When AI Finds Vulnerabilities Faster Than Humans: A Dramatic Leap in Application Security
Anthropic’s new AI model, Claude Mythos Preview, has successfully identified no fewer than 271 Zero-Day vulnerabilities in the Firefox browser—all of which were patched in a single version. This is an unprecedented figure, especially when compared to Mozilla’s annual data, which showed handling only about 73 critical vulnerabilities throughout the entirety of 2025.
The discovery was made as part of a collaboration between Mozilla and Anthropic, utilizing AI models for large-scale code scanning. Earlier on, a previous model (Claude Opus 4.6) managed to identify dozens of vulnerabilities in just two weeks, but Mythos has raised the bar dramatically. The implication is clear: AI is no longer just a supporting tool but a central engine for detecting code weaknesses.
What has truly changed—and why is it so significant?
Moving from vulnerability identification to understanding and exploitation
Claude Mythos does not just identify vulnerabilities; it also manages to effectively exploit them. According to the data, the model successfully converted approximately 72% of the discovered weaknesses into active exploits, in some cases even gaining control over system components.
Furthermore, it managed to uncover exceptionally old vulnerabilities—including decades-old bugs in systems such as OpenBSD and FreeBSD. In other words, even code that has been audited for years by experts and automated tools is not immune to advanced AI capabilities. This represents a profound shift: the AI’s ability to understand context, analyze dependencies between components, and build attack scenarios brings defensive capabilities closer to those of attackers.
Implications for Organizations: An Advantage for Defenders—But Not for Long
Why this isn’t necessarily just good news
On one hand, tools like Mythos allow organizations to identify and remediate vulnerabilities faster than ever, narrowing the “window of opportunity” for attackers. On the other hand, these exact same capabilities will—sooner or later—be available to the attacking side as well. This means the gap between discovery and exploitation is shrinking, and the requirements for organizations are changing:
• Code audits must be continuous, not periodic.
• DevSecOps processes must be more deeply integrated into development.
• A shift is required from reactive vulnerability management to proactive risk management.
Ultimately, AI is changing the rules of the game but does not eliminate the need for proper security architecture.
Recommendations from IPV Security Information Security Experts:
1. Integration of AI tools in code scans as part of the ongoing development process.
2. Strengthening Code Review processes with an emphasis on business logic.
3. Reducing Mean Time to Remediation (MTTR) through automation and priority management.
4. Continuous monitoring of open-source dependencies and third-party libraries.
5. Preparing for scenarios where attackers use similar tools.
In conclusion, a new era in code security is already here. The ability of AI to identify hundreds of vulnerabilities in a short time changes the balance of power between attackers and defenders. However, this advantage will only be temporary; organizations that know how to correctly implement these tools will be the ones to stay one step ahead.
For further information: Claude Mythos AI Model Uncovers 271 Zero-Day Vulnerabilities in Firefox
Interested in consulting with an expert? Contact the experts at IPV Security!
For professional consultation, you can reach us via email at info@ipvsecurity.com or by phone at 077-4447130.
IPV Security has specialized for 21 years in information security, cyber, risk assessments, and standards and regulations relating to data security and more.