🔍 Read the full analysis: An AI Anyone Can Download Turned Firefox Fixes Into Working Attacks. What Epoch AI Showed, And What To Do Now on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
In a controlled test, Epoch AI researchers used the downloadable, open-weight model GLM 5.3 to build working file-reading attacks against six Firefox releases by analyzing public security fixes. Mozilla patched a separate, previously unpublished flaw used in the tested attacks in Firefox 159; Epoch has not yet tested whether similar attacks work against that release.
Epoch AI researchers say the downloadable, open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, using public code changes that revealed security fixes before all users had installed them. The attacks could make a specially crafted webpage read a local file when opened, according to the report; Mozilla has since patched a separate, previously unpublished flaw used in the tested attacks in Firefox 159.
The Epoch report, published October 29, says the model succeeded against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. Researchers gave it up to 48 hours per attempt; the fastest successful run took 12 hours. Once their testing setup was in place, Epoch estimated API costs at about $1,000 for each Firefox version. Building and testing the setup cost the research group more than $100,000, according to its account.
In the test, GLM 5.3 examined public information about upcoming security fixes, selected vulnerabilities and developed an attack chain without further researcher input. Epoch says each successful attack against recent versions also used a second flaw that had not been publicly disclosed. The researchers reported that flaw to Mozilla, which patched it in Firefox 159.0, released October 27. The demonstrated result was reading a local file, not taking control of the computer.
Epoch says its test environment used Ubuntu 26.04 and an official Firefox release, and that the model had no internet access. Researchers did not direct an attack at real websites or users. They report that the model received no refusals or safeguards from the providers involved, including GLM 5.3’s maker, Z.ai. The source describes the lab task as a security exercise while saying the model’s actions were indistinguishable from those of a real attacker.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Public Fixes Can Guide Attacks
The findings highlight a risk in the time between a security fix becoming visible and users installing the update. In open-source software, changes to public code can reveal where a vulnerability existed, even if those changes are presented as ordinary updates. Security researchers call the exposure period the patch gap. Epoch’s test suggests an AI model can help turn that information into a working exploit chain quickly, potentially lowering the expertise needed to exploit an unpatched system.
That does not establish that attackers have used GLM 5.3 this way against Firefox users, or that every security fix can be converted into an attack. But the result matters to software makers and organizations that rely on delayed updates: publishing a fix does not immediately protect people who have not installed it. For individual users, the practical step is to update Firefox to version 159 or later and restart it, as the source advises.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
The Test and Firefox Patch Gap
Epoch framed its experiment around a specific task: create a webpage that could read a local file when opened in a specified Firefox version. The researchers say the model was given the browser version and basic tools, along with public information available at the time of release. It had no internet access, and the test did not involve a real victim. The report says the model handled steps including selecting bugs, testing approaches and recovering from crashes.
Firefox fixes can become visible in public code before a user installs the stable release. That can give potential attackers clues about what has been repaired, while unpatched users remain exposed. Epoch says GLM 5.3 repeated the attack process across six consecutive releases. The group also tested its setup against Chrome but did not achieve a successful attack after spending about $100,000, according to the source. That comparison is limited to Epoch’s particular setup and test; it does not show that Chrome is generally safe from AI-assisted attacks.
The Firefox 159 advisory listed 167 security fixes: 108 rated high, 52 moderate and seven low, according to the source. It cautions that Mozilla had changed its counting method, so the total should not be read as a direct measure of an increase in vulnerabilities.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI
What Firefox 159 Has Not Settled
Epoch had not tested whether similar attacks still work against Firefox 159 when the source material was published. The group expected Mozilla’s patch to make them at least substantially more difficult, but that remains an expectation rather than a reported test result. The source also says the earlier Firefox versions may be vulnerable, but Epoch did not systematically test them.
The report does not establish whether anyone outside the lab has used this model or comparable tools to exploit Firefox users. It also does not show how often attackers could reproduce the results in other environments, or whether the same approach applies to other browsers and software. Epoch’s unsuccessful Chrome test offers no broad guarantee about Chrome’s security. The attack demonstrated file reading; the source does not report that the model took over a machine or that users’ files were accessed in the wild.
Updates and Further Testing
Firefox users should install version 159 or later and restart the browser, following the source’s guidance. Organizations should review whether their update practices leave systems exposed after security fixes become public. Prompt installation can narrow the period in which an update’s code changes may provide clues to attackers.
The next key technical milestone is testing whether the Firefox 159 patch prevents or materially impedes the attack chain Epoch demonstrated. Further independent work would also be needed to establish how well the result generalizes beyond the tested operating system, browser versions and model setup. Until those results are available, the report is evidence of a capability demonstrated in a controlled test, not confirmation of attacks against Firefox users.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model built webpages that could read a local file in six tested Firefox releases. The researchers conducted the work in a controlled environment with no internet access, not against real users.
How did the model use Firefox security fixes?
It examined public code changes that revealed information about fixes, then used that information to identify vulnerabilities and develop an attack chain. The period before users install a released fix is commonly called the patch gap.
Did Mozilla fix the vulnerability?
Epoch says it reported a previously unpublished flaw involved in the successful attacks to Mozilla, which patched it in Firefox 159.0, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that version.
Were real Firefox users attacked?
The report describes a lab test and says the model had no internet access. It does not establish that real users were attacked or that anyone outside the research setting used the technique.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, according to the source. The report does not claim that updating proves every related risk has been eliminated.
Source: ThorstenMeyerAI.com
