Mozilla says 271 vulnerabilities found by Mythos have 'almost no false positives'

Mozilla, the nonprofit foundation behind the Firefox browser, has expanded its security engineering pipeline with a new AI-assisted tool. The system, named Mythos, scans millions of lines of C++ and Rust code to surface memory-safety and input-validation flaws. The organization says nearly all of the 271 vulnerabilities it flagged were confirmed as real bugs after human review.

Mozilla argues that conventional static analyzers have long burned engineering time with high false-positive rates. Mythos pairs a large language model with data-flow analysis and symbolic execution to prioritize which reports actually represent an exploitable attack vector. The foundation said a significant share of the resulting patches addressed critical or high-severity issues, many closed before external researchers under bug-bounty programs found them.

Firefox is among the first large open-source projects to say it has 'completely bought in' on AI-assisted bug discovery. Google's Big Sleep and Microsoft's Copilot Security efforts pursue a similar approach, although their false-positive rates have not been publicly detailed in comparable terms. Mozilla said it would publish Mythos's methodology and bug taxonomy for outside researchers in the coming weeks.