Mozilla says Claude Opus 4.6 found 100+ bugs in Firefox in two weeks in January, 14 of them high-severity, more than the bugs typically reported in two months
Mozilla has a substantially larger near-term queue of Firefox defects to triage, reproduce, prioritize and patch, including 14 classified as high severity.
Claude Opus 4.6 gains a documented Firefox result: more bugs found in two weeks than Mozilla says are typically reported over two months.
Second-order effects
Mozilla's security workflow shifts toward validation and remediation capacity as AI increases the volume of candidate findings; the Firefox 150 fixes suggest that discovery can translate into release work when the findings are usable.
Other browser and security teams will have reason to test comparable models against their own codebases, while demanding evidence on false positives, severity assessment and patch quality rather than treating raw finding counts as sufficient.
Third-order effects
If AI-assisted auditing repeatedly produces actionable findings at this rate, software security programs may be differentiated less by who can search code and more by who can verify, fix and safely release the resulting volume of issues.
The pattern points toward AI models becoming a standing layer in vulnerability discovery across large codebases, with maintainers retaining responsibility for adjudication and coordinated remediation.
The trend: AI coding models are moving from developer assistance toward continuous security auditing, raising the premium on human-led triage and patch delivery.
the key point is that we're currently in a golden window where LLMs are asymmetric weapons: they are more effective tools for the defenders than the attackers there is no reason to believe this will last, and we should harden all software as much as possible before that changes […
We partnered with Mozilla to test Claude's ability to find security vulnerabilities in Firefox. Opus 4.6 found 22 vulnerabilities in just two weeks. Of these, 14 were high-severity, representing a fifth of all high-severity bugs Mozilla remediated in 2025. [image]
this is the worst the technology will ever be at finding vulns. going to take a near-total overhaul of the software stack. defense beats offense in cyber but only if defense takes the magnitude of the task seriously enough for long enough.
A very practical example of why US AI leadership (and compute advantage) matters. If China got to Opus 4.6 first, do you think they'd tell US software companies about their code vulnerabilities or try to exploit them before we caught up?
Back in ~November, our team picked a stretch goal of seeing if we could find and fix vulnerabilities in Firefox with Opus 4.6. In 2 weeks, we found 22, and ~1/5th of all high severity CVEs in a year. For our team, this feels like a rubicon moment. [image]
I love these blogs because they always contain something like this. “We ran this test several hundred times with different starting points, spending approximately $4,000 in API credits. Despite this, Opus 4.6 was only able to actually turn the vulnerability into an exploit in t…