---
title: "Partnering with Mozilla on Firefox security"
description: "Anthropic describes a collaboration with Mozilla in which Claude Opus 4.6 discovered 22 previously unknown Firefox vulnerabilities over two weeks, including 14 that Mozilla classified as high severity. The work began with reproducing historical Firefox CVEs, then shifted to novel bugs in the current codebase, starting with the JavaScript engine and eventually scanning nearly 6,000 C++ files. Anthropic and Mozilla submitted 112 unique reports, while most issues were fixed in Firefox 148; Claude also produced working exploits for two vulnerabilities in a deliberately weakened test environment. The post says Claude is substantially better at finding and fixing vulnerabilities than exploiting them, but warns that this gap may narrow and recommends evidence-rich reports, task verifiers, and coordinated disclosure processes."
---

# Partnering with Mozilla on Firefox security

[Anthropic](https://yomu.fyi/company/anthropic) · Sep 9, 2026

**Type:** Announcement

## Summary

Anthropic describes a collaboration with Mozilla in which Claude Opus 4.6 discovered 22 previously unknown Firefox vulnerabilities over two weeks, including 14 that Mozilla classified as high severity. The work began with reproducing historical Firefox CVEs, then shifted to novel bugs in the current codebase, starting with the JavaScript engine and eventually scanning nearly 6,000 C++ files. Anthropic and Mozilla submitted 112 unique reports, while most issues were fixed in Firefox 148; Claude also produced working exploits for two vulnerabilities in a deliberately weakened test environment. The post says Claude is substantially better at finding and fixing vulnerabilities than exploiting them, but warns that this gap may narrow and recommends evidence-rich reports, task verifiers, and coordinated disclosure processes.

## Context

Anthropic wanted a harder, more realistic evaluation of AI vulnerability research than CyberGym, focusing on technically complex software and modern browser security. Firefox was selected because it is a complex, well-tested open-source codebase with a large attack surface and hundreds of millions of users.

## Approach / What changed

Claude first reproduced historical Firefox CVEs, then searched the current Firefox codebase for novel vulnerabilities, beginning with the JavaScript engine and expanding across other areas. Anthropic validated and reported findings with Mozilla, which encouraged bulk submission; the collaboration also tested exploit development and examined practices for triaging, patching, and disclosing vulnerabilities.

## Takeaways

- Claude Opus 4.6 found 22 Firefox vulnerabilities in February 2026, including 14 Mozilla classified as high severity, from 112 unique submitted reports.
- Claude successfully turned two submitted vulnerabilities into exploits, but only in a test environment that removed security features including the browser sandbox.
- Mozilla identified minimal test cases, detailed proofs of concept, and candidate patches as important evidence for trusting vulnerability reports.

**Tags:** [AI Security](https://yomu.fyi/topic/ai-security), [Claude](https://yomu.fyi/topic/claude), [Open Source](https://yomu.fyi/topic/open-source)

- Source: [Anthropic](https://www.anthropic.com/news/mozilla-firefox-security)
- Source URL: https://www.anthropic.com/news/mozilla-firefox-security
- Ingested by Yomu: 2026-09-10T04:03:05.331Z

[Read original post](https://www.anthropic.com/news/mozilla-firefox-security)