借助Claude Mythos Preview，Mozilla在幕后强化Firefox安全
Behind the Scenes Hardening Firefox with Claude Mythos Preview
Mozilla利用Claude Mythos Preview模型，成功定位并修复了Firefox中的数百个安全漏洞。此前AI生成的漏洞报告多为低质量信息，但随着模型能力提升及技术方法改进，报告质量发生显著变化。修复的漏洞包括一个存在20年的XSLT漏洞和一个长达15年的`<legend>`元素漏洞。值得注意的是，许多自动化攻击尝试已被Firefox现有的深度防御机制拦截。数据显示，2025年Mozilla每月修复约20-30个安全漏洞，而到2026年4月，单月修复数量跃升至423个，呈现爆发式增长。
Simon Willison’s Weblog
7th May 2026 - Link Blog
Behind the Scenes Hardening Firefox with Claude Mythos Preview (via) Fascinating, in-depth details on how Mozilla used their access to the Claude Mythos preview to locate and then fix hundreds of vulnerabilities in Firefox:
Suddenly, the bugs are very good
Just a few months ago, AI-generated security bug reports to open source projects were mostly known for being unwanted slop. Dealing with reports that look plausibly correct but are wrong imposes an asymmetric cost on project maintainers: it’s cheap and easy to prompt an LLM to find a “problem” in code, but slow and expensive to respond to it.
It is difficult to overstate how much this dynamic changed for us over a few short months. This was due to a combination of two main factors. First, the models got a lot more capable. Second, we dramatically improved our techniques for harnessing these models — steering them, scaling them, and stacking them to generate large amounts of signal and filter out the noise.
They include some detailed bug descriptions too, including a 20-year old XSLT bug and a 15-year-old bug in the <legend> element.
A lot of the attempts made by the harness were blocked by Firefox's existing defense-in-depth measures, which is reassuring.
Mozilla were fixing around 20-30 security bugs in Firefox per month through 2025. That jumped to 423 in April.
7th May 2026
来源：Simon Willison 博客 · simonwillison.net