Partnering with Mozilla to improve Firefox’s security

2026-03-06 · Source: Anthropic News · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Advanced, medium

Summary

Anthropic collaborated with Mozilla, demonstrating that Claude Opus 4.6 can independently identify high-severity vulnerabilities in complex software. Over two weeks in February 2026, Claude Opus 4.6 discovered 22 vulnerabilities in Firefox, 14 of which Mozilla classified as high-severity. This represents almost a fifth of all high-severity Firefox vulnerabilities remediated in 2025. The AI model initially reproduced historical CVEs in older Firefox versions before successfully finding novel bugs in the current codebase, including a Use After Free vulnerability in the JavaScript engine. Mozilla subsequently released fixes for most issues in Firefox 148.0. While Claude is proficient at finding and fixing vulnerabilities, its ability to create exploits is significantly less developed, succeeding in only two out of several hundred attempts, at a cost of approximately $4,000 in API credits.

Key takeaway

For security teams and CTOs evaluating AI for cybersecurity, this collaboration highlights AI's immediate value in vulnerability discovery and patching. You should consider integrating LLM-powered tools, like Claude Code Security, into your security workflows to accelerate the identification and remediation of high-severity bugs. Focus on establishing robust task verifiers and clear reporting protocols to maximize AI's effectiveness and maintain trust in AI-generated findings, while acknowledging the current gap in AI's exploitation capabilities.

Key insights

AI models like Claude Opus 4.6 can autonomously find and help fix high-severity software vulnerabilities at accelerated speeds.

Principles

• Task verifiers improve AI agent output quality.
• AI excels at discovery, less so at exploitation.
• Collaboration enhances AI-driven security outcomes.

Method

Claude Opus 4.6 was tasked to find novel vulnerabilities in Firefox's current codebase, starting with the JavaScript engine, and then expanded to other areas, submitting findings with proposed patches.

In practice

• Use LLMs with task verifiers for bug discovery.
• Include test cases and candidate patches in reports.
• Prioritize fixing vulnerabilities quickly.

Topics

• AI-enabled Security
• Vulnerability Discovery
• Large Language Models
• Firefox Security
• Exploit Generation

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, Security Engineer, AI Researcher

Related on AIssential

• Claude Finds 22 Firefox Vulnerabilities In Just Two Weeks — AI models can rapidly discover high-severity vulnerabilities in complex software like Firefox.
• Using LLMs to Secure Source Code — LLMs streamline vulnerability discovery, shifting the security bottleneck to verification, triage, and patching.
• Behind the Scenes Hardening Firefox with Claude Mythos Preview — Advanced LLMs, when properly harnessed, can dramatically improve software security by finding numerous vulnerabilities.
• Mozilla says 271 vulnerabilities found by Mythos have "almost no false positives" — An AI agent harness significantly reduces false positives in vulnerability detection by integrating LLMs into existing developer toolchains.
• How our partners are putting Opus to work for cybersecurity — Frontier AI models like Claude Opus significantly accelerate vulnerability discovery and remediation across diverse cybersecurity operations.
• Mozilla fixes 271 Firefox vulnerabilities found by Anthropic’s AI — Advanced AI can significantly enhance vulnerability detection, potentially shifting the cybersecurity advantage to defenders.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Anthropic News.