mythos to Fix 271 Firefox Bugs","url":"https://privacyguides.org/news/2026/04/22/mozilla-used-mythos-to-fix-271-firefox-bugs","date":"2026-04-22","written_by":"deployer","quote":"Mozilla has announced that Firefox 150 (set to be released this week) will include fixes for 271 bugs found using Anthropic's"}]}}},"sources[].upstream_sources":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"strategic_assessments[]":{"state":"unresolved","family":"strategic assessments"},"summary":{"state":"value_present","value":{"kind":"record_fields","fields":{"summary":"Mozilla says that Firefox 150 fixes 271 vulnerabilities that an early version of Claude Mythos Preview identified in an initial evaluation: 180 rated high, 80 moderate and 11 low.","account":"Mozilla began working with Anthropic in February 2026. A scan of Firefox with Claude Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148. Mozilla then applied an early version of Claude Mythos Preview to Firefox. Firefox 150, released on 21 April 2026, fixes 271 vulnerabilities identified during that initial evaluation. In May, Mozilla's engineers wrote that 180 of the 271 were rated high, 80 moderate and 11 low, and that the model's reports produced few false positives. The same post says that Mozilla fixed 423 security bugs in its April releases in all, since its security team also hunts for bugs by fuzzing, by manual inspection and with other models, and that further fixes from the evaluation shipped in 149.0.2, 150.0.1 and 150.0.2. Anthropic cites the result in its Project Glasswing update. Privacy Guides reported the announcement on 22 April 2026. The count of 271 is Mozilla's own, and Mozilla has not described most of the individual bugs."}}},"systems[].autonomy_permissions":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].component_role":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].deployment_configuration":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].inputs_outputs":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].model_name":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"systems[].model_version":{"state":"value_present","value":{"kind":"record_fields","fields":{"model_version":"early version of Claude Mythos Preview"}}},"systems[].product_name":{"state":"value_present","value":{"kind":"record_fields","fields":{"system":"Claude Mythos Preview"}}},"systems[].provider":{"state":"unresolved","reason":"This is an explicit unresolved assignment: the sources on record do not settle this question."},"title":{"state":"value_present","value":{"kind":"record_fields","fields":{"title":"Mozilla fixes 271 vulnerabilities in Firefox 150 that an early version of Anthropic's Claude Mythos Preview identified in an initial evaluation, after a scan with Claude Opus 4.6 had led to 22 fixes in Firefox 148","headline":"Mozilla fixes 271 Firefox flaws that *Claude Mythos Preview* found"}}},"workflow":{"state":"value_present","value":{"kind":"record_fields","fields":{"account":"Mozilla began working with Anthropic in February 2026. A scan of Firefox with Claude Opus 4.6 led to fixes for 22 security-sensitive bugs in Firefox 148. Mozilla then applied an early version of Claude Mythos Preview to Firefox. Firefox 150, released on 21 April 2026, fixes 271 vulnerabilities identified during that initial evaluation. In May, Mozilla's engineers wrote that 180 of the 271 were rated high, 80 moderate and 11 low, and that the model's reports produced few false positives. The same post says that Mozilla fixed 423 security bugs in its April releases in all, since its security team also hunts for bugs by fuzzing, by manual inspection and with other models, and that further fixes from the evaluation shipped in 149.0.2, 150.0.1 and 150.0.2. Anthropic cites the result in its Project Glasswing update. Privacy Guides reported the announcement on 22 April 2026. The count of 271 is Mozilla's own, and Mozilla has not described most of the individual bugs.","replication":{"produced_by":["A large language model applied to a browser's code in an agentic pipeline that finds bugs, writes test cases and describes their impact","A maintainer whose security team deduplicated, triaged and fixed the reports"],"must_hold":["The maintainer must triage reports and ship fixes before attackers find the same flaws","The pipeline must deduplicate against known issues and produce few false positives"],"echoes":[]}}}}}}}