In a recent security partnership with Mozilla, Anthropic discovered 22 separate vulnerabilities in Firefox. Fourteen of these were classified as high-severity. Most of the bugs have been fixed in Firefox 148, the version released this February, although a few fixes will have to wait for the next release.
Anthropic’s team used Claude Opus over a two-week period, starting with the JavaScript engine and then expanding to other portions of the codebase. According to the post, the team focused on Firefox because it is both a complex codebase and one of the most well-tested and secure open-source projects in the world.
Notably, Claude Opus was much better at finding vulnerabilities than writing software to exploit them. The team ended up spending four thousand dollars in API credits trying to concoct proof-of-concept exploits, but only succeeded in two cases.
This partnership serves as a reminder of how powerful AI tools can be for open source projects, even if they can bring a flood of bad merge requests alongside the useful ones.