🔍 Read the full analysis: Firefox Fixes Became Attack Inputs In Epoch AI’s AI Experiment on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that GLM 5.3 built a webpage-based file-reading attack against six Firefox releases by using public information about security fixes, with its fastest run taking 12 hours. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159; Epoch has not tested whether similar attacks work against that release.
Epoch AI reported that the open-weight model GLM 5.3 built working attacks against six consecutive Firefox releases by analyzing security fixes already visible in public code. In the researchers’ fastest test, the model took 12 hours to produce a webpage that could read a local file when opened in a targeted Firefox version; Mozilla has since patched a separate flaw used in the attacks in Firefox 159.
In a report published October 29, six Epoch AI researchers described tests against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. Epoch gave the model up to 48 hours per attempt. The researchers said each successful run against a recent release combined a vulnerability revealed by an upcoming security fix with a second flaw that had not been publicly disclosed. The model found that second flaw again in each attempt.
The test goal was to build a webpage that could read a file from a computer running a specified Firefox version. Epoch said the demonstration required no additional click, download or user action beyond opening the page. The researchers characterized the possible exposure as including browser-saved passwords, login cookies or private documents. Their report describes file access, not a takeover of the computer.
Epoch said the model used public information available when each Firefox version was released, including code changes associated with security fixes. It reported the unpublished flaw to Mozilla, which released Firefox 159.0 on October 27 with a fix. The study also says the researchers spent more than $100,000 building and testing their setup, while subsequent attempts cost about $1,000 per Firefox version in API fees. These are figures reported by Epoch, not estimates of what an independent attacker would necessarily spend.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Attackers
The study highlights the risk created when a software security fix becomes public before users have installed it. A patch can reveal which part of a program was vulnerable. During that interval, attackers may be able to study the change and develop an exploit for systems that have not yet been updated. Security researchers call this period the patch gap.
Epoch’s finding is that a widely available open-weight model could perform much of that analysis and attack development in a controlled test, rather than requiring a specialist to do every step manually. If similar capabilities are usable outside a lab, the time available to install security updates could matter more. That is a risk implication, not evidence that the reported attacks were used against Firefox users.
For readers, the immediate practical point is to update Firefox to version 159 or later and restart it. For software teams, the results focus attention on how quickly fixes reach users and on whether security-sensitive code changes can be exploited before updates are widely installed.
Products Worth Considering
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
FLEXISPOT Reversible L-Shaped Standing Desk, 71 x 63 Inches, Black
As an affiliate, we earn on qualifying purchases.
How the Firefox Test Worked
Epoch set up a test machine running Ubuntu 26.04, default settings and an official Firefox release. It supplied GLM 5.3 with the target version and basic tools, then allowed it to work with public information. According to the report, the model did not have internet access, so it could not attack real websites or users. Researchers gave it a basic direction to inspect fixes not yet present in the stable release, then let it run without further input.
The researchers said GLM 5.3 selected fixes, investigated bugs, developed a multi-stage attack and adjusted its approach after crashes. In each successful recent-version test, one flaw was indicated by a forthcoming fix, while another, unpublished flaw helped the attack get past Firefox’s sandbox—the separation intended to limit what a compromised webpage can access.
Epoch said it also tried the same setup against Chrome, where it failed after about $100,000 in attempts. That result is specific to the researchers’ setup and does not establish that Chrome, or other browsers, cannot be attacked by different methods. Epoch described earlier Firefox releases as likely vulnerable but said they were not systematically tested.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
Firefox 159 Has Not Been Tested
Epoch had not tested whether the attack chain, or a similar one, still works against Firefox 159. The researchers expect the fix to make such attacks harder, but that expectation is not a result from a completed post-patch test. The report also does not establish that anyone used the model’s techniques against real Firefox users.
The study demonstrates a result on a particular Linux setup and against six specified releases. It does not show how often comparable attacks would succeed across operating systems, browser configurations or other software. Epoch also said the earlier Firefox versions it considered likely vulnerable were not systematically examined. The broader reach and practical reliability of the approach therefore remain unclear.
Epoch reported no refusals or safeguards from the providers it tested, including GLM 5.3’s maker, Z.ai. That is the researchers’ finding under their experiment’s framing and conditions; the report does not establish how every model or deployment would respond to the same task.
Install Firefox 159 or Later
Firefox users should install version 159 or later and restart the browser, following the update advice provided with the source report. Mozilla released version 159 on October 27 and said it included a fix for the flaw Epoch disclosed. Users who manage browsers for a workplace should check that updates have reached the devices they oversee.
The next technical milestone is a post-patch assessment: Epoch said it had not yet tested Firefox 159, so its findings do not answer whether the reported chain remains possible after the update. Further testing would help establish how much the patch changes the risk and whether related methods work against other configurations. The study’s immediate conclusion remains limited to its controlled tests; real-world exploitation was not reported.
Key Questions
What did GLM 5.3 do in Epoch AI’s experiment?
Epoch said the model built webpages that could read a local file when opened in six tested Firefox releases. The demonstrations used public security-fix information and a separate flaw that had not been published at the time.
Was this a real-world attack on Firefox users?
No such attack was reported in the source material. Epoch described a controlled lab test with no internet access, designed so real websites and users could not be targeted.
Which Firefox versions were tested?
The researchers reported successful tests against releases from 156.0 to 158.0.1, issued between September 17 and October 26. Epoch said it had not systematically tested earlier versions.
Did Mozilla fix the flaw?
Epoch said it reported the unpublished flaw to Mozilla, which released Firefox 159.0 on October 27 with a fix. Epoch had not yet tested whether similar attacks work against that release.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. The source report says the update addresses the flaw disclosed by Epoch.
Source: ThorstenMeyerAI.com
