Anthropic’s Claude found 22 vulnerabilities in Firefox over two weeks

Source: TechCrunch

Overview

In a recent security partnership with Mozilla, Anthropic discovered 22 separate vulnerabilities in Firefox, with 14 classified as “high‑severity.” Most of the bugs have been fixed in Firefox 148 (released in February), while a few fixes are slated for the next release.

Methodology

Anthropic’s team employed Claude Opus 4.6 over a two‑week period, beginning with the JavaScript engine and then expanding to other parts of the codebase. The team chose Firefox because “it’s both a complex codebase and one of the most well‑tested and secure open‑source projects in the world.”

Findings

• Claude Opus proved far more effective at identifying vulnerabilities than at writing exploit code.
• The team spent $4,000 in API credits attempting to create proof‑of‑concept exploits, succeeding in only two cases.

Implications

The results highlight the power of AI tools for open‑source projects, even as they can generate a “flood of bad merge requests” alongside valuable contributions.

Read more about AI’s mixed impact on open‑source contributions.