In a recent security partnership with Mozilla, Anthropic discovered 22 vulnerabilities in Firefox. Of these, 14 were classified as “high severity.” Most bugs were fixed in Firefox 148 (the version released in February of this year), but some fixes will have to wait until the next release.
The team at Anthropic used Claude Opus 4.6 for two weeks, starting with the JavaScript engine and expanding to other parts of the codebase. According to the post, the team focused on Firefox because “Firefox is a complex codebase and one of the most well-tested and secure open source projects in the world.”
In particular, Claude Opus was much better at discovering vulnerabilities than he was at writing software to exploit them. The team ended up spending $4,000 in API credits trying to concoct proof-of-concept exploits, but only two were successful.
Still, it's a reminder of how powerful AI tools can be for open source projects. Even if it results in a lot of bad merge requests along with the useful ones.