Using AI for self-diagnosis, Mozilla discovered 271 zero-day vulnerabilities in Firefox.

Mozilla says that early access to Mythos Preview helped them identify 271 security vulnerabilities in this week's Firefox 150 release.

Earlier this month, Anthropic said its Mythos Preview model was so good at finding cybersecurity vulnerabilities that the company limited the initial release to “a small group of key industry partners.”

Since then, debate has raged over whether this model heralds an era of AI-powered cyberattacks at breakneck speed, or whether Anthropic is simply drawing attention to a relatively normal step in the development of AI capabilities.

Mythos preview has helped uncover a number of security vulnerabilities in Firefox.

On Tuesday, Mozilla added some crucial data to that debate, writing in a blog post that early access to Mythos Preview helped them identify 271 security vulnerabilities in this week's Firefox 150 release.

This result was significant enough to prompt Firefox's Chief Technology Officer, Bobby Holley, to enthusiastically declare that, in the never-ending battle between cyber attackers and defenders, "defenders finally have a chance to win decisively."

Holley didn't go into detail about the severity of the hundreds of vulnerabilities that Mythos allegedly discovered simply by analyzing unreleased source code of the latest version of Firefox.

But for comparison, he noted that Anthropic's Opus 4.6 model found only 22 security-sensitive flaws when analyzing Firefox 148 last month.

Holley wrote that the vulnerabilities identified by Mythos could also be discovered using automated "fuzzing" techniques or by having a "top security researcher" analyze the browser's complex source code.

But the use of Mythos has eliminated the need to "focus months of costly human effort on finding a single error" in many cases, Holley added.

Among the vulnerabilities discovered in Firefox, Mythos successfully exploited them with a success rate of 72.4%.

By identifying vulnerabilities so efficiently, AI tools like Mythos tip the balance of cybersecurity toward defenders, who benefit as vulnerability discovery becomes cheaper for both sides.

Overcoming the challenge of AI-powered defenses can be particularly important for open-source projects, the foundation of much of the modern internet. This is because their publicly available source code is vulnerable to exploitation by AI systems searching for flaws, and because many such projects rely on volunteer maintenance that is insufficient to guarantee security.

In an essay in the New York Times last week, Mozilla's chief technology officer, Raffi Krikorian, argued that the human difficulty of simultaneously finding bugs and writing complex software created a balance in cyber threat research that Mythos could completely disrupt.

Ali Ansari, the Iranian founder and CEO of Micro1, was one of the first to share information and reviews about the Claude Mythos Preview. Ansari has emerged as someone who conducts in-depth assessments of the capabilities of new large language models (LLMs), especially those with programmable and cyber-attack capabilities.

Ansari has publicly shared on social media results showing that Claude Mythos is capable of carrying out cyberattacks, finding security vulnerabilities, and even taking control of network systems from end to end—capabilities that Anthropic is restricting from being widely released due to security concerns.

This GenZ CEO also tried using Mythos to attack Firefox, and the AI ​​was successful in exploiting 72.4% of the vulnerabilities discovered.

​

​

Mozilla, Arstechnica, Redhat

Source: https://khoahocdoisong.vn/tu-kham-bang-ai-mozilla-phat-hien-271-loi-zero-day-บน-firefox-post2149097730.html