How AI helps make the software we use more secure

AI can make the software we use more secure by helping us find defects that previous checks missed. That happened with Firefox, a browser developed and examined for years: in the collaboration Anthropic described in March 2026, Claude Opus 4.6 helped identify 22 vulnerabilities over two weeks. Mozilla classified 14 as high severity.

This was not newly written, untested software. That is precisely what makes the case interesting: new analysis tools can uncover problems even in mature products. Discovering those problems does not suddenly make the software insecure. It creates an opportunity to address weaknesses that were previously unknown.

The Firefox story lets us follow that opportunity to a concrete outcome: a defect identified in code, verification by researchers, a fix and, finally, an update that reaches users. AI contributes at the beginning of this sequence, but the benefit depends on completing it.

Firefox: new flaws in software tested for years

Anthropic’s researchers chose Firefox because it is complex, widely used and extensively tested. As their account of the Mozilla collaboration explains, they began with the JavaScript engine, the component that executes code from web pages.

The reason is practical: a browser constantly processes content it does not control. A page can come from a trusted website or from someone trying to exploit an error. How the browser handles memory and code execution is therefore an important part of its security.

According to the report, after roughly twenty minutes of exploration the model flagged a possible use-after-free error: the program could access memory after it had been released. Researchers reproduced the problem in a virtual machine and carried out further checks before reporting it to Mozilla.

The important result was not a convincing model response, but a defect that other people could reproduce. That distinction turns a hypothesis into a useful report. The model indicated where to look; verification established that the problem was real.

How a report becomes a confirmed vulnerability

While researchers checked the initial findings, the model continued producing new cases to examine. This did not mean that every case was a vulnerability: an input that crashes a program does not, on its own, demonstrate that someone can compromise the system.

Working with Mozilla helped distinguish these outcomes. Anthropic describes submitting 112 unique reports during the effort, compared with the 22 vulnerabilities identified. These are different measures: one describes material to investigate, the other the security problems recognized through the research.

This reveals AI’s specific contribution. It can help explore code and construct test cases, while researchers and maintainers interpret the results, resolve misunderstandings and decide how to respond. The process remains technical and verifiable, rather than relying on trust in the model.

AI makes research more useful when it produces evidence that maintainers can check. In the Firefox case, the report emphasizes reproducible tests, descriptions of the problem and candidate fixes. These give people who understand the software the information needed to move from a report to a solution.

Finding a flaw is also different from exploiting it. In a separate experiment described by Anthropic, the model produced exploits in only two cases, in an environment with some browser protections removed, including the sandbox. That does not demonstrate an ability to compromise any Firefox installation automatically. It shows why discovery, verification and exploitation must be treated as distinct steps.

Why more reported vulnerabilities are not only bad news

The Firefox case gains a broader perspective from Epoch AI’s cyber vulnerabilities dataset. The project uses public records from the CVE Program, which assigns identifiers to known vulnerabilities, to track their publication over time.

In its analysis of July 2026, covering 21 major organizations, critical vulnerabilities rise from 35 in January to 98 in April and 606 in July. High-severity vulnerabilities rise from 268 to 600 and then 1,906 over the same months. These are figures from the table published in that analysis, not estimates read visually from a chart.

This is the kind of growth captured by the phrase “Cyber Risk Goes Parabolic.” But the data measures published vulnerabilities, not successful attacks or even the time of discovery. Epoch AI explains that reporting practices and classifications differ between organizations and that historical counts can be revised. The chart alone does not establish how much of the increase is caused by AI.

Part of progress in security is making previously unknown problems visible. The Firefox case demonstrates that possibility; rising disclosures make handling it more urgent. A new CVE does not have to be interpreted as evidence that the software is getting worse.

The decisive question comes next: what do we do with what we have discovered? If the result is only a longer list, the benefit remains incomplete. If reports lead to fixes, the software can become more secure.

From discovering a flaw to fixing Firefox

For Firefox, that step is documented. The Firefox 148 security advisory lists corrected vulnerabilities and credits several discoveries to researchers using Claude. The work did not stop at the model provider’s claims: it became part of the browser’s maintenance process.

Fixing a problem, however, takes more than changing a line of code. The team must verify that the defect no longer occurs and that the program continues to behave as intended. A change that removes one problem but introduces errors elsewhere is not yet a good fix.

Anthropic’s report describes the value of giving AI tools reliable checks: tests that establish whether the original problem remains reproducible and tests that detect regressions. Passing these checks supports technical review; it does not automatically make every model-generated patch ready for approval.

A discovery improves software when it becomes a verified, shipped fix. This is where AI can contribute beyond the initial research, helping prepare tests and candidate solutions. Maintainers remain responsible for deciding whether those changes are appropriate for the project.

One last step remains. The new version may be available, but users still need to receive it.

The update must reach the systems we use

For Firefox users, the benefit of a corrected vulnerability depends on adopting a version that contains the fix. Publishing a patch does not, by itself, change every older installation. The distinction sounds simple, but in a business it becomes a practical management problem.

A browser may be installed on many devices, updated through different processes and schedules. Before considering an issue resolved, the organization needs to know which versions remain installed and whether the update was successfully deployed. It is not enough for the security team to read the advisory or for an update to be approved.

The same logic applies to other software. The component’s producer must fix it; those integrating it must check compatibility; those managing systems must deploy and verify the update. Every step can require work, and none is automatically eliminated by the speed at which a model found the defect.

Users benefit when the fix is present in the software they are actually using. Current inventories, clear ownership and reliable release processes complete that journey. AI can help match advisories against installed versions, but its conclusions must be checked against real systems.

This is how a research case becomes a lesson for businesses: investing in discovery is useful when its results can reach the applications and devices people use every day.

AI’s value lies in the software we improve

Firefox does not tell the story of a browser that suddenly became fragile. It shows how new tools can help find defects in a mature product, and how cooperation between researchers and maintainers can turn those discoveries into fixes.

That perspective differs from reading a chart only as an alarm. More known vulnerabilities can also represent an opportunity: problems we could not previously address become identifiable and fixable. That opportunity is lost if the ability to analyze grows without a corresponding ability to verify, correct and update.

AI helps make software more secure when it connects the discovery of a weakness to its removal from real systems. Its value does not end with the number of flaws found. It is reflected in the quality of the software we continue to use after that work.