Loading post…
AnthropicAnnouncement
Partnering with Mozilla on Firefox security
Summary
Anthropic describes a collaboration with Mozilla in which Claude Opus 4.6 discovered 22 previously unknown Firefox vulnerabilities over two weeks, including 14 that Mozilla classified as high severity. The work began with reproducing historical Firefox CVEs, then shifted to novel bugs in the current codebase, starting with the JavaScript engine and eventually scanning nearly 6,000 C++ files. Anthropic and Mozilla submitted 112 unique reports, while most issues were fixed in Firefox 148; Claude also produced working exploits for two vulnerabilities in a deliberately weakened test environment. The post says Claude is substantially better at finding and fixing vulnerabilities than exploiting them, but warns that this gap may narrow and recommends evidence-rich reports, task verifiers, and coordinated disclosure processes.
Context
Anthropic wanted a harder, more realistic evaluation of AI vulnerability research than CyberGym, focusing on technically complex software and modern browser security. Firefox was selected because it is a complex, well-tested open-source codebase with a large attack surface and hundreds of millions of users.
Approach / What changed
Claude first reproduced historical Firefox CVEs, then searched the current Firefox codebase for novel vulnerabilities, beginning with the JavaScript engine and expanding across other areas. Anthropic validated and reported findings with Mozilla, which encouraged bulk submission; the collaboration also tested exploit development and examined practices for triaging, patching, and disclosing vulnerabilities.
Takeaways
Claude Opus 4.6 found 22 Firefox vulnerabilities in February 2026, including 14 Mozilla classified as high severity, from 112 unique submitted reports.
Claude successfully turned two submitted vulnerabilities into exploits, but only in a test environment that removed security features including the browser sandbox.
Mozilla identified minimal test cases, detailed proofs of concept, and candidate patches as important evidence for trusting vulnerability reports.
Source and freshness
- Source
- anthropic.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.