Summary
Brian Ginstead, a distinguished engineer at Mozilla Firefox, joins the How I AI podcast to explain how his team used Anthropic’s not-yet-publicly-released model Mythos to find and fix nearly 500 security vulnerabilities in Firefox — a browser with tens of millions of lines of code across tens of thousands of source files. The spike in Firefox security bug fixes visible in April 2026 data drew widespread attention online, and this episode tells the full technical story behind those numbers.
The key methodological insight is that rather than asking a model to scan an entire codebase (impossible at current context limits), the team built constrained harnesses that give the agent a well-scoped problem surface and then let it exhaust every attempt. One heap use-after-free vulnerability required 14 separate attempts before the agent found it. Several bugs fixed through this process had existed in Firefox for over 20 years — their origin identified by having Claude Code trace git history through file renames and code migrations using commands Ginstead hadn’t even known existed. The output is a verified, reproducible HTML test case that engineering teams can act on immediately, a sharp contrast to the wave of low-quality AI-generated bug reports that flooded open-source projects throughout 2025.
Ginstead argues that the agents’ greatest advantage in security auditing isn’t superior intelligence — it’s relentless persistence. Human cognitive energy declines over repetitive analysis tasks; agent attention doesn’t. The episode also covers the economics of Mozilla’s bug bounty program, the specific shape of what makes a useful versus useless AI-generated security report, and what it took to build harnesses capable of producing results the engineering team could trust.
📺 Source: How I AI · Published June 22, 2026
🏷️ Format: Interview
