🔍 Read the full analysis: What Epoch AI Revealed About AI, Firefox Fixes, And Security on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing publicly visible security fixes, with the fastest run taking 12 hours. Mozilla patched a separate, previously unpublished flaw used in the attacks in Firefox 159; the lab results do not show attacks on real users or establish whether similar attacks work against version 159.
Epoch AI researchers say open-weight model GLM 5.3 built working attacks against six Firefox releases by using publicly visible information about security fixes. In the lab tests, the attacks could make a webpage read a local file when opened in a targeted browser version; Mozilla has since patched a second, previously unpublished flaw used in the successful attempts, in Firefox 159.
In a report published October 29, six Epoch AI researchers described tests against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. The researchers gave the model each version number, basic tools and public information available at the time, then allowed it up to 48 hours to find a way to make a webpage read a file on the test computer. The fastest successful run took 12 hours.
Epoch says each version-specific attempt cost about $1,000 in API fees after the research team had built its testing setup. That setup cost more than $100,000 to develop and test, according to the report. The team said it received no refusals or safeguards from the providers it used, including Z.ai, the maker of GLM 5.3. It characterized the model’s actions as “indistinguishable from those of a real attacker”.
The researchers said successful attacks combined clues from fixes that were public in the code but not yet available to stable-version users with a separate flaw that had not been publicly disclosed. Epoch reported that second flaw to Mozilla. The company released Firefox 159 on October 27, saying the version included security fixes; Epoch says the previously unpublished flaw was among those addressed.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Public Fixes Can Aid Attackers
The report highlights a timing problem for software users: a security fix can reveal useful information before everyone has installed the update. Epoch calls the interval between a fix becoming visible and users receiving or applying it the patch gap. In this experiment, the model identified clues in public Firefox code and used them to develop attacks against older versions.
The finding matters because the researchers say the work was done by an open-weight model, not a system available only to a small group of developers. That does not establish that comparable attacks are routine, cheap for everyone, or being used against people. It does show, in a controlled test, that a model could automate substantial portions of vulnerability research and attack development under the conditions Epoch set.
The demonstrated outcome was a local file read, not full control of a computer. Epoch said that kind of access could expose sensitive information such as saved passwords, login cookies or private documents. Those examples describe potential consequences, not evidence that any user’s files were accessed during the study.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
The Firefox Patch-Gap Test
Epoch’s test used a machine running Ubuntu 26.04 with default settings and an official Firefox release. The model was given no internet access, and the researchers say it could not target a real website or person. It was asked to build a webpage that would read a local file when opened in a specified Firefox version. The team instructed it to examine fixes not yet included in the stable release, but otherwise let it work without human input during the attempts.
Firefox’s public development process made security-related code changes available before users of the stable release had received the corresponding update. Epoch’s report says GLM 5.3 selected fixes, investigated bugs and built a multi-stage chain, while also responding to crashes and abandoning unsuccessful approaches. The researchers report success on all six tested releases; they did not systematically test earlier versions.
Epoch also tried its setup against Chrome, but says it failed after about $100,000 in attempts. That result is limited to this particular experiment and does not establish that Chrome or other browsers are immune to AI-assisted attacks. The report’s comparison instead shows that the same approach did not produce a successful Chrome attack under the team’s tested conditions.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What Firefox 159 Has Not Settled
Epoch said it had not tested whether similar attacks work against Firefox 159, so the effect of Mozilla’s fix on this attack chain remains unverified by the researchers. Epoch expects the patch to make such attacks substantially more difficult, but that is an expectation rather than a reported test result.
The report also does not show that the attacks were used outside the lab, that real users’ files were read, or that the researchers’ results translate directly to other software. Epoch did not systematically test Firefox releases earlier than 156. The source material also notes that Mozilla’s Firefox 159 advisory listed 167 security fixes—108 rated high, 52 moderate and seven low—but says Mozilla had changed its counting approach, limiting comparisons with earlier advisories.
Updating Firefox After the Disclosure
Firefox users should install version 159 or later and restart the browser, according to the source report’s guidance. Updating closes the known flaw Mozilla patched, though Epoch had not yet verified whether the attack chain remains possible after that release. Organizations should also track browser updates and the gap between security fixes becoming public and updates being installed across their systems.
The next evidence to watch for is whether Epoch or other researchers test the attack against Firefox 159 and later versions, and whether Mozilla or security researchers report related activity. Until then, the study is evidence of a capability demonstrated in a controlled environment—not confirmation of attacks on Firefox users.
Key Questions
What did GLM 5.3 do in the Epoch AI test?
Epoch says the model built webpages that could read a local file when opened in six tested Firefox releases, using public information about security fixes and a separate previously unpublished flaw.
Were real Firefox users attacked?
The report describes a controlled lab test with no internet access. It does not report attacks on real users or evidence that anyone’s files were accessed.
Did Mozilla fix the flaw?
Epoch says it reported the previously unpublished flaw to Mozilla and that Mozilla patched it in Firefox 159, released October 27, 2026. Epoch had not yet tested that version against the attack.
How long did the attacks take?
Epoch allowed up to 48 hours for each attempt. The fastest successful run took 12 hours; the researchers said each version-specific run cost about $1,000 in API fees after the testing setup was built.
What should Firefox users do?
Install Firefox 159 or later and restart the browser. The report does not establish whether similar attacks work against versions released after the patch.
Source: ThorstenMeyerAI.com
