By playing, you agree to uListen's Terms and Privacy Policy and YouTube's Terms of Service.

How Mozilla Uses Claude Mythos to find Firefox bugs before hackers do

Brian Grinstead is a distinguished engineer at Mozilla, where he’s worked on Firefox and the web platform since 2013 (he joined to help launch Firefox DevTools).

Brian GrinsteadguestClaire Vohost

Jun 22, 202648mWatch on YouTube ↗

Summaries, chapters, transcripts, and FAQs on this page are made by uListen, not YouTube.

EPISODE INFO

Released: June 22, 2026
Duration: 48m
Channel: How I AI
Watch on YouTube: ▶ Open ↗

EPISODE DESCRIPTION

Brian Grinstead is a distinguished engineer at Mozilla, where he’s worked on Firefox and the web platform since 2013 (he joined to help launch Firefox DevTools). Recently he and his team pointed an agentic bug-finding pipeline at Firefox—a codebase with tens of thousands of files and tens of millions of lines of code—and shipped a record month of security fixes. The viral chart everyone saw gave the credit to Anthropic’s new Mythos model. Brian’s take is that the harness and pipeline did just as much of the work, and he walks through exactly how it runs and how anyone can build a starter version. *What you’ll learn:*
How to build a basic bug-finding harness by running Claude Code or Codex with one prompt and the -p flag, no SDK required
Why pointing an agent at a whole codebase fails, and how an LLM judge can score and rank files before you spend any compute
How a verifier subagent kills false positives by catching the agent when it cheats
The goal-loop pattern: give an agent a tightly scoped problem, a clear pass/fail signal, and let it retry far past the point a human would quit
Why teams that already invested in fuzzing, CI, and dev tooling are so far ahead
How to weigh model versus harness, and why Brian splits the credit close to 50-50
How a non-engineer can reuse the same score, verify, and fix the loop for design quality, conversion rate, or tech debt
Why AI-generated patches still can’t ship on their own, and where humans stay in the loop
*Brought to you by:* WorkOS—Make your app enterprise-ready today Metaview—The agentic recruiting platform for winning teams *In this episode, we cover:* (00:00) Introduction to Brian Grinstead (02:43) The viral chart: Firefox Security Bug Fixes by Month (05:32) How the custom harness works (10:22) Goal loops and guardrails (14:45) How they built it (16:55) Real bugs, including a 15-year-old one (23:00) Open-sourcing it (26:26) Why humans still review every fix (32:30) Live demo and prioritizing files (40:18) Mobilizing the team and recap (42:33) Lightning round *Blog and detailed workflow walkthroughs from this episode:* How Mozilla Fixed 500 Security Bugs with Claude Mythos: https://www.chatprd.ai/how-i-ai/how-mozilla-fixed-500-security-bugs-with-mythos ↳ Create an AI-Powered Patch and Verification Loop for Security Bugs: https://www.chatprd.ai/how-i-ai/workflows/create-an-ai-powered-patch-and-verification-loop-for-security-bugs ↳ Use an LLM as a Security Judge to Prioritize Codebase Analysis: https://www.chatprd.ai/how-i-ai/workflows/use-an-llm-as-a-security-judge-to-prioritize-codebase-analysis ↳ Build an AI Agentic Harness for Automated Security Bug Hunting: https://www.chatprd.ai/how-i-ai/workflows/build-an-ai-agentic-harness-for-automated-security-bug-hunting *Tools referenced:*
Claude Code: https://claude.ai/code
Claude Agent SDK: https://code.claude.com/docs/en/agent-sdk/overview
Codex: https://openai.com/index/openai-codex/
OpenAI Agent SDK: https://developers.openai.com/api/docs/guides/agents
VS Code: https://code.visualstudio.com/
Docker: https://www.docker.com/
Firefox: https://www.mozilla.org/firefox/
Address Sanitizer: https://github.com/google/sanitizers
RLBox: https://rlbox.dev/
*Other references:*
Mozilla Bug Bounty Program: https://www.mozilla.org/security/bug-bounty/
Mozilla GitHub: https://github.com/mozilla
*Where to find Brian Grinstead:* LinkedIn: https://www.linkedin.com/in/bgrins/ GitHub: https://github.com/bgrins *Where to find Claire Vo:* ChatPRD: https://www.chatprd.ai/ Website: https://clairevo.com/ LinkedIn: https://www.linkedin.com/in/clairevo/ X: https://x.com/clairevo _Production and marketing by https://penname.co/._ _For inquiries about sponsoring the podcast, email jordan@penname.co._

SPEAKERS

Brian Grinstead
guest
Distinguished engineer at Mozilla Firefox focused on security and tooling to find and patch bugs in the Firefox codebase.
Claire Vo
host
Product leader and host of How I AI who interviews practitioners about building with new AI tools.

EPISODE SUMMARY

In this episode of How I AI, featuring Brian Grinstead and Claire Vo, How Mozilla Uses Claude Mythos to find Firefox bugs before hackers do explores Mozilla finds Firefox security bugs early using agentic harness loops Mozilla’s spike in Firefox security fixes was driven as much by custom harness orchestration and verification as by improved models like Claude Mythos.

RELATED EPISODES