Firefox says LLM-driven bug discovery became its largest source of security reports

40C3 halfnarp – Submit talk preferences to aid scheduling

In the first eight months of 2026, LLM-driven bug discovery using models like Claude Mythos Preview became Firefox's largest source of security bugs, with reports rising more than sevenfold. Mozilla's own threat-model-guided tooling produced easily reproducible reports for hard-to-fuzz vulnerabilities, including sandbox escapes. The volume exposed bottlenecks across the development lifecycle, but automated verification let Mozilla fix more bugs per release than ever—and ahead of Pwn2Own 2026, pre-event fixes forced several contestants to withdraw.