Mozilla and Anthropic’s Frontier Red Team collaborated on AI-assisted vulnerability hunting in Firefox, discovering 22 CVEs including 14 high-severity bugs, almost a fifth of all high-severity Firefox vulnerabilities remediated in 2025. As Anthropic’s writeup details, the team used “task verifiers” to let Claude validate its own work against the codebase, and Claude proved significantly better at finding vulnerabilities than exploiting them: it managed only two crude exploits from several hundred attempts, and those only worked with the browser sandbox switched off. The exploit writeup walks through one of them, a type confusion in the WebAssembly JIT (CVE-2026-2796) that Claude turned into arbitrary read/write and code execution in a stripped-down js shell. All issues are patched in Firefox 148, and the takeaway is clear: AI finds logic errors that traditional fuzzing misses, but the window of defensive advantage won’t stay open forever.
