In a Mozilla Blog post dated 29 October 2026, 'Defending the patch gap against automated attackers', Mozilla's Bobby Holley says AI models can now identify software vulnerabilities as effectively as top security researchers.

Mozilla says the Firefox team has worked since February with early access to frontier models from Anthropic and OpenAI and has shipped more than seven times the number of security fixes compared with the same period in 2025. It describes the patch gap as the window between a security fix appearing in the code and that code reaching most users, during which an attacker could reverse-engineer an incoming fix and attack the prior version.

Mozilla says AI models can dramatically accelerate this and lower the barrier to entry, and that it has seen evidence that models like GLM 5.3 can exploit some of the fixes for bugs originally uncovered by more advanced models.

Steps Mozilla says Firefox has already taken: cutting the release cycle in half so new builds ship every week; keeping regression tests confidential until after a fix has shipped, because it observed GLM 5.3 is much less effective at patch-gapping without one; and scanning all new commits for newly introduced bugs.

Mozilla says it will also group classes of fixes so that the patch gaps for different layers of Firefox's defences (for example a renderer exploit and a sandbox escape) do not overlap, and that getting this right may take some time.

Mozilla also says October has seen a sharp increase in vulnerability disclosures and exploit activity as defenders and attackers get more capable models. (source: Mozilla Blog)