🔍 Read the full analysis: Did AI Turn Firefox Fixes Into Working Attacks? Epoch AI’s Results on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working attacks against six Firefox releases by using publicly visible security fixes and a separate, unpublished flaw. Mozilla patched that flaw in Firefox 159, but Epoch has not tested whether similar attacks work against that release; the study was a controlled lab test, not an attack on users.
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases, using public security-fix information and a separate, unpublished vulnerability to make a webpage read a local file in a controlled test. Mozilla patched that additional flaw in Firefox 159, released October 27; the researchers have not established whether the attack method still works against that version.
In a report published October 29, six Epoch AI researchers describe testing Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave the model up to 48 hours per attempt. The fastest successful run took 12 hours. Epoch says each subsequent version cost about $1,000 in API fees after the research team had built its testing setup, which cost more than $100,000 to develop.
The task was to create a webpage that could read a file on a computer when opened in a specified Firefox version. Epoch says GLM 5.3 identified fixes visible in public code before they reached stable users, then built an attack chain. Each successful attack also used a flaw that had not been publicly disclosed. The researchers reported that vulnerability to Mozilla, which fixed it in Firefox 159. The test targeted a local file read; Epoch does not report that the model took over a computer or attacked real users.
Epoch says the test environment ran Ubuntu 26.04 with default settings and an official Firefox release. The model had no internet access and could not target a live website or person. Researchers say they supplied basic instructions and tools, then left the model to choose bugs and work through failures. They report no refusals or safeguards from the providers involved during the experiment, including GLM 5.3’s maker, Z.ai.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk Between Fix and Update
The findings focus attention on the patch gap: the period after a security fix becomes visible but before users install the update. In open-source software, changes in public code can reveal what was repaired. Epoch’s results suggest that a widely available model may be able to use that information to build an exploit more quickly than many users can update, although this study does not measure how often such attacks occur outside a lab.
A successful local file read could expose sensitive information, depending on what the browser can access and the attack’s exact limits. Epoch identifies saved passwords, login cookies and private documents as examples of information that could be at risk. The reported result is not evidence that those materials were stolen from users. It is evidence, according to the researchers, that a model could automate substantial parts of turning a fix into a working attack under the test conditions.
For users, the immediate practical step is to update Firefox to version 159 or later and restart the browser. For software vendors and security teams, the report adds a reason to account for how quickly public fixes may be analyzed: a patch can protect updated users while also signaling the location of a weakness to people who have not yet installed it.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Logitech MX Mechanical Wireless Illuminated Performance Keyboard – Clicky
As an affiliate, we earn on qualifying purchases.
How Public Fixes Became a Clue
Security updates often make the details of a repair visible. In Firefox, researchers say, relevant changes may appear in public code before the stable update reaches everyone. The period in between is commonly called the patch gap. An attacker who can compare the repaired code with an older release may infer what was vulnerable, even without access to secret information.
Epoch asked GLM 5.3 to work from information public when each tested release appeared. According to the report, the model selected fixes, investigated bugs, built a multi-stage chain and adjusted after crashes. The researchers say the attacks against recent versions needed both a weakness exposed by the forthcoming fix and a separate flaw that allowed the chain to get past Firefox’s sandbox, which is intended to isolate webpage activity from local files.
Mozilla’s Firefox 159 advisory, identified as MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low, according to the supplied report. That total includes changes to Mozilla’s counting approach, so it should not be read on its own as a measure of a sudden rise in risk. Epoch also says its setup failed against Chrome after about $100,000 in attempts, illustrating that the result was specific to the tested model, targets and methods.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers, as quoted in their report
What Firefox 159 Has Not Proved
Epoch says it has not tested whether similar attacks work against Firefox 159. Mozilla fixed the previously unpublished flaw the researchers reported, but the report does not establish that this patch eliminates every route to a file-reading attack or that the model could not find another one.
The experiment also does not show that real users were targeted, that any files were taken, or how frequently attackers might reproduce the results. Its findings concern six specified releases, one model and a controlled environment without internet access. Epoch says earlier Firefox versions were likely vulnerable, but it did not systematically test them. The report’s results should not be generalized to every browser, AI model or software project.
The source material says the setup failed against Chrome after roughly $100,000 in attempts, but does not provide enough detail here to compare the products or explain the failure. It also does not establish how the model’s performance would change with different tools, instructions or access to online systems.
Updates and Follow-Up Testing
Firefox users should install version 159 or later and restart the browser, as the supplied report advises. Users and organizations can check that managed devices have received the update rather than assuming that a downloaded patch has been applied.
The next key evidence would be testing of Firefox 159 and any subsequent releases against comparable attack attempts. Epoch says it has not yet performed that test. Mozilla’s public security advisories and any further findings from the researchers may clarify whether the patched vulnerability materially changes the risk and whether similar work can be reproduced in other browsers.
For now, the confirmed development is a lab result and a reported Mozilla fix—not a documented campaign against Firefox users. The broader question of how quickly AI systems can turn public vulnerability information into attacks remains open, and depends on further testing across models, software and real-world conditions.
Key Questions
Did GLM 5.3 attack Firefox users?
No real users were targeted in the reported experiment. Epoch says the model worked in a controlled environment without internet access and produced a webpage for testing specified Firefox releases.
What did the attack do in the test?
It was designed to make a webpage read a local file when opened in a vulnerable Firefox version. Epoch describes a file-reading capability, not a complete takeover of the computer or confirmed theft of users’ data.
Has Mozilla fixed the vulnerability?
Mozilla released Firefox 159 on October 27 with a fix for the unpublished flaw Epoch reported. Epoch has not yet tested whether similar attacks work against Firefox 159, so the effect on the full attack method remains unconfirmed.
How quickly did the model build the attacks?
Epoch allowed up to 48 hours per attempt and says the fastest successful run took 12 hours. The researchers estimate that each later Firefox version cost about $1,000 in API fees once their testing setup was ready.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. The report does not say that users were attacked or that their files were accessed.
Source: ThorstenMeyerAI.com
