Claire Vo · 2 min read · Gen AI Tools
How Claude Mythos found a 15-year-old bug in Mozilla Firefox | Brian Grinstead
Read the original on lennysnewsletter.com →
Mozilla engineer Brian Grinstead explains how a focused, agentic bug-finding pipeline using Claude Mythos helped identify a long-standing Firefox bug and accelerate security fixes. He details how the harness, scoring, verification, and tight goal-loop enable scalable bug hunting, and he shows how to build a starter version without any SDK.
Key Takeaways
- Build a basic bug-finding harness with Claude Code or Codex using a simple prompt and the -p flag—no SDK required.
- Don’t feed an entire codebase to a single agent; use an LLM judge to score and rank files before spending compute.
- Add a verifier subagent to catch cheating and kill false positives, enabling a disciplined goal-loop with retries.
- Fuzzing/CI/dev tooling foundations accelerate adoption; humans still review every fix.
- A non-engineer can reuse the same score–verify–fix loop to target design quality, conversions, or tech debt.
Excerpt
Brian Grinstead is a distinguished engineer at Mozilla, where he’s worked on Firefox and the web platform since 2013 (he joined to help launch Firefox DevTools). Recently he and his team pointed an agentic bug-finding pipeline at Firefox—a codebase with tens of thousands of files and tens of millions of lines of code—and shipped a record month of security fixes. The viral chart everyone saw gave the credit to Anthropic’s new Mythos model. Brian’s take is that the harness and pipeline did just as much of the work, and he walks through exactly how it runs and how anyone can…