Loading story…
OpenAI launched Patch the Planet, a Daybreak initiative aimed at supporting open source maintainers, while separately disclosing that its GPT-5.5 safety evaluation helped uncover a high-severity Firefox vulnerability. The flaw, tracked as CVE-2026-8390, was a use-after-free bug in Firefox’s WebAssembly implementation, and Mozilla credited OpenAI Preparedness and Bill Demirkapi for reporting it.
Mozilla fixed the issue in Firefox 150.0.3, with the patch landing shortly before Pwn2Own Berlin. Together, the initiative and the Firefox disclosure show OpenAI tying AI safety work to practical software security outcomes, including direct support for maintainers and the identification of exploitable defects in widely used open source software.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
OpenAI stated that its GPT-5.5 model identified CVE-2026-8390 during a model safety evaluation. The disclosure context linked the finding to the Firefox 150.0.3 patch release shortly before Pwn2Own Berlin.
OpenAI announced Patch the Planet, a Daybreak initiative to support open source maintainers. The announcement was made in an OpenAI blog post published that day.
Mozilla patched a high-impact use-after-free vulnerability in Firefox's WebAssembly implementation in Firefox 150.0.3. Mozilla credited OpenAI Preparedness and Bill Demirkapi for reporting the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic reported that **Claude Opus 4.6** identified **22 security vulnerabilities in Mozilla Firefox** during a **two-week** collaboration with Mozilla, with **14** categorized as **high severity**. The work began in Firefox’s **JavaScript engine** and expanded across the broader codebase, demonstrating that an AI model can rapidly surface memory-safety and other complex issues in a mature, heavily scrutinized open-source project; one example cited was a **use-after-free** class bug discovered early in the effort. Mozilla validated the findings and shipped fixes, with most issues addressed in **Firefox 148** (and some remediations deferred to a subsequent release, per reporting). Separate reporting discussed market and product implications of Anthropic’s *Claude Code Security* feature—an AI-assisted code-scanning capability that suggests patches and is positioned as an alternative to traditional rules-based static analysis—along with investor reactions affecting major security vendors. While related to AI-driven secure development, that coverage does not describe the Firefox vulnerability-discovery engagement itself and is better treated as adjacent industry context rather than part of the same specific event.
Jun 29, 2026
Anthropic disclosed that its **Claude Mythos Preview** model autonomously discovered and, in some cases, exploited vulnerabilities across major software targets, including **Firefox**, **OpenBSD**, **FreeBSD**, **Linux**, **FFmpeg**, cryptography libraries, and a memory-safe virtual machine monitor. The company said the system produced browser exploit chains involving JIT heap sprays and sandbox escapes, chained Linux kernel flaws into local privilege escalation, and developed a fully autonomous exploit for **`CVE-2026-4747`**, a FreeBSD NFS issue that reportedly enables unauthenticated remote root access. Anthropic said most findings remain under coordinated disclosure because fewer than 1% had been patched at the time of publication. Publicly described examples included a **27-year-old OpenBSD SACK denial-of-service bug** that was later addressed in an OpenBSD patch, and a **16-year-old FFmpeg H.264 out-of-bounds write**. Anthropic also said it partnered with Mozilla to improve Firefox security, underscoring that modern AI systems are now capable of meaningful autonomous vulnerability research against widely deployed platforms. To limit immediate misuse, the company withheld most technical details and published **SHA-3 commitments** for future disclosure while urging defenders to accelerate AI-assisted bug hunting, patching, disclosure coordination, and incident-response automation.
Jul 28, 2026
Mozilla said **Firefox 150** shipped with fixes for **271 security vulnerabilities** identified during an early evaluation of Anthropic’s restricted **Claude Mythos Preview** model, a sharp increase from the **22 bugs** previously found with Anthropic’s Opus 4.6 in Firefox 148. Mozilla CTO Bobby Holley said the findings created a major engineering burden and forced reprioritization, but argued the work was necessary because AI-assisted vulnerability discovery is rapidly improving and can now reason about source code at a level Mozilla compared to elite human researchers. Mozilla said the model did not uncover wholly new classes of flaws beyond human capability, but it found known types of bugs at much greater speed and scale, including issues traditional fuzzing might miss.
Jun 29, 2026