Mozilla says AI helped it fix 271 Firefox security issues
Firefox repairs, new voice models, faster Gemma inference, and experiments in explaining model internals.
Mozilla reports that Firefox 150 includes fixes for 271 findings from Claude Mythos Preview. In its account of the repairs, Mozilla describes turning AI vulnerability reports into reproducible test cases and shipped fixes.
Some bugs were 20 years old. More than 100 people contributed code.
Mozilla’s chart records 423 security fixes in April, compared with roughly 20–30 a month during 2025. The April total isn’t attributed solely to Mythos. Alongside code contributions, the work included triage, testing, and releases.
Several published sandbox escapes, which break out of a restricted browser process, assume an already compromised browser content process; they don’t demonstrate a complete attack chain.
Top Stories
OpenAI introduced three models for live conversation, translation, and transcription. The audio release includes GPT-Realtime-2, GPT-Realtime-Translate, and GPT-Realtime-Whisper.
OpenAI says Realtime-2 expands context from 32K to 128K, supports parallel tool calls, and lets developers adjust reasoning effort. Higher reasoning effort trades responsiveness for additional computation.
Translate supports more than 70 input languages and 13 output languages, according to OpenAI. Realtime-Whisper provides streaming transcription while a conversation is still in progress.
Google released small drafting models to accelerate Gemma 4. Google reports up to threefold speedups without changing output quality. The technique, speculative decoding, lets a small model propose several tokens for the main model to check together, instead of generating each separately.
The drafters reuse the main model’s activations and cached attention state. Google describes testing across LiteRT-LM, MLX, Transformers, and vLLM, with uses including local coding assistants and on-device applications.
Google released the drafter weights under Apache 2.0. For the 26B model on Apple Silicon, it reports better speedups when processing four to eight requests together.
Anthropic released tools that turn model internals into readable explanations. Its natural language autoencoders translate activations, the numerical representations used during computation, into text. One model explains an activation; another tries to reconstruct the activation from the explanation, providing a training signal.
In a controlled exercise auditing hidden motivations, Anthropic reports that equipped auditors succeeded 12–15% of the time, versus less than 3% without the tools. The exercise used a toy setting.
Anthropic also reports hallucinated explanations and substantial training and inference expense. The release includes training code and trained autoencoders for several open models.
Top Links
- Petri 3.0 (anthropic.com): Anthropic transferred development of its open-source model-behavior testing tool to Meridian Labs; version 3 adds evaluation with realistic system prompts and surrounding software.
- Voice networking in Go (openai.com): OpenAI describes separating packet routing from stateful WebRTC connections, using a conventional Go implementation without kernel bypass.
- Reviewing less generated code (simonwillison.net): An engineering essay argues that real usage history now provides stronger evidence of software quality than polished documentation and extensive-looking tests alone.
The week in AI, once a week.