Mozilla Partners with Anthropic to Better Secure Firefox

Mozilla and Anthropic announced that they are partnering to improve the security and stability of the Firefox web browser.

“A few weeks ago, Anthropic’s Frontier Red Team approached us with results from a new AI-assisted vulnerability-detection method that surfaced more than a dozen verifiable security bugs, with reproducible tests,” Mozilla’s Brian Grinstead and Christian Holler explain. “Our engineers validated the findings and landed fixes ahead of the recently shipped Firefox 148.”

As Mozilla explains, this isn’t a one-off: Unlike the previous AI-assisted bug reports it’s received, which included false positives that required unnecessary work on its part, the Anthropic bug reports were different. They focused on the Firefox JavaScript engine. And each included minimal test cases to help Mozilla quickly verify and reproduce each issue.

The results were so overwhelmingly positive that the two organizations began collaborating on the rest of the Firefox codebase within hours.

“In total, we discovered 14 high-severity bugs and issued 22 CVEs [common vulnerabilities and exposures] as a result of this work,” Mozilla says. “All of these bugs are now fixed in the latest version of the browser. In addition to the 22 security-sensitive bugs, Anthropic discovered 90 other bugs, most of which are now fixed.”

Anthropic says that it’s been using its AI models to identify high-severity vulnerabilities in complex software, and it’s found over 500 zero-day vulnerabilities in open source software so far.

“AI is making it possible to detect severe security vulnerabilities at highly accelerated speeds,” Anthropic says. “As part of this collaboration, Mozilla fielded a large number of reports from us, helped us understand what types of findings warranted submitting a bug report, and shipped fixes to hundreds of millions of users in Firefox 148.0. Their partnership, and the technical lessons we learned, provides a model for how AI-enabled security researchers and maintainers can work together to meet this moment.”

Anthropic Claude scanned almost 6,000 C++ files and submitted a total of 112 unique bug reports to Mozilla. Most of the bugs, including the most serious, were fixed in Firefox 148, and the rest will be fixed soon. Interesting stuff.