Browser Security in the Age of Mythos: How AI Is Driving a Surge in Browser Risk Exposure
Large language models trained on coding tasks have become remarkably adept at finding security issues. Effective enough that Anthropic made the decision to restrict access to its latest model, Mythos. But between software vendors that have access to Mythos and the advances made by other models, it was broadly expected that we would see a large number of security vulnerabilities being found in the near future.
That future arrived faster than most expected. The patch tsunami is here, and browsers are absorbing the worst of it. This was also expected, given that browsers are the most exposed attack surface and that browser vendors have been at the forefront of vulnerability research.
Vulnerability Discovery Is Exploding
In the span of just over a month, Google released a steady stream of Chrome updates fixing more than 800 security issues: 33 on June 16, 27 on June 11, 74 on June 8, 429 on June 2, 151 on May 27, 16 on May 19, 79 on May 12. For its part, Mozilla fixed 22 security issues found in Firefox in February and then fixed a whopping 271 security issues at the end of April. The issues in Firefox were found by successive versions of Anthropic models: Opus 4.6 in February, Mythos Preview in April. Google has not publicly confirmed exactly how the Chrome vulnerabilities were found, but it is almost certain that LLMs were involved.
What makes this moment feel so different is the tempo. Both the pace and the number of vulnerabilities given a critical severity rating is unprecedented. In the case of Chrome, this has resulted in 7 separate updates in 6 weeks, with each update fixing at least one critical issue, something that would previously rarely happen even twice in 6 weeks.
Beyond Discovery: Exploitation and Evasion
This influx of security fixes is creating risk for people sitting behind browsers because the same models driving discovery have become increasingly capable at the next step: exploitation. The conversation around Mythos and other frontier models has often been focused on their ability to find vulnerabilities, including a 27-year old bug in OpenBSD. While this is impressive, just as important is how much the coding models can help in writing exploits. Turning a vulnerability into an exploit that can reliably compromise a target is far from trivial.
Mostly, security researchers stop at proof-of-concepts that can crash the browser. This is enough to convince a software engineer that there is a memory safety issue that could lead to an exploit. This leaves significant work that used to require time and specialized skills to weaponize a vulnerability. LLMs accelerate this timeline and lower the barrier to entry. Tasks that used to require deep knowledge can now be assisted and accelerated by the same class of models that are discovering the flaw.
Faster exploitation is not the only way LLMs are shifting the balance. A recent report from the Google Threat Intelligence Group highlights that frontier models are also adept at defensive evasion. Attackers have now started using models to mutate their attack payloads. Security experts have long known that signature based approaches were relatively easy to defeat for a moderately skilled attacker, but this is one more area where the barrier to entry is being lowered.
Rethinking Browser Security for an AI-Driven Threat Landscape
This points to a new reality where there is no time to deploy patches and where band-aid solutions in the form of signature-based attack detections cannot be relied on. Security leaders need approaches that fundamentally address the risks inherent in browsing complex, untrusted websites.
For browser vendors, this for example means moving to memory safe language to implement browsers, work that is already under way. For everyone else, it means moving the browser attack surface off endpoints and continuing to focus on security fundamentals, such as following the principle of least privilege. This implication shifts away from relying on detection and response to reducing the impact of compromise when they inevitably occur.
Moving the attack surface off the endpoint means that when a user visits a malicious site, the attack executes in an environment that disappears when the session ends. Nothing reaches the endpoint. Nothing persists. The model found the vulnerability, the attacker wrote the exploit (possibly with the help of the model), and the exploit ran inside a container that no longer exists. In that model, the goal isn’t to eliminate every attack path, but to make successful attacks have far less of an impact.
Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!
