Security research partnership, Anthropic deployed its Claude Opus 4.6 AI model to analyze Mozilla Firefox, discovering 22 security vulnerabilities in just two weeks.

Key Findings

• High Severity: Mozilla classified 14 of the 22 vulnerabilities as high-severity. This represents nearly one-fifth of all high-severity Firefox bugs patched in 2025.
• Efficiency: The model identified its first bug—a “Use After Free” memory flaw in the JavaScript engine—within 20 minutes of beginning its scan.
• Scale: Beyond the 22 security-critical issues, Claude Opus 4.6 flagged over 100 total bugs, including roughly 90 non-security issues such as crashes and logical errors.
• Methodology: The AI scanned approximately 6,000 C++ files, reasoning through code structures to find errors that traditional “fuzzing” tools had missed.

Defensive Advantage vs. Offensive Risk

Anthropic’s research highlighted a current “asymmetry” in AI capabilities that favors defenders:

• Strong Discovery: The model is exceptionally fast at finding vulnerabilities.
• Weak Exploitation: When tasked with weaponizing these bugs, Claude Opus 4.6 succeeded in only 2 out of several hundred attempts.
• Real-World Protection: The two successful exploits only functioned in test environments with Firefox’s sandbox protections disabled. Under normal conditions, Firefox’s architecture would have blocked them.

Resolution

Mozilla addressed these vulnerabilities in Firefox 148, released in late February 2026. Users should update their browsers immediately.