Anthropic reports Claude finding Firefox vulnerabilities with Mozilla

Anthropic reports Claude finding Firefox vulnerabilities with Mozilla

Anthropic published this account on March 6, 2026, describing a collaboration with Mozilla in which Claude Opus 4.6 found vulnerabilities in Firefox. Anthropic says Mozilla classified some findings as high severity and fixed most reported issues in Firefox 148. The account describes Mozilla helping Anthropic decide what to report, including submitting findings in bulk without validating each one; Anthropic says the collaboration helped it adjust its approach. Anthropic also reports that Claude could turn vulnerabilities into working exploits in only a small number of its tests. Those exploits worked only in a test environment that lacked some security features found in modern browsers, including the sandbox. Anthropic says this leaves vulnerability discovery ahead of exploitation for now, but warns that the gap may not last. Its conclusion is that developers should use this window to improve software security, while Anthropic plans to expand its work with developers on finding, triaging and fixing vulnerabilities. How quickly, if at all, might models’ ability to exploit vulnerabilities catch up with their ability to find them?

Publication: 5e1db1c6-4016-5162-17e5-0c0826c77512

attribution — pass: The reading consistently attributes the account, figures and warnings to Anthropic, which published the post. Mozilla's actions, including its severity ratings, fixes and bulk-submission advice, are presented as Anthropic's description of them. The source is a single article, not a listing.

In this post, we share details of a collaboration with researchers at Mozilla in which Claude Opus 4.6 discovered 22 vulnerabilities

summary — uncertain: The reading faithfully covers the collaboration, the limited exploit results, the caveat about the test environment lacking the sandbox, and Anthropic's warning about a closing window. However, central terms are not explained and the definitions list is empty: exploit, sandbox and triaging. The source glosses some terms itself, such as zero-day and Use After Free. A general reader may not grasp the difference between finding a vulnerability and exploiting it, which the question depends on. The smallest repair is a plain-language gloss or term-library tooltip for exploit and sandbox. The question is substantive and grounded in the source.

we wanted to understand whether Claude could also develop the sorts of tools that a hacker would use to take advantage of these bugs to execute malicious code

date — pass: The stated date of March 6, 2026 matches the UTC calendar day of evidence.originalPublished. The evidence is a publisher page, so no archive disclosure is needed. The forecast that the gap will close is reported as Anthropic's warning, not as an outcome. The page was edited after publication, which the limitations disclose. The cited passages (Firefox 148, February 2026 findings, exploit tests) are consistent with the original March piece. The reading does not use the later-sounding passage saying Mozilla has since begun experimenting internally.

Claude Opus 4.6 found 22 vulnerabilities in February 2026, more than were reported in any single month in 2025.

support — pass: Each claim matches its quoted text: 22 vulnerabilities with 14 rated high severity, most fixes shipped in Firefox 148, exploits produced in two cases over several hundred runs, and exploits that worked only without the sandbox. The warning about the gap and the call for developers to act are also quoted accurately. Anthropic's planned expansion is supported by the source. These cited passages appear to be core parts of the original article rather than later edits. Grounding in the source does not independently verify Anthropic's claims.

We urge developers to take advantage of this window to redouble their efforts to make their software more secure.

media — pass: No media was selected and no verified media candidates were supplied, so there is no identity or relevance issue to check.