Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening Firefox with Claude Mythos Preview

hacks.mozilla.org

Post reply on HN
Print view View original

51–60 of 176 posts

Re: Hardening Firefox with Claude Mythos Preview

#51

Post by OhMeadhbh »

When I was at PalmSource, I tried to get budget for CoVerity or Fortify (static code analysis tools.). "Too expensive," my management chain said. I spent another year putting together a deal for a lower cost but limited to scanning the network stack. "No, it's based on BSD and BSD is inherently secure," my management chain said (neither is true, btw.)

I eventually left and wound up at Mozilla where there were a number of /* flawfinder ignore */ comments scattered throughout the code.

My guess is that Mythos just ignored the "flawfinder ignore" directives and reported the known vulnerabilities in the code.

Re: Hardening Firefox with Claude Mythos Preview

#52

Post by UltraSane »

crummy wrote: post #24

Curious if people think LLMs will lead to more secure or less secure software in five years.

In 5 years attackers have an advantage but in the long run I think more secure if developers use LLMs on software to find and fix all of the worse remotely exploitable bugs before release. LLMs are going to force devs to be much more security conscious.

Re: Hardening Firefox with Claude Mythos Preview

#54

Post by mccr8 »

cookiengineer wrote: post #42
IainIreland wrote: post #21

Earlier quoted context omitted.

I work at Mozilla; I fixed a bunch of these bugs. In general, I would say that our use of "vulnerability" lines up with what jerrythegerbil calls "potential vulnerability". (In cases with a POC, we would likely use the word "exploit".) Our goal is to keep Firefox secure. Once it's clear that a particular bug might be exploitable, it's usually not worth a lot of engineering effort to investigate further; we just fix i…

Can you elaborate why those bugs weren't found by e.g. fuzzing in the past? I'm genuinely curious what "types" of implementation mistakes these were, like whether e.g. it was library usage bugs, state management bugs, control flow bugs etc. Would love to see a writeup about these findings, maybe Mythos hinted us towards that better fuzzing tools are needed?

Fuzzing isn't good at things like dealing with code behind a CRC check, whereas the audit based approach using an LLMs can see the sketchy code, then calculate the CRC itself to come up with a test case. I think you end up having to write custom fuzzing harnesses to get at the vulnerable parts of the code. (This is an example from a talk by somebody at Anthropic.)

That being said, I think there's a lot of potential for synergy here: if LLMs make writing code easier, that includes fuzzers, so maybe fuzzers will also end up finding a lot more bugs. I saw somebody on Twitter say they used an LLM to write a fuzzer for Chrome and found a number of security bugs that they reported.

Re: Hardening Firefox with Claude Mythos Preview

#55

Post by IainIreland »

cookiengineer wrote: post #42
IainIreland wrote: post #21

Earlier quoted context omitted.

I work at Mozilla; I fixed a bunch of these bugs. In general, I would say that our use of "vulnerability" lines up with what jerrythegerbil calls "potential vulnerability". (In cases with a POC, we would likely use the word "exploit".) Our goal is to keep Firefox secure. Once it's clear that a particular bug might be exploitable, it's usually not worth a lot of engineering effort to investigate further; we just fix i…

Can you elaborate why those bugs weren't found by e.g. fuzzing in the past? I'm genuinely curious what "types" of implementation mistakes these were, like whether e.g. it was library usage bugs, state management bugs, control flow bugs etc. Would love to see a writeup about these findings, maybe Mythos hinted us towards that better fuzzing tools are needed?

If I had to guess, I'd say that AI is better at finding TOCTOU bugs than fuzzing because it starts by looking at the code and trying to find problems with it, which naturally leads it to experiment with questions like "is there any way to make this assumption false?", whereas fuzzing is more brute force. Fuzzing can explore way more possible states, but AI is better at picking good ones.

In this particular sense, AI tends to find bugs that are closer to what we'd see from a human researcher reading the code. Fuzz bugs are often more "here's a seemingly innocuous sequence of statements that randomly happen to collide three corner cases in an unexpected way".

Outside of SpiderMonkey, my understanding is that many of the best vulnerabilities were in code that is difficult to fuzz effectively for whatever reason.

Re: Hardening Firefox with Claude Mythos Preview

#56

Post by browningstreet »

jerrythegerbil wrote: post #12

Again, and this is important: A bug is a bug. A “potential vulnerability” is a bug. A vulnerability is verifiable as having security implications with a proof of concept or other substantial evidence. Words matter. Bugs matter. It’s important to fix large amounts of bugs, just as it always has been, and has been done. Let that be impressive on its own, because it IS impressive. Mythos didn’t write 271 PoC for vulnera…

This isn’t true anywhere people have to make decisions about what to work on first.

Re: Hardening Firefox with Claude Mythos Preview

#57

Post by mozdeco »

gnabgib wrote: post #46

16 day old story Wired: Mozilla Used Anthropic's Mythos to Find and Fix 271 Bugs in Firefox (41 points, 18 comments) https://news.ycombinator.com/item?id=47853649 Ars: Mozilla: Anthropic's Mythos found 271 security vulnerabilities in Firefox 150 (33 points, 8 comments) https://news.ycombinator.com/item?id=47855384

No, it's a new post, see also

https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...

Re: Hardening Firefox with Claude Mythos Preview

#58

Post by gnabgib »

mozdeco wrote: post #57
gnabgib wrote: post #46

16 day old story Wired: Mozilla Used Anthropic's Mythos to Find and Fix 271 Bugs in Firefox (41 points, 18 comments) https://news.ycombinator.com/item?id=47853649 Ars: Mozilla: Anthropic's Mythos found 271 security vulnerabilities in Firefox 150 (33 points, 8 comments) https://news.ycombinator.com/item?id=47855384

No, it's a new post, see also https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...

That's this post.. and while it's more detail on the same headline (271 bugs) these discussions look the same as 2 weeks ago (and the same as all the bloggers and podcasters discussed)

Re: Hardening Firefox with Claude Mythos Preview

#60

Post by mc3301 »

crummy wrote: post #24

Curious if people think LLMs will lead to more secure or less secure software in five years.

Kinda like home-improvement stores, power tools, easily available hardware and youtube tutorials led to both incredibly amazing and durable furniture, as well as janky, ugly and even dangerous furniture.

More tools for more people equals more stuff being made on a wider range.

Post reply on HN