Claude Opus 4.6 Found 22 Firefox Security Bugs in Two Weeks

Anthropic gave Claude Opus 4.6 access to Firefox's C++ codebase and tasked it with hunting for security vulnerabilities autonomously. Over two weeks in January 2026, the model scanned nearly 6,000 C++ files — the core of Firefox's engine — and submitted 112 unique vulnerability reports. Of those 112 reports, 22 were confirmed as real, previously unknown security vulnerabilities.

Mozilla chose Firefox for the experiment specifically because of its complexity and reputation as one of the most rigorously audited open-source projects in the world. If Claude was going to be tested against something hard, Firefox was the right target. The fact that it found 22 valid bugs — not theoretical issues, but real confirmed flaws — in that context is significant.

One result stood out immediately: Claude spotted a use-after-free bug in Firefox's JavaScript engine in just 20 minutes. That's the kind of critical memory corruption flaw that attackers actively hunt for, because it can enable arbitrary code execution. A human researcher validated the finding in a virtualized environment before it was formally reported to Mozilla.

Of the 22 confirmed vulnerabilities: 14 were rated high severity, 7 were moderate, and 1 was low. Anthropic noted that the 14 high-severity findings represent "almost a fifth" of all high-severity vulnerabilities patched in Firefox across the entirety of 2025. In a two-week AI-assisted audit, Claude matched roughly 20% of an entire year's worth of critical Firefox bug discovery by human researchers.

All 22 bugs were patched by Mozilla and shipped in Firefox 148. Anyone running Firefox 148 or later is already protected. The full advisory is publicly available on Mozilla's security advisory page.

Finding a vulnerability is one thing. Turning it into a working weapon is another. Anthropic ran a second phase of the experiment to test exactly that: they gave Claude the full list of discovered vulnerabilities and asked it to develop working exploits. The model attempted this several hundred times, spending approximately $4,000 in API credits. It succeeded in only two cases.

Anthropic framed this result as meaningful in two directions. First, it demonstrates that AI can find vulnerabilities significantly faster than attackers can reliably weaponize them — a real defensive advantage. The gap between discovery and exploitation is a window that defenders can use. Second, the cost ($4,000 for hundreds of attempts, two successes) suggests that autonomous AI exploitation, while possible in principle, remains expensive and unreliable at this stage.

That gap won't last forever. Anthropic explicitly acknowledged in its report that future models may close the exploitation difficulty gap, raising concerns about dual-use risks. The current cost and failure rate limits immediate threats — but that calculus could change as models improve and costs fall.

AI-assisted vulnerability research has been a topic of speculation for years. This is one of the first major public demonstrations of it working at scale against a real-world production codebase, with validated results and shipped patches. The practical implication for security teams is straightforward: Claude can now function as a force multiplier for code audits — scanning C++ codebases at speeds no human team could match, flagging patterns that might take a human weeks to notice.

Mozilla's integration of the patches into Firefox 148 is cited as a potential model for the industry — AI auditing feeding directly into a continuous security pipeline, with quick turnaround from discovery to patch. Anthropic has also signalled that Claude Code Security (launched in limited research preview alongside this disclosure) will incorporate "task verifiers" for higher-confidence AI-generated fixes, moving toward autonomous patch-and-verify workflows.

For open-source projects especially, the implications are significant. Firefox has a full-time security team. Smaller open-source projects don't. If AI-assisted auditing can produce results like this on Firefox, the same tool applied to less-scrutinised codebases could find vulnerabilities that have been sitting undetected for years.

The same capability that lets security teams run rapid AI audits is available to attackers. This is the dual-use reality of AI security tools, and it's not unique to Claude — it applies to every capability advance in this space. Anthropic's position is that the defensive advantage currently outweighs the offensive risk, primarily because exploitation remains harder than discovery. Whether that remains true as models improve is one of the central questions in AI security research right now.

What's clear is that the pace of AI-assisted security research is accelerating. Claude Opus 4.6's extended task horizon — up to 14.5 hours of sustained autonomous work — is what made a two-week code audit feasible at scale. As that capability matures, the volume of AI-assisted vulnerability research will only increase. Security teams that build familiarity with these tools now will be better positioned than those who wait.