271 Unknown Firefox Bugs Found in Days: AI Rewrites the Security Debt Math

Yesterday's feed crystallized around two questions that matter beyond any individual story: what does it mean when AI makes software vulnerability debt measurable at scale for the first time, and what happens to an inference economy minting billion-dollar valuations while major operators quietly admit the returns haven't materialized.

Security

The most technically significant item in yesterday's feed came from Steve Gibson's Security Now episode 1080: Mozilla deployed AI-assisted fuzzing against Firefox and surfaced 271 previously unknown vulnerabilities in days — bugs that had survived millions of automated test runs across years of continuous integration. Gibson's position is deliberately measured: this is not evidence that Firefox's codebase is uniquely problematic. It's the first time the industry has had tooling capable of actually surfacing the vulnerability debt that has accumulated, silently, in every production codebase since the beginning of the software industry.

That reframe is worth sitting with. These 271 bugs weren't created yesterday. They've existed for years, latent and undiscovered, because the automated tooling available to auditors simply couldn't find them at this fidelity. What AI-assisted fuzzing changed is the detection threshold, not the underlying failure rate. The optimistic conclusion: defenders now have a real instrument for paying down this debt systematically. The less comfortable conclusion: adversaries have access to the same capabilities, and the gap between vulnerability discovery and active exploitation is about to compress in ways the patching cadence of most organizations is not designed to handle.

What makes this land harder is the context: the industry is simultaneously managing active exploitation of newly discovered flaws. Three of those — the Starlette BadHost vulnerability threatening AI agent infrastructure, the KnowledgeDeliver zero-day being used to plant Godzilla web shells, and the ShinyHunters-driven Charter Communications breach — are covered in yesterday's breaking news below. The attack surface is already live. The Firefox audit is a preview of how much larger it actually is.

AI

The inference economy minted another batch of large numbers. Baseten is in talks to raise $1 billion at an $11 billion valuation. OpenRouter closed a $113 million Series B at $1.3 billion on the back of 5x usage growth in six months. The thesis underneath both: multi-model routing and specialized inference deployment are becoming infrastructure-grade utilities, and the underlying demand isn't softening. The revenue basis for that demand is clearer than the narrative suggests — Anthropic is likely generating at least 35% more revenue than OpenAI, a gap that inverts the public perception of who's winning the model layer and explains a lot about where inference traffic is actually routing.

The counterweight came from Uber. The company burned through its entire AI budget in a single quarter, yet its COO said publicly that AI lacks demonstrable ROI. That combination — unplanned budget exhaustion alongside genuine uncertainty about whether the spend produces results — is the honest state of enterprise AI adoption. Both things can be true simultaneously: the infrastructure layer can be worth billions in valuation while the application layer remains unproven for most operators.

The price war at the model layer extended further: Xiaomi cut MiMo-v2.5 API pricing by up to 99%. Base inference is commoditizing at a pace that makes raw token generation nearly a zero-margin business. The investable layer is moving upstack to routing, fine-tuning, and deployment tooling — exactly where Baseten and OpenRouter compete.

Two consumer signals worth tracking. DuckDuckGo installs jumped 30% in direct response to Google replacing blue links with AI agents at I/O 2026 — users who wanted search results are actively opting out of AI mediation, and the install numbers make that preference concrete. Meanwhile, Stack Overflow's Q&A forum is effectively dead, volume evaporated as developers moved to LLMs, and the company is now betting its revenue model on AI tooling to survive. It's the most complete case study available of a platform disrupted by the capability it helped build.

A footnote worth saving: Pope Leo XIV's encyclical warning against the dangers of AI may have been partially written using AI. An analysis on LessWrong found certain passages scoring above 40% AI probability. The Vatican hasn't commented.

Tech

NASA published its most concrete lunar construction timeline yet: three missions launching this year to the Moon's South Pole, building toward a permanent base ahead of the crewed Artemis landing in 2028. The agency is already working through the Outer Space Treaty implications of establishing a lunar perimeter — a legal question that has no precedent and will need to be answered before the first structure goes up.

SpaceX had a split day on the wire. Starlink signed American Airlines to install service across 500+ Airbus aircraft, a clean commercial win ahead of its IPO. But a closer read of SpaceX's S-1 shows Starship's path to the reusability that Musk says is essential to Starlink's long-term economics is genuinely uncertain. The business is executing well at current satellite counts; the vehicle that's supposed to make replacing them cheap is not yet proven on reuse.

On the policy and executive fronts: the Trump administration cleared Volvo to sell connected cars in the US despite Geely's Chinese majority ownership, and is actively recruiting nuclear startups to consume the government's weapons-grade plutonium stockpile as reactor fuel — the US is sitting on dozens of tons with no current civilian disposition plan. Dropbox CEO Drew Houston is stepping down after 20 years, a quiet close to the defining chapter of cloud file sync.

271 bugs in days. Every codebase is next.

Also yesterday

• Critical 'BadHost' Vulnerability in Starlette Threatens Millions of AI Agents
• KnowledgeDeliver Zero-Day Actively Exploited to Plant Godzilla Web Shell
• Charter Communications Confirms Data Breach After ShinyHunters Extortion Threat