AI detects 22 serious Firefox flaws with Claude

Claude Opus 4.6 detected 22 new vulnerabilities in Firefox over two weeks, 14 of which Mozilla classified as high severity. The collaboration allowed Mozilla to fix most of them in Firefox 148.0, a version reaching hundreds of millions of users.

The work shows an important shift in cybersecurity: AI can now review large amounts of code and find flaws that previously required weeks or months of manual research.

How it found the flaws

Anthropic chose Firefox because it combines two difficult characteristics: it is a highly complex program and, at the same time, one of the most heavily reviewed open-source projects. A browser is also a sensitive target because it processes internet content that you do not control.

Claude started with the JavaScript engine, the part of Firefox that runs code from web pages. After just 20 minutes of exploration, it identified a Use After Free flaw, a memory vulnerability that can allow data to be overwritten with malicious content.

Anthropic researchers verified the issue in an independent virtual machine and sent Mozilla a report with a possible fix. While validating that first case, Claude found 50 additional entries capable of causing crashes.

Mozilla recommended submitting the findings in batches, even when it was not yet clear whether all of them had security implications. By the end of the analysis, Anthropic had reviewed nearly 6,000 files written in C++ and submitted 112 unique reports.

Of those, 22 were considered security vulnerabilities. Mozilla classified 14 as high severity, a figure equivalent to nearly one-fifth of all serious Firefox vulnerabilities fixed during 2025.

Most of the findings have already been fixed

The collaboration between the two organizations was not limited to detecting errors. Mozilla helped determine which reports were worth submitting and how the evidence should be presented so its teams could review it quickly.

Most of the issues have already been fixed in Firefox 148.0. The rest are planned for future updates. For each report, Anthropic recommends including:

• Minimal test cases to reproduce the flaw.
• Detailed proof-of-concept tests.
• A possible fix that the responsible team can review.

This matters because finding an error is not enough. Developers must verify that the patch removes the vulnerability without breaking other browser functions.

Finding flaws is easier than exploiting them

Anthropic also wanted to measure whether Claude could turn those vulnerabilities into real attacks. To do that, it asked the model to create tools capable of reading and writing a local file, demonstrating that the flaw could be used to perform malicious actions.

The team repeated the test several hundred times and spent approximately $4,000 on API credits. Claude managed to create a functional exploit in just two cases.

The difference matters: the model was much better at finding vulnerabilities than exploiting them. Those attacks also worked only in a test environment that had disabled several modern browser protections, including the sandbox, a barrier that limits the damage a compromised process can cause.

That reduces the risk posed by those specific exploits, but it does not eliminate the concern. A complete attack needs to overcome several layers of defense, and flaws that allow an attacker to escape the sandbox do exist.

What changes for you

The most visible impact is that the fixes are arriving in a version of Firefox used by hundreds of millions of people. Keeping your browser up to date remains the most important step you can take to benefit from them.

The broader consequence affects those who build and maintain software. AI can review code at a speed human teams cannot match, but its results still need expert validation and review.

Anthropic says Claude works best when it can check its own work with external tools. For example, a system can automatically verify that the flaw can no longer be reproduced and that the program's tests still work after the patch.

That approach could speed up two tasks that often slow down security teams:

• Separating useful reports from false positives.
• Creating and testing patches before incorporating them into the program.

The advantage still lies with defenders: Claude finds vulnerabilities more easily than it exploits them. But that gap could narrow as models improve. That is why the next step is not to trust AI blindly, but to use it now to review more code, fix flaws sooner, and strengthen security processes before attackers have equally capable tools.