Anthropic's Claude Opus 4.6 has discovered 22 vulnerabilities in Firefox, 14 of which are high severity, during a two-week testing phase.
Anthropic's AI model, Claude Opus 4.6, has uncovered 22 vulnerabilities in the Firefox browser within a two-week testing period, with 14 categorized as high severity by Mozilla.
"We partnered with Mozilla to test Claude's ability to find security vulnerabilities in Firefox. Opus 4.6 found 22 vulnerabilities in just two weeks. Of these, 14 were high-severity, representing a fifth of all high-severity bugs Mozilla remediated in 2025," stated Anthropic on social media.
This finding constitutes approximately 20% of the high-severity issues that Mozilla addressed throughout 2025.
During the two-week evaluation, the Anthropic team specifically selected Firefox due to its reputation as a highly tested and secure open-source project, albeit complex. The initial focus was on the JavaScript engine, allowing for a more contained analysis before extending to other segments of the codebase.
In a notable discovery, Claude identified a Use After Free vulnerability within just 20 minutes, which could permit attackers to substitute legitimate data with arbitrary content.
The model scanned close to 6,000 C++ files and generated 112 issue reports, most of which were resolved in Firefox version 148 released in February. Remaining issues are set to be patched in future updates.
Post-collaboration, Mozilla researchers have begun to independently explore the use of Claude for detecting vulnerabilities.
While Anthropic highlighted Claude's proficiency in identifying vulnerabilities, it noted that the model struggled to exploit them effectively. In an experiment to demonstrate this, Claude was tasked with executing a real attack using the identified Use After Free vulnerability, but it was only successful in two out of several hundred attempts, despite spending around $4,000 on API usage.
“This demonstrates an advantage for cybersecurity professionals utilizing AI, yet the model's ability to create even basic malware raises concerns,” Anthropic remarked.
Notably, in February, a similar coding endeavor with Claude Opus 4.6 resulted in a $1.78 million hack of the DeFi project Moonwell.
