Where Waterfox stands on AI and LLMs

Waterfox is a privacy focused, customisable browser. It’s the guiding principle in how I do anything related to the project and I don’t want an LLM processing your browsing activity as part of the experience Waterfox provides. Running a model locally doesn’t, by itself, convince me that integrating it is appropriate for this project.

In December’s No AI* Here, I acknowledged that LLMs have utility while explaining why I don’t want them integrated into Waterfox. Keeping LLMs out of Waterfox wasn’t a promise to oppose every single use of them and for some reason that seems to have been what was extrapolated from that post.

I don’t want to be a poster boy for blanket opposition to AI or LLMs. I have my own views about these technologies and agreeing with one of my decisions doesn’t mean we will agree about every other application, or that I have adopted an entire set of beliefs associated with it.

Keeping LLMs out of the browser doesn’t require me to deny their usefulness elsewhere, reject every security improvement that involved one, or promise never to use one myself. You can hold me to the commitments I have actually made. Broader expectations inferred from those commitments aren’t promises I have broken by having views of my own.

Recognising useful applications for LLMs doesn’t mean I approve of everything involved in their creation or everything their developers do. Using software doesn’t amount to endorsing every decision made during its development and choosing to sparingly use an LLM can also be consistent with believing that the industry’s overall effects are harmful. An LLM helping to discover a vulnerability, an LLM generating a patch, and an LLM running inside the browser are different things.

For example, in May 2026, Mozilla described fixing 271 security bugs in Firefox 150 identified with Claude Mythos Preview. What the the account describes the human work actually needed to go from a report to an actual fix.

The curl project has documented useful findings from AI-assisted analysis as well with a more honest example, showing the necessity of human verification.

I won’t reject an otherwise appropriate, verified security fix solely because an LLM helped identify the problem. Accepting such a fix corrects a defect; it doesn’t add an LLM to your browsing experience.

At the end of the day, I control my decisions about Waterfox, not every upstream contributor’s tools or every researcher’s methods. I can’t certify that no LLM has ever contributed to any work in the history of the software Waterfox depends on and I don’t believe that’s a promise I need to make. I suppose refusing work to discourage practices someone considers harmful is an argument that can be made, but when an appropriate security fix has been verified and is available, my judgement is that protecting users takes priority over excluding it solely because of LLM assisted discovery.

A person can accept those kinds of findings and still believe the technology’s wider consequences are negative. To me, finding a useful application challenges the claim that LLMs have no use at all, but that doesn’t mean I make a judgment on whether their overall benefits outweigh their harms.

To that point, my concerns about environmental costs, training practices and the treatment of creative work haven’t disappeared. For example, when it comes to the arts, I want human work and strongly oppose generative AI replacing what I regard as a fundamentally human experience. Waterfox’s art and design are things I make myself or pay someone else to create.

I think it’s also important to clarify, for removal of all doubt, that someone using “anti-AI” as shorthand for an objection to generative AI isn’t necessarily rejecting every application of machine learning. My disagreement is with a literal rejection of all AI, in a more absolutist fashion.

For example, Firefox’s translation system works on the user’s device. It deserves to be assessed separately from a general purpose LLM assistant.

Accessibility tools, including those that use generative AI, deserve to be considered on their own merits. Nature has reported on the benefits of these tools in terms of accessibility, as well as the potential consequences of restricting their use in academia. Be My Eyes provides blind and low vision users with AI generated visual descriptions and access to human assistance.

People using such tools should be involved in decisions that affect their access to them. This does not excuse poor privacy practices, unreliable output or the forced implementation of unwanted features.

Waterfox is a passion project. I put substantial amounts of time into it, make it available for free, and earn next to nothing from the work. I do it because I care about the browser and the people who use it but it also means that I don’t have unlimited time or energy.

Constructive criticism is part of maintaining software; a specific bug report can help me fix something, a reasoned objection can point out something I have missed and a disagreement doesn’t have to be vitriolic to be fruitful. But acknowledging useful applications for LLMs, or drawing different boundaries around their use, isn’t grounds for personal abuse or harassment.

To wit, making Waterfox freely available isn’t an offer of unlimited access to my time. It doesn’t oblige me to accommodate every demand, defend the same decision indefinitely, or adopt somebody else’s entire position on AI. I am responsible for the commitments I make about this project, not for fulfilling an identity assigned to me by people who want it to represent something else. That means I will set boundaries around abusive behaviour and step away from conversations that become harassment. Truthfully, I would rather spend my time working on Waterfox.

To everyone who engages in good faith, including those who disagree with me: thank you. The useful reports, honest questions and occasional words of encouragement matter.