Anthropic and Mozilla Partnership: Claude Opus 4.6 Firefox Security Findings

Anthropic and Mozilla have partnered to demonstrate that AI models can independently identify high-severity vulnerabilities in complex software. Using Claude Opus 4.6, Anthropic discovered 22 vulnerabilities in the Firefox browser over two weeks, 14 of which were classified by Mozilla as high-severity—representing nearly one-fifth of all high-severity Firefox vulnerabilities remediated in 2025.

AI-Driven Vulnerability Discovery in Firefox

Claude Opus 4.6 demonstrated the ability to detect severe security flaws at accelerated speeds, identifying more vulnerabilities in February 2026 than were reported from all sources in any single month of 2025.

Methodology and Process

Anthropic transitioned from using benchmarks like CyberGym to testing on the Firefox codebase due to its complexity and high security standards. The process evolved in three stages:

Historical Reproduction: Claude first reproduced previously identified Common Vulnerabilities and Exposures (CVEs) in older Firefox versions.
Novel Discovery: The model was tasked with finding new bugs in the current version of Firefox, starting with the JavaScript engine due to its isolated nature and large attack surface.
Bulk Reporting: After validating an initial Use After Free memory vulnerability, Anthropic submitted 112 unique reports to Mozilla, covering nearly 6,000 C++ files.

Most of these issues were fixed in Firefox 148.0.

Exploitation Capabilities vs. Discovery

To test the upper limits of the model, Anthropic evaluated whether Claude Opus 4.6 could develop exploits for the bugs it discovered. The goal was to see if the model could execute a real attack, such as reading or writing a local file on a target system.

Key Findings on Exploitation

Low Success Rate: Despite several hundred attempts and approximately $4,000 in API credits, Opus 4.6 successfully created an exploit in only two cases.
Discovery Advantage: The cost and ease of identifying vulnerabilities are an order of magnitude lower than the cost of creating exploits.
Environmental Limitations: The successful exploits were "crude" and only worked in testing environments where modern browser security features, specifically the sandbox, were removed. Firefox's "defense in depth" would have mitigated these specific attacks.

Technical Best Practices for AI-Enabled Security

Anthropic identified several procedural and technical methods to improve the "find-and-fix" process for defenders.

The Role of Task Verifiers

Claude performs most effectively when paired with a "task verifier"—a trusted tool that provides real-time feedback to the AI agent. For patching bugs, these verifiers ensure two critical properties:

Vulnerability Removal: Confirming the original bug can no longer be triggered.
Regression Prevention: Running test suites to ensure intended functionality is preserved.

Submission Standards for Maintainers

To reduce the burden on software maintainers, Anthropic recommends that AI-powered reports include three specific components to ensure trust and verifiability:

Minimal test cases
Detailed proofs-of-concept
Candidate patches

Implications for Cybersecurity

Frontier models are now capable of world-class vulnerability research, with Claude Opus 4.6 also discovering flaws in the Linux kernel. While a gap currently exists where models are better at finding and fixing bugs than exploiting them, Anthropic warns that this window is likely temporary.

As the gap between discovery and exploitation closes, additional safeguards will be necessary to prevent misuse by malicious actors. Anthropic is expanding its cybersecurity efforts through the release of Claude Code Security in limited research preview and by adhering to a Coordinated Vulnerability Disclosure (CVD) process.