# Evyatar Ben Asher and co-authors at Anthropic describe Claude’s Firefox exploit [Canonical reading](https://escapemeridian.com/readings/evyatar-ben-asher-and-co-authors-at-anthropic-describe-claude-s-1ee6ad2c) Published March 6, 2026, Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng and Daniel Freeman at Anthropic describe how Claude Opus 4.6 exploited a Firefox vulnerability in a stripped-down testing environment. They trace the bug to an optimization that unwraps a JavaScript call.bind wrapper without checking whether the underlying WebAssembly function matches the import’s declared type. A later call path can pass mismatched values directly between WebAssembly functions, bypassing the conversion layer that normally protects that boundary. The authors say Claude built memory-reading and memory-writing primitives and used them to achieve code execution in the test environment. They call Opus 4.6 the first model they had observed writing a successful browser exploit with minimal hand holding. They stress that it did not escape a modern browser’s sandbox or combine vulnerabilities into a full-chain exploit, and that Opus 4.6 succeeded only twice across hundreds of chances. Still, they call the result an early warning: motivated attackers working with LLMs may write exploits faster. They urge developers to secure more code while that work remains possible, and say Anthropic plans to expand security research and work with developers on vulnerabilities, triage and patches. The authors say it remains unclear why Claude could exploit this vulnerability but not others. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Anthropic · Article Original source date: Mar 6, 2026 (2026-03-06T00:00:00.000Z). Date basis: Date stated on the publisher’s page. Added to Escape Meridian: 2026-11-07T23:38:23.302Z. First observed: 2026-10-19T02:33:20.253Z. Retrieved: 2026-10-28T04:39:59.424Z. - [Reverse engineering Claude's CVE-2026-2796 exploit](https://www.anthropic.com/research/exploit) ## Limits The evaluation used a stripped-down js shell resembling an unsandboxed browser content process, not a modern browser with its security features intact. Text as retrieved on October 28, 2026; originally published March 6, 2026. ## Open question Why was this vulnerability easier for Claude to exploit than others? ## Source-stated The authors report that Claude Opus 4.6 wrote an exploit for a Firefox vulnerability in a testing environment. > This blog post will deep dive into how Claude wrote an exploit for CVE-2026-2796 (now patched). - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors trace the vulnerability to an optimization that unwraps a call.bind wrapper without checking the underlying function’s type against the import’s declared type. > Notice what's not checked: whether the unwrapped function's type signature matches the import’s declared type. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors say Claude used memory-reading and memory-writing primitives to achieve code execution in the stripped-down test environment. > After getting both read64 and write64 working, built entirely from standard JavaScript and WebAssembly APIs, the agent had a complete set of exploitation primitives sufficient to construct arbitrary read/write over the process's address space. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors say Opus 4.6 succeeded in exploiting a vulnerability only twice across hundreds of opportunities, and that the exploit did not escape a modern browser’s sandbox. > Opus 4.6 only turned a vulnerability into an exploit in two cases (given hundreds of chances at dozens of bugs). - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors argue that motivated attackers working with LLMs may write exploits faster, and urge developers to secure more code. > We believe this suggests motivated attackers who can work with LLMs will be able to write exploits faster than ever before. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors say they do not know why Claude could exploit this vulnerability but not others. > It’s also not clear why Claude was able to construct an exploit for this vulnerability, but not others. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source and contributor context Anthropic · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media retrieval status: unchecked. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## Anthropic Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems. - [Explore this context](/entities/anthropic) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Claude Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding. - [Explore this context](/entities/claude) - [Reference](https://claude.com/product/overview) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Editorial provenance Version 1. Publication ID: cec11dd1-7864-bf81-af5e-fb2cff674e16. Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-07T23:33:46.796Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: bridge\_admitted\_by\_model, second\_opinion\_categorical. Observation: b5beb0c520ddc9497af5599b81da04e452dfa5a401e50e9bb4b9c2b7a6f703ea. Source text hash: c2cadb2368a722a1c056bbdb1433578e9cde1b79a691241b693187478ecee0f7. ## Revision and source-check history ### Version 1 — 2026-11-07T23:38:23.302Z Published March 6, 2026, Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng and Daniel Freeman at Anthropic describe how Claude Opus 4.6 exploited a Firefox vulnerability in a stripped-down testing environment. They trace the bug to an optimization that unwraps a JavaScript call.bind wrapper without checking whether the underlying WebAssembly function matches the import’s declared type. A later call path can pass mismatched values directly between WebAssembly functions, bypassing the conversion layer that normally protects that boundary. The authors say Claude built memory-reading and memory-writing primitives and used them to achieve code execution in the test environment. They call Opus 4.6 the first model they had observed writing a successful browser exploit with minimal hand holding. They stress that it did not escape a modern browser’s sandbox or combine vulnerabilities into a full-chain exploit, and that Opus 4.6 succeeded only twice across hundreds of chances. Still, they call the result an early warning: motivated attackers working with LLMs may write exploits faster. They urge developers to secure more code while that work remains possible, and say Anthropic plans to expand security research and work with developers on vulnerabilities, triage and patches. The authors say it remains unclear why Claude could exploit this vulnerability but not others. ## Original source Anthropic · Article Original source date: Mar 6, 2026 (2026-03-06T00:00:00.000Z). Date basis: Date stated on the publisher’s page. Added to Escape Meridian: 2026-11-07T23:38:23.302Z. First observed: 2026-10-19T02:33:20.253Z. Retrieved: 2026-10-28T04:39:59.424Z. - [Reverse engineering Claude's CVE-2026-2796 exploit](https://www.anthropic.com/research/exploit) ## Limits The evaluation used a stripped-down js shell resembling an unsandboxed browser content process, not a modern browser with its security features intact. Text as retrieved on October 28, 2026; originally published March 6, 2026. ## Open question Why was this vulnerability easier for Claude to exploit than others? ## Source-stated The authors report that Claude Opus 4.6 wrote an exploit for a Firefox vulnerability in a testing environment. > This blog post will deep dive into how Claude wrote an exploit for CVE-2026-2796 (now patched). - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors trace the vulnerability to an optimization that unwraps a call.bind wrapper without checking the underlying function’s type against the import’s declared type. > Notice what's not checked: whether the unwrapped function's type signature matches the import’s declared type. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors say Claude used memory-reading and memory-writing primitives to achieve code execution in the stripped-down test environment. > After getting both read64 and write64 working, built entirely from standard JavaScript and WebAssembly APIs, the agent had a complete set of exploitation primitives sufficient to construct arbitrary read/write over the process's address space. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors say Opus 4.6 succeeded in exploiting a vulnerability only twice across hundreds of opportunities, and that the exploit did not escape a modern browser’s sandbox. > Opus 4.6 only turned a vulnerability into an exploit in two cases (given hundreds of chances at dozens of bugs). - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors argue that motivated attackers working with LLMs may write exploits faster, and urge developers to secure more code. > We believe this suggests motivated attackers who can work with LLMs will be able to write exploits faster than ever before. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source-stated The authors say they do not know why Claude could exploit this vulnerability but not others. > It’s also not clear why Claude was able to construct an exploit for this vulnerability, but not others. - [Supporting source](https://www.anthropic.com/research/exploit) ## Source and contributor context Anthropic · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media retrieval status: unchecked. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## Anthropic Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems. - [Explore this context](/entities/anthropic) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Claude Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding. - [Explore this context](/entities/claude) - [Reference](https://claude.com/product/overview) - [Reference](https://www.anthropic.com/news) - [Reference](https://www.anthropic.com/research/team/economics) ## Editorial provenance Version 1. Publication ID: cec11dd1-7864-bf81-af5e-fb2cff674e16. Prepared by openai/gpt-6-luna; grounding review by anthropic/claude-opus-5.5. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-07T23:33:46.796Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: bridge\_admitted\_by\_model, second\_opinion\_categorical. Observation: b5beb0c520ddc9497af5599b81da04e452dfa5a401e50e9bb4b9c2b7a6f703ea. Source text hash: c2cadb2368a722a1c056bbdb1433578e9cde1b79a691241b693187478ecee0f7. ### uncertain — 2026-11-07T23:33:46.796Z — anthropic/claude-opus-5.5 Publication: cec11dd1-7864-bf81-af5e-fb2cff674e16 attribution — pass: The reading correctly credits Anthropic and the five named authors. Their claims stay attributed to them, and the page is a single article, not a listing. > Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, and Daniel Freeman summary — uncertain: The question 'Why was this vulnerability easier...' treats as settled something the authors only suggest: they say the bug 'may' have been 'easier' and that the reason is unclear. Smallest repair: 'Why could Claude exploit this vulnerability but not others?' Central terms also go unexplained for general readers: WebAssembly, call.bind, exploit primitives, code execution and sandbox. A brief plain-language gloss of each, or tooltip additions, would fix this. > This bug may have also been “easier” for Claude to exploit, because translating this type confusion into exploit primitives didn’t require sophisticated heap manipulation date — pass: 'March 6, 2026' matches the UTC calendar day of originalPublished. The reading uses no later events and adds no hindsight framing, and the forecasts stay attributed to the authors. The page was modified on 2026-10-23, but the dated content the reading relies on reads as part of the original post. > Today we published an update on our collaboration with Mozilla, in which Claude Opus 4.6 found 22 vulnerabilities in Firefox over the course of two weeks. support — uncertain: Most claims match the source text. However, 'secure more code while that work remains possible' changes the source's 'window' framing. The authors mean a window to raise the skill attackers need, not a period after which securing code becomes impossible. Smallest repair: 'urge developers to use this window to make their software more secure.' The page was also edited after publication (2026-10-23), so these claims cannot be fully confirmed as part of the original text. > We urge developers to take advantage of this window to redouble their efforts to make their software more secure. media — pass: No media was selected and no verified candidates were supplied, so there is no media identity or relevance issue. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/1ee6ad2c4eada78ffcdd83d574e972be6030b53bc0f59ec0d6793809899ddc6d/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/evyatar-ben-asher-and-co-authors-at-anthropic-describe-claude-s-1ee6ad2c.json)