Summary
Mozilla’s Brian joins OpenAI to explain how the Firefox team uses GPT-6 Cyber inside an agentic security pipeline to find and fix browser vulnerabilities. The conversation starts with this year’s Pwn2Own hacking competition, where nobody managed to exploit Firefox. Bugs filed shortly beforehand by OpenAI’s cyber team and quickly patched turned out to match several competitor submissions, which showed that different models find different bugs even in code that has been scanned many times.
The discussion then walks through the architecture. An LLM first scores source files by risk, using Mozilla’s own technical documentation and threat model, to decide what the agent should examine next. An inner harness then discovers bugs, building on years of investment in fuzzers, address sanitizers, debuggable builds and an external bug bounty program. Agents can reuse these same tools to launch Firefox, test a potential exploit and iterate quickly.
The second half focuses on the bottlenecks that appear once discovery scales up: prioritizing severity, and deduplicating findings across crash stacks, test cases and write-ups. Mozilla gives an agent access to a local database of reports and feeds its mistakes back into prompts. It also sets reminders to re-check findings that were marked as duplicates once the original fix lands. Viewers get a practical look at running AI-driven vulnerability discovery without overwhelming engineers.
📺 Source: OpenAI · Published November 13, 2026
🏷️ Format: Interview
