🔍 Read the full analysis: Epoch AI Showed How AI Can Turn Firefox Fixes Into Working Attacks on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI researchers report that open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing publicly visible security fixes. Mozilla patched a separate, previously unpublished flaw used in the attacks in Firefox 159; the researchers have not yet tested whether similar attacks work against that release.
Researchers at Epoch AI say the open-weight model GLM 5.3 built working attacks against six Firefox releases by studying security fixes visible in public code before users had installed the updates. The attacks could make a webpage read a local file when opened in a vulnerable browser; Mozilla patched a separate flaw used in the tests in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers described tests of Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. For each version, researchers gave the model the browser version and basic tools, then allowed it up to 48 hours to produce a webpage that could read a file from the test computer. The fastest successful run took 12 hours, according to Epoch.
The researchers say GLM 5.3 identified fixes in public Firefox code that had not yet reached the stable release, then used that information to find and exploit vulnerabilities. Epoch reported a marginal cost of about $1,000 per version in API fees once its testing setup was in place. The group says building and testing that setup cost more than $100,000. It also reported that none of the providers involved refused the task or triggered a safeguard during its test.
Epoch says the successful attacks combined information from an upcoming fix with a second, unpublished vulnerability that allowed the attack to get past Firefox’s sandbox. The researchers disclosed that flaw to Mozilla, which patched it in Firefox 159. The test ran in a controlled lab with no internet access, and did not involve attacks on real users. Epoch says the demonstrated capability was file reading, not control of the entire computer.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Attacks
The findings highlight a risk in the time between publishing a security fix and users installing it. In open-source software, code changes can reveal where a vulnerability was found. A person or automated system that studies those changes may be able to develop an attack before affected users update. Security teams call this interval the patch gap.
Epoch’s results suggest that an AI model may reduce the specialist effort needed to turn that public information into an exploit. The report does not establish that attackers have used GLM 5.3 this way outside the lab, or that the same result is possible across browsers and systems. But the researchers’ account raises a practical concern for software makers and users: once fixes are visible, installing updates promptly can matter as much as the quality of the fix itself.
For Firefox users, the immediate step is to update to version 159 or later and restart the browser. For organizations, the test is a reason to review how quickly browser updates reach managed devices, while treating Epoch’s findings as a controlled demonstration rather than evidence of a live campaign.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Works
Security fixes can become visible before they are installed by all users. In Firefox, Epoch says relevant changes were available in public code while versions containing the fixes had not yet reached stable users. The researchers instructed the model to examine fixes not yet present in the stable release, but say they otherwise let it work without human input during each run.
Epoch chose a target in which a webpage would read a local file when opened in a specified Firefox version. Its test computer used Ubuntu 26.04, default settings and an official Firefox release. The researchers say they selected file reading as a consequential but bounded outcome: exposed files could include browser-saved passwords, login cookies or private documents, depending on what was accessible on the machine.
The researchers also tested the same setup against Chrome, but say it failed after about $100,000 in attempts. That result does not establish that Chrome is immune; it describes the outcome of this particular experiment. Epoch said earlier Firefox versions may also be vulnerable, but did not systematically test them.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Has Not Proven
Epoch had not tested whether the same attack chain works against Firefox 159 at the time of its report. Mozilla fixed the unpublished flaw identified by the researchers, but the report does not establish that this eliminates every route to a similar file-reading attack. Epoch expects the patch to make such attacks substantially more difficult, but that remains an assessment rather than a confirmed test result.
The experiment also does not show that GLM 5.3 has been used against real Firefox users. Its test environment had no internet access, and the model’s demonstrated result was reading a file, not taking over a computer. The report’s figures describe this setup, including its costs and time limits; they should not be treated as a measure of how quickly or cheaply an attacker could reproduce the work elsewhere.
It is also unclear how often attackers can exploit public fixes across other software, models and operating systems. Epoch’s Chrome attempt did not succeed, but a failed test on one setup cannot establish broader protection. The group said it had not systematically checked earlier Firefox releases.
Update Firefox and Watch for Tests
Firefox users should install version 159 or later and restart the browser, as the source report advises. Organizations that manage browsers can check whether the update has reached their devices and review the time between a security release becoming available and deployment across their systems.
The next evidence to watch for is whether Epoch or independent researchers test Firefox 159 and publish results. Mozilla’s release notes and security advisories may also provide further detail about the fixes. Until such testing is reported, the lab findings support prompt patching but do not answer whether the reported attack chain remains workable against updated Firefox installations.
Key Questions
What did GLM 5.3 do in the Epoch AI test?
Epoch AI says the model built webpages that could read a local file when opened in each of six tested Firefox releases, using information from publicly visible security fixes. The tests were run in a lab, not against real users.
Which Firefox versions did the researchers test?
The report describes tests against Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, released from September 17 to October 26, 2026.
Did Mozilla fix the flaw?
Epoch says it reported a previously unpublished flaw to Mozilla and that Mozilla patched it in Firefox 159, released October 27. Epoch had not yet tested whether similar attacks work against that version.
Does the report show that real users were attacked?
No. Epoch described a controlled test with no internet access and said it did not target real users. The report is evidence of a lab capability, not confirmation of an attack campaign.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. The source report does not establish that this removes every possible attack route, but Mozilla’s release includes the patch Epoch says it reported.
Source: ThorstenMeyerAI.com
