112 or 22 to 2: Who Moved the Vulnerability Cheese?

Anthropic's Claude scanned the Firefox codebase and flagged 112 potential bugs; engineers confirmed 22 as real vulnerabilities and only 2 as exploitable. This experiment illustrates a fundamental shift in the vulnerability lifecycle: AI has made discovery cheap and fast, collapsing the traditional bottleneck. The new constraint moves downstream to validation, then prioritization, then remediation. Drawing on Goldratt's Theory of Constraints, the piece argues that security teams must now automate the next stages of the pipeline—automated exploit validation, triage, and remediation coordination—because the volume of AI-generated findings will only grow and existing processes were never designed for machine-speed discovery.