Firefox security patch tests are now private for at least a week
B · Useful, limited A first-hand Mozilla security-team policy notice that ties a concrete process change to AI capability, but it is three paragraphs long and cites analyses it does not share.
Summary based on the full text·Original: about 1 minute to read
In short
On 20 October 2026 Tom Ritter, writing for Mozilla's security team on the firefox-dev list, asked developers to split tests into a separate patch from the fix for sec-high and sec-moderate bugs, and to hold the tests until about a week after the fix ships. The stated reason: "As AI keeps improving, our security policies are changing in response", based on recent analyses that are not described.
Key numbers
- sec-high and sec-moderateFirefox bug severities whose tests must now land separately from the fix
- the next Tuesdayearliest landing date for a test after the Tuesday release that ships the fix
As reported by the source.
English·Web page·opens groups.google.com
What it reports
- Tests for sec-high and sec-moderate fixes must be in a separate patch from the fix itself.
- If a fix ships in a Firefox release on a Tuesday, the test lands no sooner than the next Tuesday.
- Developers can tag the bug whiteboard with a reminder and a bot will ping them on the date.
- The sec-approval process is unchanged "for now".
- The team acknowledges frequent, disruptive changes to the process for landing security fixes.
How they got it
An internal-process announcement on a public mailing list. The "recent analyses" behind it are not shared.
Limits
- No data on how quickly attackers derive exploits from public tests, or what the analyses found.
- Short notice; the reasoning is implied (tests reveal the bug) rather than stated.
- Policy may change again; the message flags further process work.
Why it matters for companies
A major browser vendor now treats a public test case as an exploit hint that models can turn into an attack within days. The same logic applies to any company publishing patches: commit messages, tests and diffs can reveal the flaw before customers have updated. Patch release processes should assume fast automated diff analysis and delay revealing artefacts accordingly.
Summary based on the full text. Read the original for the full argument and data.Read the original on groups.google.com
- Tags
- AI security