Anthropic published on March 6, 2026 that Claude Opus 4.6 discovered 22 vulnerabilities in Mozilla Firefox during a two-week collaboration; Mozilla classified 14 of those as high-severity. Most of the issues were fixed and shipped in Firefox 148.0. The post frames this work as evidence that large language models can accelerate discovery of serious bugs in complex, widely used software.
Why Firefox was chosen
Anthropic selected Firefox because it is a large, complex and well-tested open-source codebase used daily by hundreds of millions of people. Browser vulnerabilities are especially consequential because browsers routinely process untrusted content and are a frequent target for attacks.
How the research proceeded
The team first asked Claude to reproduce historical Firefox CVEs to assess its ability to surface known vulnerabilities. Opus 4.6 reproduced a high percentage of past CVEs, but Anthropic noted the possibility that some historical cases could have been present in the model’s training data. To remove that ambiguity, they then tasked Claude with finding novel vulnerabilities in the current Firefox codebase.
The initial focus was Firefox’s JavaScript engine because it can be analyzed in isolation and has a wide attack surface. After about twenty minutes of exploration, Claude reported a Use After Free memory bug in the JavaScript engine. Anthropic researchers independently validated the finding in virtual machines, and the team submitted a Bugzilla report to Mozilla including a description and a proposed patch authored by the model and checked by humans.
Scaling up and working with Mozilla
While validating and reporting the first bug, Claude had already generated about fifty additional unique crashing inputs. Anthropic continued triaging these crashes, after which a Mozilla researcher contacted them. Following technical discussions, Mozilla encouraged Anthropic to submit findings in bulk, even if not every crashing test case had been fully validated as a security issue. Over the effort Anthropic scanned nearly 6,000 C++ files and submitted 112 unique reports. Of the new issues, 22 were distinct vulnerabilities and Mozilla marked 14 as high-severity. Most fixes were included in Firefox 148, with remaining fixes planned for future releases.
Validating findings and false positive risk
Anthropic emphasized the risk of false positives when analyzing external software and said they attempted to validate bugs themselves. They praised Mozilla’s transparent triage process, which helped refine which test cases were important to submit. Mozilla researchers have also begun experimenting internally with Claude for security purposes.
From finding bugs to building exploits
To measure whether Claude could do more than find bugs, Anthropic asked the model to develop exploits for the vulnerabilities they had reported. The success criterion for an exploit was that it could read and write a local file on a target system—demonstrating a real attacker capability.
They ran this evaluation several hundred times with different starting points and spent roughly $4,000 in API credits. Opus 4.6 produced working exploits in only two cases within their testing environment. This suggests the model is far better at finding vulnerabilities than at turning them into exploits, and that exploit development remains significantly more costly than vulnerability discovery. Nevertheless, the fact that Claude could automatically generate crude browser exploits in some instances is noted as concerning.
Anthropic also clarified that the exploits worked only in their test environment, which intentionally removed certain security features—most importantly the sandbox that modern browsers use to limit impact. Firefox’s layered defenses would likely have mitigated those specific exploits in real-world settings, but sandbox escapes have occurred historically, and an automated exploit component is one element of a potential end-to-end attack.
Technical and procedural lessons
Anthropic offered practical recommendations for maintainers and researchers working with LLM-powered tools:
-
Task verifiers: Claude performed best when paired with a secondary, trusted tool that could check whether the model’s output achieved its goal. These verifiers provided real-time feedback and allowed deeper iteration. Anthropic built tools that automatically tested whether a proposed fix removed the original bug and ran test suites to detect regressions.
-
Evidence for reports: Mozilla highlighted three submission components that increased trust in Anthropic’s results: minimal reproducible testcases, detailed proofs-of-concept, and candidate patches. Anthropic encourages other researchers who use LLM tools to include similar evidence to help maintainers triage reports.
-
Coordinated disclosure process: Anthropic published its Coordinated Vulnerability Disclosure (CVD) operating principles describing how it will work with maintainers. The organization notes these processes currently follow industry norms but may need to evolve as model capabilities change.
Outlook for AI-enabled cybersecurity
Anthropic argues that frontier language models are now world-class at vulnerability discovery. Beyond the 22 Firefox CVEs, they say Claude Opus 4.6 has been used to find bugs in other significant projects such as the Linux kernel. Opus 4.6 is currently much better at discovery and patch assistance than at exploit creation, which favors defenders for now.
However, Anthropic warns that the gap between discovery and exploitation may narrow as models improve. If future models reliably automate exploit creation, additional safeguards and policy responses will be necessary to reduce misuse risk.
Anthropic plans to expand its cybersecurity work: collaborating with developers to search for vulnerabilities following CVD processes, building tools to help triage bug reports, and proposing patches. They have also started a limited research preview of Claude Code Security to provide vulnerability discovery and patching capabilities to customers and maintainers.
Anthropic invited interested engineers and researchers to apply to join their security efforts, including building detection scaffolds, triaging and patching vulnerabilities, and operating a coordinated disclosure process suited to the AI era.
Summary
The collaboration between Anthropic and Mozilla demonstrates that large language models can rapidly surface high-severity vulnerabilities in complex, widely-used software. While exploitation remains harder and costlier than discovery today, the work underlines the need for robust processes, tooling and coordination between AI-enabled researchers and maintainers as model capabilities advance.
