How Claude Mythos found a 15-year-old bug in Mozilla Firefox | Brian Grinstead

Firefox has tens of thousands of source code files and tens of millions of lines of code. It's not possible to say, one shot, go find all the potential bugs in this project. It's way too much context for the model. I think people really underappreciate the relentless tedium that an agent will go through. Anybody who's done this kind of what I call archeology, it's really hard to do. And this is something that the coding agents are great at. I asked Cloud Code, go figure out semantically when this bug was introduced. I was, like, watching it do get commands I didn't even know existed. And the ability to take an agent and give it a very constrained problem in the surface area and say exhaust every attempt at this is really powerful. Again, not because human intelligence couldn't identify similar issues that actually are, like, cognitive energy declines over time in a way that agents don't. Our goal is not to have a bunch of bugs that are hard to find. Our goal is to have zero bugs. And so I think that these tools, as us and other defenders are starting to apply them, actually get us closer to that world. Welcome back to How I AI. I'm Claire Vaux, product leader and AI obsessive here on a mission to help you build better with these new tools. Today, I have Brian Grinstead, distinguished engineer at Mozilla Firefox, who's gonna take us behind the scenes with their experience with Anthropic's new but not yet fully released model Mythos and how they solved almost 500 security bugs by rolling their own harness, which isn't as complicated as you think. Let's get to it. This episode is brought to you by WorkOS. AI has already changed how we work. Tools are helping teams write better code, analyze customer data, and even handle support tickets automatically. But there's a catch. These tools only work well when they have deep access to company systems. Your Copilot needs to see your entire code base. Your chatbot needs to search across internal docs. And for enterprise buyers, that raises serious security concerns. That's why these apps face intense IT scrutiny from day one. To pass, they need secure authentication, access controls, audit logs, the whole suite of enterprise features. Building all that from scratch, it's a massive lift. That's where WorkOS comes in. WorkOS gives you drop in APIs for enterprise features so your app can become enterprise ready and scale up market faster. Think of it like Stripe for enterprise features. OpenAI, Perplexity, and Cursor are already using Work OS to move faster and meet enterprise demands. Join them and hundreds of other industry leaders at workos.com. Start building today. Brian, welcome to How I AI. I'm really excited about this episode because I think you have one of the most impactful stories in AI engineering right now. So tell me first, let's take a step back. For people, what is …