How Claude Mythos found a 15-year-old bug in Mozilla Firefox | Brian Grinstead

June 22, 2026

AI Summary

5 min read

In February 2025, Mozilla Firefox was still dealing with the same problem many open-source projects faced: unwanted AI-generated bug reports that looked professional but were often wrong, creating an asymmetric cost for maintainers who had to verify them. By April, that had flipped. Firefox shipped nearly 500 security fixes in a single month, and the spike was widely attributed to Anthropic's unreleased Mythos model. But Brian Grinstead, a Distinguished Engineer at Mozilla, tells a more nuanced story: the model mattered, but the real unlock was the custom harness they built around it.

The harness, not the model, was the real breakthrough

Grinstead is careful not to discount the model improvements. Mythos generates better hypotheses about where bugs might live and produces more accurate test cases. But the core insight from Mozilla's experience is that the harness—the orchestration layer that gives the model tools, a structured loop, and a verification pipeline—is where most of the leverage came from. "I think people really underappreciate the relentless tedium that an agent will go through," Grinstead says. "The ability to take an agent, give it a very constrained problem and surface area and say exhaust every attempt at this is really powerful. Again, not because human intelligence couldn't identify similar issues, but actually our cognitive energy declines over time in

Continue reading the full summary in the app — free to try.

Read Full Summary →

Free • No credit card required

Listen to Audio Summary Open in App

Never miss an episode of How I AI

Get every new episode summarized in your inbox — free, ~5 minutes to read.

No spam. Unsubscribe anytime.

What you'll learn

1 (00:00) **The Core Problem: Scale and the Need for a Harness** - Firefox has tens of millions of lines of code, making a single-shot bug hunt impossible; the solution is a constrained, agentic harness.
2 (01:06) **Welcome & Context: The Firefox Security Bug Spike** - Brian Grinstead, Distinguished Engineer at Mozilla, introduces the challenge of securing a massive, complex web browser.
3 (04:28) **The Problem with AI Bug Reports (Pre-2026)** - Before the new system, AI-generated bug reports were often low-quality and unverifiable, creating an asymmetric cost for maintainers.
4 (06:00) **Defining the "Harness"** - A custom wrapper that gives an LLM tools (like running scripts, opening a browser) to achieve a specific goal, moving beyond a "brain in a jar."
5 (07:13) **The Firefox Harness Flow** - A step-by-step walkthrough of the custom harness, which is simpler than it looks.
6 (10:38) **The Power of Relentless Loops** - The key advantage is the agent's ability to exhaustively test hundreds of hypotheses without cognitive fatigue.
7 (13:00) **Simplicity of the Harness & Reusing Existing Pipelines** - The harness is a simple analyzer loop with a verifier sub-agent and a dozen tools, plugging into an existing bug-fix pipeline.

+ Full timestamped outline available in the app

Show Notes

Brian Grinstead is a distinguished engineer at Mozilla, where he’s worked on Firefox and the web platform since 2013 (he joined to help launch Firefox DevTools). Recently he and his team pointed an agentic bug-finding pipeline at Firefox—a codebase with tens of thousands of files and tens of millions of lines of code—and shipped a record month of security fixes. The viral chart everyone saw gave the credit to Anthropic’s new Mythos model. Brian’s take is that the harness and pipeline did just as much of the work, and he walks through exactly how it runs and how anyone can build a starter version.

What you’ll learn:

How to build a basic bug-finding harness by running Claude Code or Codex with one prompt and the -p flag, no SDK required
Why pointing an agent at a whole codebase fails, and how an LLM judge can score and rank files before you spend any compute
How a verifier subagent kills false positives by catching the agent when it cheats
The goal-loop pattern: give an agent a tightly scoped problem, a clear pass/fail signal, and let it retry far past the point a human would quit
Why teams that already invested in fuzzing, CI, and dev tooling are so far ahead
How to weigh model versus harness, and why Brian splits the credit close to 50-50
How a non-engineer can reuse the same score, verify, and fix the loop for design quality, conversion rate, or tech debt
Why AI-generated patches still can’t ship on their own, and where humans stay in the loop

—

Brought to you by:

WorkOS—Make your app enterprise-ready today

Metaview—The agentic recruiting platform for winning teams

—

In this episode, we cover:

(00:00) Introduction to Brian Grinstead

(02:43) The viral chart: Firefox Security Bug Fixes by Month

(05:32) How the custom harness works

(10:22) Goal loops and guardrails

(14:45) How they built it

(16:55) Real bugs, including a 15-year-old one