🔍 Read the full analysis: AI Security Questions Raised By Epoch AI’s Firefox Attack Demo on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reported that open-weight model GLM 5.3 created file-reading attacks against six Firefox releases by analyzing publicly visible security fixes before users updated. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159; the study was conducted in a lab, and the researchers have not tested whether similar attacks work against that release.
Epoch AI reported that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible in public code before those fixes reached users. In the researchers’ isolated test, a malicious webpage could read a local file when opened in the targeted browser; Mozilla has since patched a separate vulnerability used in the attacks in Firefox 159.
The six tested releases were Firefox 156.0 through 158.0.1, issued between September 17 and October 26, according to Epoch’s report, published October 29. The researchers gave the model up to 48 hours for each attempt. Its fastest successful run took 12 hours. Epoch estimated that running the setup against each additional version cost about $1,000 in API fees, after it had spent more than $100,000 building and testing the broader setup.
The test targeted a browser running on Ubuntu 26.04 with default settings. Researchers asked the model to make a webpage that could read a local file when visited in a specified Firefox version. Epoch says the system identified relevant fixes in public code, developed an attack chain, and worked through crashes without additional human guidance. The researchers reported no safety refusals during their tests across providers, including GLM 5.3’s maker, Z.ai.
Epoch says successful attacks against recent versions also depended on a previously unpublished vulnerability, which the model rediscovered during attempts. The group reported that flaw to Mozilla. Mozilla released Firefox 159 on October 27, and the researchers say that version fixes it. The demonstrated capability was reading a file, not taking control of the computer; Epoch did not test its attacks on real users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk Between Firefox Fixes and Updates
The report focuses on the patch gap: the period after a software fix becomes public but before users install the update. For open-source software, code changes can reveal what a developer corrected. That information can help defenders check whether they are protected, but it can also give attackers clues about weaknesses in versions that remain in use.
Epoch’s result suggests that some of the work involved in turning those clues into an exploit may now be within reach of a widely available model. The researchers’ claim is about this particular model, target and controlled setup—not evidence that AI can automatically break into any browser or that attacks against Firefox users occurred. Still, if similar techniques become cheaper or faster to repeat, the time available for users and organizations to apply security updates may matter even more.
For readers, the practical step is to use Firefox 159 or later and restart the browser after updating, following the source’s guidance. For organizations, the report highlights the value of distributing browser updates promptly and confirming that managed devices have restarted into the patched version. Epoch’s cost estimate concerns API fees for repeating a prepared test; it does not represent the total cost of developing the research setup.
Products Worth Considering
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
As an affiliate, we earn on qualifying purchases.
How Public Fixes Became Attack Clues
Software developers often publish changes that address security bugs before every user has installed a release containing the fix. In Firefox, researchers said they could examine public code and identify changes that were not yet included in the stable version being tested. The interval between disclosure of the fix and widespread installation is commonly called the patch gap.
Epoch’s experiment was designed to measure whether GLM 5.3 could use that information to produce an attack with limited human input. The model had the target browser version, basic tools and public information available at the time, but no internet access. Researchers instructed it to examine fixes not yet present in the stable release, then allowed it to work without further direction. The test was not a live campaign against websites or users.
The researchers also tried the setup against Chrome, but report that it did not succeed after about $100,000 in attempts. That result does not establish that Chrome is immune; it describes the outcome of this particular experiment. Epoch says it did not systematically test Firefox releases earlier than version 156, although it considers some older versions likely vulnerable.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Has Not Settled
Epoch had not tested whether similar attacks work against Firefox 159 when it published its report. The group expects Mozilla’s fix to make the demonstrated approach substantially more difficult, but that is an expectation rather than a reported test result. The source material does not establish whether other vulnerabilities could support a different attack chain.
The report also does not show that real Firefox users were targeted or that anyone’s files were accessed. It describes a controlled lab demonstration, and the researchers restricted the system from accessing the internet. The exact likelihood of comparable attacks outside the test, and how quickly they might be carried out against unpatched devices, remains unclear.
Epoch says it did not systematically test Firefox versions before 156. Its Chrome attempts were unsuccessful, but that outcome is limited to the setup and resources described in the report. The study’s cost and timing figures should likewise be read as measurements from its experiment, not as a universal estimate for developing browser exploits.
Updates and Independent Retesting
The immediate step for Firefox users is to update to version 159 or later and restart, so the browser is running the release that includes Mozilla’s patch. Organizations can check that managed installations have received the update and completed a restart, rather than treating distribution alone as proof that devices are protected.
A key next milestone is testing whether the demonstrated attack remains viable against patched versions and whether similar methods work on other software. Epoch has reported the separate vulnerability to Mozilla, and Mozilla’s Firefox 159 release includes its fix, according to the source material. Further technical details or independent assessments could clarify how much protection the patch provides and how broadly the model’s approach applies.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model built webpages that could read a local file in six specified Firefox releases by using public information about security fixes. The work took place in a controlled lab, not against real users.
Which Firefox versions were tested?
The report covers Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, released between September 17 and October 26, 2026.
Did Mozilla fix the vulnerability used in the demo?
Epoch says it reported a previously unpublished vulnerability to Mozilla and that Firefox 159, released October 27, includes a fix. The researchers had not tested the attack against that release when the report appeared.
Does the report show that Firefox users were attacked?
No. Epoch describes a lab test with no internet access, not an attack on real users. The report does not establish that anyone’s files were accessed outside the experiment.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser, according to the source material. Restarting helps make sure the updated version is running.
Source: ThorstenMeyerAI.com
