Anthropic says Claude found 22 vulnerabilities in Firefox during a two-week security experiment, including flaws judged to be highly severe. The result places a language model in a role usually associated with patient human specialists: tracing unfamiliar code, testing assumptions, and locating the small mistakes that can expose millions of users. AI coding tools are commonly presented as engines of production. Here the model becomes an inspector, searching the accumulated work of other programmers for weaknesses that survived earlier review.

Finding a vulnerability is not the same as understanding its full consequences or repairing it safely. Reports must be reproduced, prioritized, and handled without giving attackers an advantage. Human security teams still decide what is real and what should happen next. Yet the scale of the experiment suggests a change in defensive work. Automated auditors can examine old code continuously, including areas that receive little attention because time and expertise are scarce. That can make software safer, but it also raises the tempo of discovery for defenders and attackers alike. The advantage will belong not simply to whoever has the strongest model, but to whoever builds the most responsible process around what the model uncovers.