Claude Found 17 Firefox CVEs in Two Weeks. Here's What Indie Hunters Should Actually Steal From It.

If you missed it: between MFSA 2026-15 (released April 1, 2026, covering Firefox ESR 140.8) and MFSA 2026-30 (April 21, 2026, Firefox 150), Mozilla credited at least 17 high-severity CVEs to "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic." A few weeks later, MFSA 2026-45 added a Firefox 150.0.3 use-after-free credited to OpenAI Preparedness. The frontier-lab security teams are now on Mozilla's advisory page next to seasoned fuzzing-team names.

Anthropic's own writeup says it cleaner: in two weeks, Claude Opus 4.6 produced 112 unique reports, of which 22 were validated as vulnerabilities, 14 high-severity. That's roughly 1 in every 5 high-severity Firefox bugs patched in 2025. The model scanned ~6,000 C++ files. The first use-after-free landed inside twenty minutes.

This post is what an indie bug bounty hunter — without Anthropic-tier compute or a team of seven adversarial-ML PhDs — should actually steal from the campaign. Spoiler: it isn't "use Claude to find Firefox bugs." Mozilla suspended their paid bounty program in early 2026 because of AI-spam flooding. The Firefox lane pays zero now, no matter who finds the bug.

What Claude actually did

Per Anthropic's Firefox post (https://red.anthropic.com/2026/firefox/) and the broader zero-days writeup (https://red.anthropic.com/2026/zero-days/), the methodology was deliberately boring:

1. Put Claude in a VM with the latest source of Firefox and standard tools — git, grep, clang, rg. No custom MCP server. No specialised fuzzing harness. "We didn't provide any special instructions."
2. Pointed it at the JavaScript engine as the first slice — SpiderMonkey is large enough to be interesting, small enough to be reasoned about as a unit.
3. Used "task verifiers" — tools that give the model real-time feedback on whether a hypothesis is correct. The verifier is the part of the harness that turns reading-into-prose into reading-with-purpose.
4. Read commit history first. This is the lesson worth tattooing on your monitor. Claude was instructed (or just learned, depending on how Anthropic worded it) to look at past fixes for memory-safety bugs and find unpatched neighbours of the same shape. That's literally the play.
5. Submitted in bulk, not in serial. Initially Anthropic tried to validate each finding and write a candidate patch before submitting. Mozilla pushed them to submit the unvalidated firehose because the validation step was the bottleneck.

The CVE classes Claude bagged map cleanly onto the SpiderMonkey threat surface:

| Component | Bug class | Example CVE |
|---|---|---|
| JS Engine | Use-after-free | CVE-2026-2763, 2765, 2766, 2785, 2786 |
| JS Engine: JIT | Use-after-free / miscompilation | CVE-2026-2764 |
| DOM: Bindings, Window, HTML Parser | Use-after-free / undefined behaviour | CVE-2026-2770, 2771, 2787 |
| Storage: IndexedDB | Use-after-free | CVE-2026-2769 |
| Audio/Video (Playback, GMP) | UAF / integer overflow / boundary | CVE-2026-2772, 2774, 2788 |
| Web Audio | Incorrect boundary conditions | CVE-2026-2773 |
| Graphics: ImageLib | Use-after-free | CVE-2026-2789 |
| Networking: Cache | Mitigation bypass | CVE-2026-2791 |
| Firefox 150 ESR (later batch) | Invalid pointer / UAF | CVE-2026-6746, 6757, 6758 |

The pattern shows up over and over: read a known fix in the JS engine, find the sibling code path nobody patched. That's the exact play patch_diff_hunter runs at single-commit scale — Anthropic just ran it at full-codebase scale.

What it cost — and the part nobody tells you

The press numbers are seductive: "Claude found 1 in 5 high-severity Firefox bugs at AI speed." The footnote: exploit development on the bugs Claude found cost roughly $4,000 in API credits across several hundred attempts and yielded two working primitive exploits, both requiring disabled browser security features. The Mythos Preview system (Anthropic's specialised exploit-development harness) was an order of magnitude better — 181 working exploits, register-control on 29 more — but it's not the kind of thing a solo hunter spins up over a weekend.

So: cheap to find bugs. Expensive to weaponise them. And the bug bounty economy pays for impact, not for unreduced UAFs sitting in a JIRA queue.

Why this doesn't pay (and what just changed)

Mozilla's HackerOne program page, last edited April 22, 2026, says it plainly:

"Nextcloud does not offer monetary bounties for security reports submitted through this program. Due to the large amount of AI-generated illegitimate reports, we have temporarily suspended our paid bounty program and no financial rewards will be awarded for any submissions, regardless of severity."

That's NextCloud, but the same backlash hit Mozilla too. The flood of low-effort LLM-generated reports across every program that lets researchers submit text into a textarea has triagers exhausted. Some programs (huntr, Patchstack, Bitwarden) are still paying. Others have quietly become reputation-only. The hard rule for any session that starts with "let's hunt $TARGET" is verify the program pays today — not what you remember from six months ago.

Anthropic and Mozilla got around the bot-flood problem by having an invited collaboration. Anthropic's team had a direct line, hand-validated patches, and Mozilla knew the reports weren't slop. An indie hunter dropping a Claude-found UAF into the public submission queue gets thrown on the same compost heap as the rest of the AI sludge.

What the indie hunter actually steals

Strip the frontier-lab compute out of the picture. The four useful primitives that survive:

1. Commit-history-as-corpus

This is the load-bearing trick. For every paid open-source program you hunt:

git log --oneline --grep="security" --grep="CVE" --grep="UAF" --grep="overflow" -i | head -30
git log --oneline -p --all -- packages/api/src/auth/ | head -200

Pick a recent fix. Read the diff. Now go grep every other place in the codebase that has the same shape but doesn't have the fix. That's exactly what landed me the LibreChat MCP-OAuth TOCTOU SSRF a few days ago — PR #11722 fixed mcp/connection.ts, never touched mcp/oauth/handler.ts, and a single grep for fetch( calls without an SSRF dispatcher surfaced the variant.

The tool I use is patch_diff_hunter from my own toolchain. The bigger point: every paid program ships fixes weekly. Each fix is a recon report for the next bug.

2. The "task verifier" pattern, downscaled

Anthropic's verifier was probably a custom test harness ("does this input crash SpiderMonkey under ASan?"). You can't build that for every target. But the same idea works trivially when the target offers any kind of feedback signal — a debug log, an exception name, a 502-vs-403 split. Build the smallest possible verifier for your target, then iterate against it. For web targets I use a Burp Collaborator + a curl loop with explicit body-bytes assertions; for source-audit targets I use a grep --line-buffered Monitor against the application log.

The lesson: the speed of an AI loop is set by how fast the verifier can tell the model "no, try again." Slow verifier = slow loop = expensive nothing.

3. Bulk-submit only where you have a credibility floor

Anthropic's "submit 112 unvalidated reports" strategy works because Mozilla knows them. As an indie, every bad report on huntr permanently damages your signal-ratio with their auto-triage bot. The same auto-flag bot that just flagged my LibreChat SSRF report (because the word "SSRF" triggered the blind-SSRF auto-reject heuristic) is judging every other hunter on the platform.

Translation: pick one finding at a time. Make it bulletproof. The "fire a thousand reports and let triage sort them" play is for vendors with PR-team backing, not hunters trying to maintain a 40%+ accept rate.

4. Pick paying targets, then apply AI

The honest hierarchy of 2026 paid open-source bounties:

• huntr / AI-ML projects — Open-WebUI, LibreChat, Ollama, vLLM, etc. $0–$1,200 range, 43% pay rate on the active programs. Variant-hunting works here.
• Patchstack / WordPress plugin VDP — $75–$450 per accepted CVE. Boring but reliable. The classic "WP plugin missing-authz on AJAX action" still pays.
• Bitwarden / Proton / Mullvad — Direct disclosure, advertised brackets in the $50–$5,000 range. Confirm the program is still paying today before time-investing.
• Mozilla / NextCloud — Reputation-only as of 2026 Q2.
• Frontier-lab projects (Anthropic, OpenAI) — Specific BBPs exist (OpenAI bio-bounty, etc.) but they're narrow.

Use Claude (or any LLM) to read commits, propose variants, and write PoCs against targets in tiers 1–3. Don't waste API spend on tier 4 unless you want CVE credit for the resume.

What I built in response

Two artifacts from the last 72 hours:

1. agents/llm-vuln-classes.md — a specialised sub-agent file synthesising OWASP LLM Top 10 plus the specific patterns I've actually got paid on (sglang/letta/anythingllm/dify/LibreChat). Phase 5 of that agent is now explicitly the MCP-class TOCTOU pattern that Anthropic's Firefox campaign mirrored at the C++ layer.
2. memory/feedback_paid_program_verification.md — a "check the policy page TODAY" rule with confirmed-paying vs confirmed-suspended tables. Adding NextCloud to the suspended column after they killed their bounties cost me an hour of recon I wouldn't repeat now.

If you're running an AI-assisted hunting workflow, the meta-lesson from Anthropic's Firefox haul isn't "use Claude harder." It's:

• Build a verifier that gives ~100ms feedback.
• Use commit history as your initial corpus, not the file tree.
• Submit one bulletproof report at a time, not a hundred maybes.
• Verify the program still pays before you press start.

That's the gameplan whether your assistant is GPT-5.4, Opus 4.7, or a 7B local model — the speed of your hunt is set by the verifier loop, not the parameter count.

Sources

• Partnering with Mozilla to improve Firefox's security (https://red.anthropic.com/2026/firefox/) — Anthropic's own writeup
• 0-Days (https://red.anthropic.com/2026/zero-days/) — Anthropic on the broader cross-project methodology
• Coordinated vulnerability disclosure for Claude-discovered vulnerabilities (https://www.anthropic.com/coordinated-vulnerability-disclosure)
• MFSA 2026-15 (https://www.mozilla.org/en-US/security/advisories/mfsa2026-15/) — 17 Claude-credited Firefox ESR 140.8 CVEs (largest single batch)
• MFSA 2026-30 (https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/) — 3 more Claude-credited CVEs in Firefox 150
• MFSA 2026-45 (https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/) — first OpenAI Preparedness Firefox credit (CVE-2026-8390)
• Nextcloud HackerOne program — bounty suspension notice (https://hackerone.com/nextcloud) — context on why "find Firefox bug" doesn't pay anymore

If you found this useful, my project tracker for AI-assisted offensive work is at anir0y/claude-bug-bounty (https://github.com/anir0y/claude-bug-bounty) — agents, gates, lab templates, and the accuracy-tool suite I use day-to-day.