🔍 Read the full analysis: How AI Reframed Firefox Fixes As Potential Attack Paths on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, using public information about security fixes. Mozilla patched a separate, previously unpublished flaw used in the attacks in Firefox 159; the researchers have not yet tested whether similar attacks work against that release.
Epoch AI researchers say an open-weight model, GLM 5.3, built working attacks against six Firefox releases in a controlled test by analyzing public security fixes before those fixes reached stable users. Mozilla patched a separate, previously unpublished flaw used in the test in Firefox 159, released October 27; Epoch has not yet tested whether comparable attacks work against that version.
In a report published October 29, six Epoch AI researchers described giving GLM 5.3 the task of building a webpage that could read a local file when opened in a specified Firefox release. The model succeeded against versions 156.0 through 158.0.1, released from September 17 to October 26, according to the researchers. Epoch allowed up to 48 hours for each attempt; the fastest completed in 12 hours.
The researchers said the model used public information available when each version was released, including code changes that disclosed the nature of security fixes. Epoch estimates that, after it built its testing setup, each additional version cost about $1,000 in API fees. The setup itself cost more than $100,000 to develop, the report says. Epoch said it received no refusals or safeguards from the model providers during the test.
Epoch also reported that the attacks against recent versions relied on a separate, unpublished vulnerability that let the attack get past Firefox’s sandbox. The researchers disclosed that flaw to Mozilla, which fixed it in Firefox 159. The test ran on Ubuntu with an official Firefox release and without internet access, according to Epoch; it was not an attack on real users. The reported outcome was local file access, not control of the computer.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Shorten the Attack Window
The report highlights a security risk in the period between a fix becoming public and users installing the update. That interval, often called the patch gap, can reveal where a weakness existed even when attackers do not have access to private vulnerability details. Epoch’s test suggests that an AI system may be able to use that information to automate parts of the work needed to turn a fix into an attack.
That matters to both users and software maintainers because publishing a fix does not immediately protect every device. Users who have not updated may remain exposed to the underlying weakness, while attackers can study the same public changes. Epoch’s results do not establish that real-world attackers have used GLM 5.3 this way, or that the attacks would work against every configuration. They do show why installing security updates promptly remains important, and why developers may need to account for rapid automated analysis after fixes are disclosed.
The researchers also report an important limit: their setup failed against Chrome after about $100,000 in attempts. That comparison is specific to their experiment and does not establish that Chrome is generally safer or that the method cannot work against it under different conditions.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
How Firefox’s Patch Gap Was Tested
Firefox is an open-source browser, so code changes can be publicly inspected. When developers correct a security problem, those changes can disclose details before all users have installed a release containing the fix. The resulting delay between disclosure and broad updating is commonly called the patch gap. It predates AI; the question raised by Epoch is whether widely available models can make it easier to analyze fixes and develop working attacks.
For the experiment, Epoch instructed GLM 5.3 to target specific Firefox versions and use public information about fixes that had not yet reached the stable release. The researchers say the model selected fixes, tested approaches, handled crashes and constructed a multi-stage attack with no further human input during each run. They chose file reading as the goal because, if achieved in a real browser, it could expose sensitive material such as saved credentials or private documents.
Epoch said it tested all six releases from 156.0 to 158.0.1 but did not systematically test earlier versions. The report says earlier releases were likely vulnerable, a projection rather than a confirmed result. Mozilla’s Firefox 159 advisory lists 167 security fixes, including 108 rated high, 52 moderate and seven low; the source account cautions that Mozilla’s counting practices changed, so the total needs that context.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
Firefox 159 Has Not Been Retested
Epoch said it had not yet tested Firefox 159 to determine whether similar attack chains still work after Mozilla’s patch. Its expectation that the fix will make attacks substantially harder is a forecast, not a measured result. The source material does not establish whether the publicly described method has been used against real Firefox users.
The test also covered six specified releases on a particular Ubuntu setup, not every operating system, browser configuration or Firefox version. Epoch’s suggestion that earlier releases may also be vulnerable was not based on systematic testing, according to its account. The report’s cost and timing figures describe this experiment and its setup; they should not be read as a universal estimate for developing attacks against other software.
Update Firefox and Await Retesting
Users should install Firefox 159 or a later release and restart the browser, according to the source account. Mozilla has already released the version containing the fix for the previously unpublished flaw reported by Epoch. Users and organizations should follow Mozilla’s security advisories for further updates.
The next key evidence will be whether Epoch or other researchers test the attack method against Firefox 159 and publish results. Further reporting may also clarify how the model’s capabilities compare across software targets and whether safeguards change. Until those findings are available, the confirmed result remains a controlled laboratory demonstration, not evidence of attacks against people using Firefox.
Key Questions
What did GLM 5.3 do in the test?
According to Epoch AI, GLM 5.3 built webpages that could read a local file in specified Firefox versions. It succeeded against six releases from 156.0 to 158.0.1 in a controlled lab test.
Did the test involve attacks on Firefox users?
No real users were targeted in the described experiment. Epoch says the test ran without internet access, and its reported result was local file access, not control of a computer.
What did Mozilla fix in Firefox 159?
Epoch reported a previously unpublished vulnerability used to get past Firefox’s sandbox and said it disclosed the flaw to Mozilla. Mozilla patched it in Firefox 159, released October 27, 2026.
Does the report show that Firefox 159 is vulnerable?
No. Epoch had not tested whether similar attacks work against Firefox 159. The researchers expected the patch to make them substantially more difficult, but that expectation had not been confirmed by a retest.
What should Firefox users do?
Install Firefox 159 or a later version and restart the browser. Organizations should also monitor Mozilla security advisories and apply browser updates promptly.
Source: ThorstenMeyerAI.com
