Firefox 159 fixes 167 reported vulnerabilities, and Notebookcheck says 41 of them were found by OpenAI’s Codex Security or OpenAI researcher Amy Burnett. It is a substantial security update, and a useful real-world example of AI-assisted bug-finding, with an important caveat: finding flaws is not the same as proving AI can secure a browser on its own.
Mozilla Watch analysis
What happened
Mozilla began rolling out Firefox 159 on 27 October for Windows, macOS, Linux and Android. Notebookcheck says Mozilla’s advisory lists 108 high-severity, 52 moderate and seven low-severity vulnerabilities. None is rated critical, and the advisory reports no active exploitation.
The report says Mozilla credits Codex Security with finding 34 flaws; Amy Burnett reported seven more. Most of the high-severity issues were use-after-free bugs, where software continues using memory after it has been released. The only sandbox escape in the list was found by Mozilla itself.
Why it matters
AI-assisted discovery has produced a concrete contribution to a major browser’s security fixes: 41 entries in this release, according to the report. That is worth noting without turning the tally into a victory lap. Mozilla’s own finding of the sole sandbox escape is a reminder that the work remains shared, and that bug counts alone do not tell us how difficult or important each discovery was.
There is also a counting wrinkle. The report says Mozilla now lists internally found memory-safety bugs separately rather than grouping them under one CVE, so comparisons with older Firefox releases are not straightforward. A bigger number does not automatically mean a less secure browser.
Our read
This is a solid, specific example of AI tools helping security researchers find defects that were then addressed in a browser release. It is evidence of useful assistance, not of an AI system independently securing Firefox. If you use Firefox, check that version 159 has installed and restart the browser if it asks; Mozilla normally updates it automatically.
What to watch
- Whether Mozilla or OpenAI publishes more detail about the 41 credited findings.
- How future releases report vulnerability counts, given the change in how memory-safety bugs are grouped.
- Whether AI-assisted findings continue to translate into fixes without obscuring the human work around them.
Discussion spark: Should browser makers publish separate tallies for vulnerabilities found by AI tools, or does that risk making raw counts look more meaningful than they are?
Sources and evidence
- Firefox 159 fixes 167 flaws, and OpenAI's Codex found 41 of them – Notebookcheck (28 October 2026, 08:10 UTC)
not affiliated with or endorsed by Mozilla