🔍 Read the full analysis: AI, Firefox Fixes, And Working Attacks: What Security Teams Can Do on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that the open-weight model GLM 5.3 built file-reading attacks against six Firefox releases by analyzing public security-fix information. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not yet tested whether the attacks work against that version.
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases by studying security fixes visible in public code before those fixes reached stable users. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159, released October 27; the researchers have not tested whether their attack works against that version.
In the lab exercise, the model was asked to create a webpage that could read a local file when opened in a specified Firefox release. Epoch says GLM 5.3 succeeded against versions 156.0 through 158.0.1, released between September 17 and October 26. Each test had a limit of 48 hours; the fastest reported run took 12 hours. The researchers estimated about $1,000 in API fees for each new version after their testing setup was built. They say that setup cost more than $100,000 to develop and test.
The researchers gave the model public information available when each release appeared and no internet access. It selected fixes to investigate and developed attack chains without further researcher input, according to Epoch. The attacks combined information from fixes not yet included in stable releases with a second flaw that had not been publicly disclosed. Epoch reported that flaw to Mozilla, which addressed it in Firefox 159. The reported outcome was file access, not control of the computer.
Epoch says it encountered no refusal or safeguard intervention from the AI providers during the exercise. The group describes the work as a controlled lab test, not an attack on real users. It also reports that its setup did not succeed against Chrome after about $100,000 in attempts. That result applies to this experiment; it does not establish that Chrome cannot be attacked using AI or other methods.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How AI Changes the Patch Gap
The study highlights a security risk in the period between disclosure of a fix and installation of the updated software. Public code changes can reveal what a developer repaired, giving attackers clues about weaknesses that may remain in older releases. Security teams already track this patch gap; Epoch’s finding is that an accessible model may help automate parts of the analysis and attack development.
For users and organizations, the practical response remains familiar: install security updates promptly and restart applications when required. The results do not show that Firefox users were attacked, or that GLM 5.3 has been used against real targets. They do suggest that defenders may have less time to act after fixes become public, especially when a vulnerable version remains in use.
The reported cost also needs context. The roughly $1,000 figure covers each additional version after researchers built a test setup costing more than $100,000. It is not a complete measure of the resources needed to reproduce the work, nor proof that a typical attacker could achieve the same result at that price.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
Public Fixes and Browser Updates
Firefox is an open-source browser, and security-related code changes can be visible before they appear in a stable release. Epoch says it directed GLM 5.3 to examine fixes that had become public but were not yet present in the stable version under test. The time in which users have not yet installed a fix is commonly called the patch gap.
The study covered six releases, from Firefox 156.0 to 158.0.1. Epoch says earlier releases may also have been vulnerable, but it did not test them systematically. The group’s report, published October 29, describes the tests as a controlled exercise using Ubuntu 26.04 and default settings. Mozilla released Firefox 159 on October 27 and patched the additional flaw reported by the researchers.
Mozilla’s Firefox 159 security advisory lists 167 security fixes: 108 rated high, 52 moderate and seven low, according to the source material. The account notes that Mozilla changed its counting practices, so the total should not be treated as a direct measure of severity or compared uncritically with earlier advisory totals.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What Firefox 159 Has Yet to Prove
Epoch has not tested Firefox 159 against the attack chain, so the study does not establish whether the new release blocks every relevant route or how much effort a modified attack would require. The researchers expect the patch to make similar attacks substantially harder, but that is an expectation rather than a reported test result.
The findings are also limited to one model, one browser configuration and a defined file-reading task. The tests did not establish that users were targeted, that files were taken from real devices, or that the model can reliably reproduce the result in other environments. Epoch’s unsuccessful Chrome effort is likewise not a broad security comparison. The source account does not provide independent replication of the Firefox results.
Update Firefox and Track Retesting
Users should install Firefox 159 or a later release and restart the browser so the update takes effect. Organizations should confirm that managed devices have received the update and continue applying browser security fixes promptly.
The next useful evidence would be testing by Epoch or other researchers against Firefox 159 and later versions, along with any further technical details Mozilla or Epoch publish. Until then, the reported results describe attacks against older releases in a controlled lab, while the effectiveness of the patch against comparable attack chains remains unverified in the cited material.
Key Questions
What did GLM 5.3 do in the study?
Epoch AI says the model built webpages that could read a local file when opened in six older Firefox releases. The tests took place in a controlled lab, not against real users.
How did public Firefox fixes help the model?
According to Epoch, the model analyzed public code changes that revealed security fixes not yet present in the stable releases being tested. That information helped it identify weaknesses during the patch gap.
Did Mozilla fix the flaw?
Epoch reported a separate, previously unpublished flaw to Mozilla. Mozilla addressed it in Firefox 159, released October 27, 2026. Epoch had not tested the attack against that release at the time of its report.
Were Firefox users attacked?
The source describes a lab experiment and reports no attack on real users. The model’s test environment had no internet access, according to Epoch.
What should Firefox users do?
Install Firefox 159 or a later version and restart the browser. Organizations should verify updates are installed across managed devices.
Source: ThorstenMeyerAI.com
