Anthropic's Claude finds 22 Firefox vulnerabilities in two weeks
In a significant security collaboration between Anthropic and Mozilla, the AI model Claude identified 22 distinct vulnerabilities within the Firefox web browser over a two-week period. Fourteen of these flaws were classified as high-severity issues. While the majority of these bugs have already been resolved in Firefox version 148, which was released in February, a small number of fixes are scheduled for the next update. Anthropic's team utilized the Claude Opus 4.6 model to conduct the audit. The process began with an analysis of the JavaScript engine before expanding to other areas of the codebase. According to the company, Firefox was selected for this initiative because it represents both a highly complex codebase and one of the most rigorously tested and secure open-source projects globally. The results highlighted a specific strength in the AI's capabilities. The model proved significantly more effective at discovering potential security flaws than at generating the software necessary to exploit them. To test its offensive capabilities, the team invested $4,000 in API credits attempting to create proof-of-concept exploits for the identified vulnerabilities. Despite this substantial effort, they only successfully generated working exploits in two instances. This exercise serves as a powerful reminder of the growing utility of artificial intelligence tools for maintaining open-source software security. By leveraging large language models for code auditing, projects can uncover critical issues that might otherwise remain hidden. However, the initiative also underscores the challenges associated with integrating AI into development workflows, as these tools often generate a high volume of low-quality or irrelevant merge requests alongside the valuable findings. The partnership demonstrates a practical application of AI in strengthening the security posture of widely used technology while prompting further discussion on how to best manage the influx of AI-generated contributions.
