AI-Driven Vulnerability Management: Mozilla's 20x Surge in Bug Fixes

In April 2026, Mozilla Firefox reported a staggering 400 security bug fixes, a 20-fold increase from its 2025 monthly average. This surge was largely attributed to vulnerabilities identified by Anthropic's Claude Preview model, which helped discover 271 of the fixes. Eugene Yan from Anthropic highlighted that the bottleneck in security now lies in verification, triage, and patching rather than detection. Anthropic scanned 23,000 open-source repositories, identifying 6,200 high or critical vulnerabilities but only saw 100 patches implemented. The shift in focus is necessary as organizations struggle with a 94% drop-off between reporting and actual patching. A well-structured threat model can significantly improve true-positive rates, yet many teams overlook this crucial step. The findings indicate that while vulnerability discovery has improved, the downstream processes have not kept pace.

Key Points: • Mozilla Firefox fixed 400 security bugs in April 2026, a 20x increase from 2025. • 271 of these fixes were attributed to vulnerabilities found by Anthropic's Claude Preview model. • The primary challenge now is in verification and patching, not in detecting vulnerabilities.