Mozilla used Anthropic’s Mythos Preview model to scan Firefox 150’s unreleased source code and flagged 271 security vulnerabilities before release. That’s a big jump from the 22 bugs found by Anthropic’s earlier Opus 4.6 model on Firefox 148, cutting out months of manual auditing.

• Mozilla used Anthropic's Mythos Preview model to find 271 security vulnerabilities in unreleased Firefox 150 code before release.
• That's a 12x jump from the 22 bugs Anthropic's Opus 4.6 model found in Firefox 148 the prior month.
• Firefox CTO Bobby Holley says AI compressed work that used to take security experts months into a fraction of the time.
• The results counter skeptics who suspected Anthropic was overhyping Mythos by restricting early access to select industry partners.

The article discusses a recent supply chain attack involving the popular Axios package, highlighting how an attacker installed malware without altering the original code. It emphasizes the challenges posed by AI in both coding and attacking, as automated systems can easily introduce vulnerabilities faster than traditional security measures can respond.

• Attackers hijacked a maintainer account and slipped a self-deleting RAT into Axios (100M+ weekly downloads) via a malicious dependency, leaving no CVE for traditional scanners to catch.
• AI coding agents are 50% more likely than humans to pick known-vulnerable dependencies and often hallucinate package names that attackers exploit via "slopsquatting."
• Attacks have shifted from targeting single packages to automated, ecosystem-wide worms, like the TeamPCP campaign that spread through 66 npm packages in days.
• Socket detected the malicious Axios dependency in 6 minutes by analyzing code behavior, versus the industry-average 267 days for breach detection.