A fixed bug does not end its pattern: Mozilla's AI scans keep finding similar flaws

Fixing a security bug does not mean its pattern is gone. Brian Grinstead of Mozilla said on OpenAI's show that AI scans seeded with known bugs keep finding similar patterns in Firefox's code. Some had lived there for a long time. The host was Clint Gibler, and the episode covers Mozilla's use of the GPT-6 Cyber model on Firefox security.

What was said

Grinstead described what Mozilla calls a variant scan. The team packages a bug it already knows about, fixed or open, for an AI agent. The agent hunts for similar patterns across the code, near the original or far away. One example was taking every security bug fixed in 2025 and looking for things that resemble them. Grinstead found the result surprising. "You can go back pretty far and still find instances of that pattern living in the code base for quite a long time," he said. Variant scans produced the majority of bugs Mozilla found in September. He tied that partly to timing: the team had only just stood up this scanning and pointed energy at it. He also said "different models find different bugs, even if you've scanned the code multiple times." People still do the fixing. He said AI patches usually cannot land as they are, so an expert engineer writes the final one and another reviews it.

Why it matters

Our reading: a closed ticket shows one bug was fixed, not that its pattern is gone. That holds for code of any age, and Mozilla scans new commits too. The narrow point is that each fixed bug can seed a search for its relatives. For people who sign budgets, that suggests three questions. Does your team or vendor run a variant search after each fix? Who re-scans when new models arrive, given that different models find different bugs? Who has the engineers to turn findings into safe patches? What would this mean for old code? Grinstead did not answer that. It is a question to ask, not a finding.

The other side

In the excerpts reviewed, Grinstead gave no age for the oldest copies, no count, and no view on how many could be attacked. He made no comparison of scanning cost with replacement cost, and no claim that aging code costs more to secure. The full episode may cover more. Firefox is actively maintained, so it is not a clear legacy case. September's lead for variant scans also reflects Mozilla's new focus, so it does not prove they are a richer source of bugs. Grinstead described zero bugs as the guiding goal for the future, not a result. The excerpts do not say whether repeat scanning eventually runs out of new finds.