Post
Mozilla has provided behind-the-scenes details on the 271 vulnerabilities it discovered with the help of Mythos. Those details include full Bugzilla reports on 12 of the vulnerabilities. I'd be curious for people to look at the reports and hear what they think.
https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/
@dangoodin to put the achievement in perspective, I'd like to know how much power was used to get this result, training included. But that unsexy point is seldom discussed.
That's a consideration I regret not thinking of during the interview. (I've sent an email seeing if I can get it answered now.) That said, if deep-pocketed threat actors pay whatever the cost is and get a ton of useful results, it seems like devs will have to incur the same cost if their users are to stay safe.
@dangoodin I looked at the first one and although I don't know the codebase at all so am missing context, I think I understand it partly (I am a good c++ programmer ) and it certainly looks real to me. There is also discussion on the bugzilla where a developer acknowledges they introduced the bug when doing code cleanup.
@dangoodin second that. Sharing for visibility
@dangoodin I... 12 is not a bad number but like...
Note that a number of these bugs are sandbox escapes, which would need to be combined with other exploits to achieve a full-chain Firefox compromise
if they had paid the 20k to a professional code auditor they would have found more... dangerous and relevant exploits
Anyone building software can start using a harness with a modern model to find bugs and harden their code today. We recommend getting started now. You will find bugs, and you will set yourself up to take advantage of new models as soon as they become available.
this sound straight up off of a entry-level "advertising 101" book...
also I looked at some of the bug repports and... meh
@passocacornio @dangoodin
Its hard to judge without all of them. 12 is what was released.
Yes, that's true. What I want to know is, what's the quality of the 12?
@michaelh @dangoodin since this one is more of an advertising piece than an actual post-morten... those are the best ones they could find
OK, assuming that's true, what's the quality of them?
@dangoodin I... 12 is not a bad number but like...
Note that a number of these bugs are sandbox escapes, which would need to be combined with other exploits to achieve a full-chain Firefox compromise
if they had paid the 20k to a professional code auditor they would have found more... dangerous and relevant exploits
Anyone building software can start using a harness with a modern model to find bugs and harden their code today. We recommend getting started now. You will find bugs, and you will set yourself up to take advantage of new models as soon as they become available.
this sound straight up off of a entry-level "advertising 101" book...
also I looked at some of the bug repports and... meh
@dangoodin I'd take the numbers with a grain of salt. Anything that helps find more is good imho.
Also I wonder what the average exploit/$ is across different projects as a whole.
Thank you
@dangoodin considering the mythos papers that anthropic wrote which said they found hundreds, mozilla confirming less than 10% of those seems to me like a desperate grasping at straws by anthropic to somehow prove they werent lying through their teeth with their writeup
So, nobody is even going to take a look?
@dangoodin @Viss Not me. I have negative levels of trust in Mozilla at the moment.
No, not the folks waiting for the burn!
Zero days don't matter
AI is a fad
If we ignore the new attack surface and vector it will go away.
@dangoodin at this point its pretty hard to trust anthropic at their word, and since it was mozilla that they were 'working for', and now mozilla has fallen into the ai deep end, i wager it'll be another one of these:
did you see this writeup?
Install bonfire.cafe
Get the full app experience
