Mozilla plans staggered Firefox fixes to blunt AI patch-gap attacks
Original title: Defending the patch gap against automated attackers
Mozilla says it now ships weekly, withholds regression tests, and will stagger sandbox-layer fixes so their patch windows do not overlap.
Mozilla says frontier models from Anthropic and OpenAI have helped Firefox ship more than seven times as many security fixes as in the same period of 2025. The team warns that weaker models such as GLM 5.3 can still reverse-engineer some fixes during the days before most users update. Firefox will ship weekly, withhold regression tests until after release, scan new commits, and separate patch windows across sandbox layers so a full exploit chain is not exposed at once.
Unconfirmed: Mozilla says GLM 5.3 can exploit some fixes but names no specific bugs or confirmed attacks on users.
- Firefox has shipped more than seven times as many security fixes as in 2025.
- The release cycle was cut in half, so new builds now ship every week.
- Regression tests stay confidential until after a fix has shipped.
- A compromise needs at least a renderer bug plus a sandbox escape.
- Mozilla says October brought a sharp rise in disclosures and exploit activity.
From the original article
4 min read at blog.mozilla.org
AI models can now identify software vulnerabilities as effectively as top security researchers, and at a speed and scale that was not possible a year ago. This is ultimately great news for defenders : the defects in software like Firefox are finite, and it seems likely that increasingly powerful models will soon be able to find them all.
By blog.mozilla.org via alcortazzo · blog.mozilla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.