Wedoany.com Report on 9th, US artificial intelligence company Anthropic recently announced that, through a security collaboration with Mozilla, it used its Claude Opus 4.6 large language model to identify 22 new security vulnerabilities in the Firefox web browser. These vulnerabilities include 14 high-risk, 7 medium-risk, and 1 low-risk issues, which have been fixed in the Firefox 148 version released at the end of last year. 
Anthropic stated that the Claude Opus 4.6 model completed this detection work over a two-week period in January 2026. The model discovered a use-after-free vulnerability in JavaScript in just 20 minutes, which was subsequently verified and confirmed by researchers in a virtualized environment. The company scanned nearly 6,000 C++ files and submitted 112 unique reports, with the high-risk vulnerabilities accounting for nearly one-fifth of the high-risk vulnerabilities fixed in Firefox in 2025.
The company also attempted to have the Claude model develop exploit programs for the vulnerabilities. After hundreds of tests and the consumption of approximately $4,000 in API credits, the model successfully generated exploit programs in only two cases. Anthropic noted, "The cost of identifying vulnerabilities is cheaper than creating exploit programs; the model is better at finding problems than exploiting them." One successful case was an exploit program for CVE-2026-2796 (CVSS score: 9.8), involving a just-in-time compilation error in the JavaScript WebAssembly component.
Anthropic emphasized that these exploit programs were only effective in a test environment where security features like sandboxing had been intentionally removed. The company stated, "The fact that Claude can automatically develop rough browser exploit programs, even in just a few cases, is concerning." The task verifier component used in the process provided real-time feedback, helping to iteratively design successful exploit programs.
This disclosure comes a few weeks after Anthropic released its Claude Code Security tool, which is designed to use AI agents to fix vulnerabilities. The company said, "The task verifier increases our confidence that the generated patches will fix specific vulnerabilities while maintaining program functionality." Mozilla confirmed in a coordinated announcement that the AI-assisted approach also discovered 90 other vulnerabilities, most of which have been fixed, including logic errors not caught by fuzz testing.
Mozilla stated, "The scale of discovery reflects the power of combining rigorous engineering with new analysis tools. Large-scale AI-assisted analysis is a powerful new addition to the security engineer's toolbox." This collaboration demonstrates the potential application of AI in the cybersecurity field while highlighting its efficiency advantages in vulnerability identification.
