How Mozilla uses GPT-6 Cyber to find and fix Firefox vulnerabilities
Use a verified agent loop—prioritize risky code, test bug theories dynamically, and have humans review fixes—to scale vulnerability discovery safely.
- Rank scan targets with an LLM using Firefox-specific threat-model guidance and prior scan history.
- Require reproducible tests, then use a separate agent to check for false positives and assess severity.
- Use fixed bugs for variant scans and new commits for focused scans; engineers still review and land patches.
The walkthrough explains the pipeline and shows how engineers use its workbench. · Best for: Security engineers building agent-assisted vulnerability discovery and remediation workflows.
Mozilla describes an agentic security pipeline for Firefox: prioritize code, let agents investigate inside virtual machines with testing tools, verify findings, help draft fixes, and use engineer feedback to improve scanning and triage.
Pwn2Own and Mozilla’s security groundwork0:10
- Mozilla uses the annual browser hacking competition as a controlled security exercise.
- Existing bug bounty, fuzzing, sanitizer, and research workflows helped the team handle a higher volume of agent-generated findings.
Choose what code to scan3:02
- An LLM scores files for risk, including exposure to webpage content and memory-safety concerns.
- Use Mozilla’s technical documentation and threat model to guide scores; include scan history when choosing targets.
Investigate and verify findings4:59
- Run the agent in its own VM with source code and the fuzzing toolchain.
- Let it test static-analysis theories dynamically; require deterministic evidence, such as an HTML test case that crashes Firefox.
- Have a separate agent check the result for tricks, assess severity, and help reduce false positives.
Triage and find related vulnerabilities8:39
- Use an agent with access to a local findings database to suggest duplicates, then feed engineering corrections back into the process.
- Recheck findings marked as duplicates after the linked fix lands.
- Give agents known bugs or fixes for variant scans; scan new commits for narrower, newly introduced issues.
Turn findings into reviewed fixes15:30
- The pipeline can draft a code patch and test, but patches are not consistently ready to land.
- A browser engineer reviews the evidence and patch, prepares the fix, and gets another engineer’s review.
Use a workbench to improve the pipeline17:24
- A local SQLite database brings together scan runs, bugs, and engineer comments for querying through a coding agent.
- Engineers can ask the agent to propose the next scans or diagnose failed runs from logs.
- Agents record environment blockers in blockers.yaml so the team can update the VM image or harness.
Step by step
- Score source files with an LLM using browser-specific risk guidance and scan history.
- Select targets and run agents in isolated VMs with source code and fuzzing tools.
- Require a deterministic reproduction, then have a second agent validate the finding and assess severity.
- Check for duplicates against the findings database; revisit duplicate decisions after related fixes land.
- Run variant scans from known bugs and focused scans of new commits.
- Attach a draft patch and test to the report; have engineers review, revise, and land the fix.
- Use scan results, engineer feedback, logs, and blockers.yaml to improve future targeting and the harness.
Tools & resources mentioned
- GPT-6 Cyber — cyber model discussed for finding and assessing Firefox vulnerabilities.
- Firefox fuzzing toolchain — dynamically tests agent-generated bug theories.
- AddressSanitizer — an established part of Mozilla’s internal security preparation.
- SQLite — local database for scan runs, findings, and engineer comments.
- blockers.yaml — agent-written record of environment problems that need follow-up.
Notes are AI-generated from the video's transcript and may miss nuance.