Mozilla's Agentic Security Pipeline for Firefox and Pwn2Own

An interview-style discussion examines how Mozilla prepared for Pwn2Own with an agentic security pipeline, using AI agents to find, verify, deduplicate, and help fix Firefox vulnerabilities. It outlines the workflow from LLM-based file prioritization and dynamic verification to automated patch suggestions and engineer triage. The conversation also covers collaboration with OpenAI's cybersecurity team and the use of advanced cyber models.

■ Pwn2Own and Firefox preparation
- Annual browser exploitation contest used as an emergency-response exercise
- Last-minute fixes and collaboration with OpenAI's cybersecurity team

■ Agentic discovery and verification
- LLM-based file prioritization, sandboxed agents, dynamic testing, and deterministic crash verification
- Second-agent review, deduplication, severity assessment, and variant/commit analysis

■ Remediation and platform outlook
- Automated patch suggestions, engineer review, and an SQLite-based security data platform
- Reported 8x growth in discoveries and fixes from 2025 to 2026; future goal of reducing Firefox vulnerabilities

The discussion is suited to security engineers, browser developers, and AI-security researchers who want an overview of agentic vulnerability discovery and remediation workflows. Viewers can expect to understand how AI agents are integrated into browser security operations and what operational challenges arise when scaling discovery and fixes.