🔍 Read the full analysis: How To Respond To AI That Can Turn Firefox Fixes Into Attacks on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing public security fixes before users had installed them. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether similar attacks work against that release.
Research group Epoch AI says the open-weight model GLM 5.3 built working attacks against six Firefox releases by using security fixes visible in public code before those fixes reached stable-version users. Mozilla released Firefox 159 on October 27 with a patch for a separate, unpublished flaw used in the tests; Epoch has not yet established whether the attack approach works against that version.
In its October 29 report, six Epoch researchers describe giving GLM 5.3 the task of building a webpage that could read a local file when opened in a specified Firefox version. The researchers say the model succeeded against each release from Firefox 156.0 through 158.0.1, covering six versions released between September 17 and October 26. The test ran on Ubuntu 26.04 with Firefox’s default settings and used information publicly available when each release appeared.
Epoch allowed up to 48 hours per attempt; the fastest successful run took 12 hours. After researchers built the testing setup, the model’s API costs were about $1,000 per version. Epoch says creating and testing the setup cost it more than $100,000. The model had no internet access, and researchers say it received no human input during the attempts. The test was conducted in a lab, not against real Firefox users.
According to Epoch, the attack chain used a vulnerability indicated by an upcoming security fix and a second flaw that had not been publicly disclosed. The researchers reported that second flaw to Mozilla, which patched it in Firefox 159.0. Epoch says the demonstrated impact was reading a file, not taking control of a computer. It also reports that the setup failed against Chrome after about $100,000 in attempts.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
When Security Fixes Become Attack Maps
The report focuses attention on the time between a security fix becoming visible and users installing the update. In open-source software, code changes can reveal what was vulnerable. That information helps developers and defenders, but it can also give attackers a lead on where to look. Epoch calls this interval the patch gap.
The reported result matters because it suggests that a widely available model can automate parts of vulnerability analysis and exploit development that have typically demanded specialist time. Epoch says the model identified relevant fixes, tested approaches and adjusted after crashes without intervention. If similar capabilities apply to other software, organizations may face more pressure to install updates quickly and to treat public fixes as information that attackers can act on, rather than assuming a flaw remains obscure until a separate disclosure.
That implication should not be confused with proof of widespread attacks. The researchers ran a controlled experiment with a specific target and operating environment. Their findings show what GLM 5.3 did under those conditions; they do not establish that criminals used the technique against users, or that it works across browsers and systems.
Popular right now
De'Longhi Magnifica Evo Fully Automatic Espresso Machine with Manual Milk Frother, Silver
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker, NC701
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
The Firefox Patch Gap Test
Mozilla’s security fixes can be visible in public code before a stable release containing them reaches every user. That delay creates a period in which people running an older version may still be exposed, while an attacker can study the changes to infer the weakness they address. The underlying patch-gap problem predates AI; the question raised by Epoch is how quickly a model can use the available clues.
Epoch’s test gave GLM 5.3 a target Firefox version, basic tools and public information, then let it work without internet access. Researchers instructed it to examine fixes not yet included in the stable version. The model’s goal was to produce a webpage that could read a local file when opened in the targeted browser. Epoch says each successful attempt combined a flaw associated with a public fix and another, unpublished vulnerability that bypassed Firefox’s sandbox.
Mozilla released Firefox 159 on October 27, before Epoch published its report. The article says Mozilla’s advisory, MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low. Those counts describe the advisory’s classifications; they do not by themselves show how many users were exposed to the particular test or how likely exploitation is.
“widely available open-weight models can now do much, or even all, of this work on their own”
— Epoch AI researchers, in the October 29 report
What the Test Has Not Established
Epoch has not reported testing the same setup against Firefox 159, so the study does not establish whether the reported attack chain remains viable after Mozilla’s patch. It also did not systematically test Firefox releases earlier than 156; Epoch describes those versions as likely vulnerable, but that is an expectation, not a reported test result.
The experiment was limited to one model, one browser family and a specified lab environment. Although Epoch reports that its setup failed against Chrome after substantial spending, that result does not establish that Chrome or other software is generally safe from AI-assisted vulnerability research. The report also does not show that the attack was used outside the lab, how many users might have been exposed, or whether attackers have attempted comparable techniques.
Epoch says it encountered no refusals or safeguards from providers during the task. That finding applies to the researchers’ prompts, model and setup; the report does not establish how all providers would respond to other requests or what safeguards may change later.
Update Firefox and Watch for Testing
Firefox users should install version 159 or later and restart the browser, following the advice in the source report. Users and organizations should check that updates have taken effect, rather than assuming a download alone has completed the process. The report does not say that users who have updated were attacked.
The next evidence to watch for is whether Epoch or other researchers test Firefox 159 and later under comparable conditions, and whether Mozilla or other browser makers publish further technical findings or fixes. For organizations, the immediate operational lesson is to keep browsers and other software current and to respond promptly when security updates are released. Broader claims about AI-enabled attacks will require results across more models, targets and environments.
Key Questions
What did GLM 5.3 do in the test?
According to Epoch AI, it built webpages that could read a local file when opened in each of six tested Firefox releases, using public security-fix information and an additional, previously unpublished flaw.
Does the report show that Firefox users were attacked?
No. Epoch describes a controlled lab test without internet access, not an attack against real users. The report does not establish that criminals used the technique outside the experiment.
Which Firefox version includes Mozilla’s patch?
The source says Mozilla patched the additional flaw in Firefox 159.0, released October 27, 2026. Epoch has not yet reported testing the attack against that release.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, as advised in the source report. The study does not provide evidence that updating alone can determine whether a device was previously targeted.
Does the study prove AI can attack any browser?
No. Epoch reports success against six Firefox releases and a failed test against Chrome after about $100,000 in attempts. Those results apply to the reported setup and do not establish how the method performs against other browsers or systems.
Source: ThorstenMeyerAI.com
