AI Finds Firefox Vulnerabilities Faster Than Ever – But Beware False Positives

Anthropic’s Claude Opus 4.6 is demonstrating a surprising aptitude for uncovering cybersecurity vulnerabilities, recently identifying 22 flaws within Mozilla Firefox over a two-week period. This discovery, detailed in a recent report, surpasses the number of vulnerabilities reported in any single month during 2025, signaling a potential shift in how software security is approached. The findings highlight both the promise and the potential pitfalls of relying on AI for security testing.

Accelerated Vulnerability Detection

The collaboration between Anthropic and Mozilla saw Claude Opus 4.6 pinpoint 22 vulnerabilities, with Mozilla classifying 14 of those as high-severity. This represents nearly a fifth of all high-severity Firefox vulnerabilities addressed in 2025. The speed at which Claude identified these issues is particularly noteworthy; it found more vulnerabilities in February 2026 than were reported in any entire month of the previous year. This suggests AI-driven security analysis can significantly accelerate the detection of critical flaws, potentially reducing the window of opportunity for exploitation. Mozilla subsequently shipped fixes for these vulnerabilities in Firefox version 148.0, impacting hundreds of millions of users.

The process wasn’t simply a matter of Claude autonomously finding and reporting bugs. Mozilla researchers actively worked with the AI’s output, helping to determine which findings warranted formal bug reports and refining the process. This collaborative approach proved crucial, demonstrating a model for how AI and human security experts can function together effectively.

Beyond Identification: Exploitation and Limitations

While Claude excelled at identifying potential vulnerabilities, its ability to exploit them proved more limited. The AI successfully created functional exploits for only two of the 22 vulnerabilities it discovered. These exploits were described as “crude” and unlikely to succeed in real-world scenarios due to existing security safeguards within Firefox. This suggests that while AI can be highly effective at finding weaknesses, it currently lacks the sophistication to consistently translate those weaknesses into actionable attacks. This distinction is important; identifying a vulnerability is only the first step, and a successful exploit is required to truly compromise a system.

The Rise of “AI Slop” and False Positives

The increasing reliance on AI for vulnerability detection isn’t without its challenges. Daniel Stenberg, lead developer at curl, cautioned against over-reliance on AI-generated reports, noting a significant increase in “AI slop” – false positive vulnerability reports. According to Stenberg, fewer than one in 20 bug reports received by his company in 2025 were actually legitimate. He stated in a comment to The Wall Street Journal that AI chatbots “still easily hallucinate security problems.” This highlights the need for careful human review and validation of AI-generated findings to avoid wasting valuable security resources on non-existent threats.

Anthropic’s Expanding Role in Cybersecurity

Anthropic’s foray into cybersecurity extends beyond simply identifying vulnerabilities. The company recently launched Claude Code Security, a tool designed not only to highlight weaknesses but likewise to suggest targeted software fixes for human review. PCMag reports that this fresh offering has already begun to impact the cybersecurity market, contributing to a decline in the share prices of some of the largest cybersecurity companies. This suggests that AI-powered security tools are poised to disrupt the traditional cybersecurity landscape, potentially automating tasks previously performed by human security analysts.

The Firefox CVE Landscape

Mozilla maintains a public database of Common Vulnerabilities and Exposures (CVEs) related to Firefox. While the specific CVE numbers for the 22 vulnerabilities identified by Claude Opus 4.6 haven’t been publicly released as of March 8, 2026, the Mozilla Security Advisories page (https://www.mozilla.org/security/) provides a comprehensive overview of previously addressed vulnerabilities. Understanding the CVE system is crucial for tracking and mitigating security risks. Each CVE is assigned a unique identifier and a severity score, allowing security professionals to prioritize remediation efforts.

What Comes Next: A Hybrid Approach

The collaboration between Anthropic and Mozilla points towards a future where AI plays an increasingly important role in software security, but not as a replacement for human expertise. The most effective approach appears to be a hybrid model, where AI tools are used to accelerate vulnerability detection and analysis, while human security researchers provide critical validation, exploit development, and remediation guidance. Further research is needed to improve the accuracy of AI-powered vulnerability detection and reduce the incidence of false positives. The ongoing development of tools like Claude Code Security will likely focus on enhancing the quality of suggested fixes and integrating seamlessly into existing software development workflows. Expect to spot more partnerships between AI developers and software vendors as the industry seeks to leverage the benefits of AI while mitigating its risks.