🔍 Read the full analysis: From Firefox Fixes To Working Attacks: Understanding Epoch AI’s AI Demo on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible in public code before users received the updates. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159; the study was conducted in a lab and did not target real users.
Epoch AI says its researchers used open-weight model GLM 5.3 to build attacks against six Firefox releases, exploiting information in public code about security fixes that had not yet reached stable users. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159, released October 27; Epoch says it has not yet tested the attack against that version.
In a report published October 29, six Epoch AI researchers described giving GLM 5.3 a task: create a webpage that could read a local file when opened in a specified Firefox version. The model succeeded against versions 156.0 through 158.0.1, released between September 17 and October 26, according to the researchers. The test was designed so the model saw only information public when each version became available.
Epoch allowed up to 48 hours per attempt; its fastest successful run took 12 hours. The researchers estimate API fees of about $1,000 for each new version once their testing setup was built. Building and testing that setup cost Epoch more than $100,000, according to the report. The researchers say they encountered no model-provider refusals or safeguards during the experiment.
The attacks combined known weaknesses indicated by upcoming fixes with a second flaw that had not been publicly disclosed. Epoch reported that flaw to Mozilla, which patched it in Firefox 159. The demonstration’s requested outcome was a local file read, not control of the entire computer. Epoch also says it had no internet access in the test, preventing the model from targeting real websites or users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Attackers
The report highlights the risk in the period between a security fix becoming publicly visible and users installing the update—a period often called the patch gap. A code change intended to repair a vulnerability can also reveal where the weakness was. Epoch’s result suggests that an AI model can help turn that information into an exploit, potentially reducing the expertise and time required for this kind of work.
That matters to both software makers and users: publishing a fix does not immediately protect devices that have not received or installed it. The research does not establish how often such attacks will occur outside a lab, or whether attackers are already using AI this way. It does show why prompt updates and restarts matter, while giving software teams reason to account for attackers analyzing fixes as soon as they are public.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
How the Patch Gap Worked
Firefox is an open-source browser, so changes to its code can be publicly visible before a stable release reaches all users. In the scenario tested by Epoch, GLM 5.3 examined fixes that were present in public development information but not yet in the stable version under test. The researchers let the model select relevant bugs, develop an attack chain and respond to failures without further human input.
Epoch tested six consecutive releases, from Firefox 156.0 to 158.0.1. It says earlier releases may also have been vulnerable but were not systematically tested. The researchers report that a similar effort against Chrome did not succeed after about $100,000 in attempts. That comparison is limited to Epoch’s particular setup; it does not establish that Chrome is generally immune to AI-assisted exploitation.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Firefox 159 Still Needs Testing
Epoch said it had not tested Firefox 159 to determine whether the demonstrated attack still works after Mozilla’s patch. The report says the fix is expected to make similar attacks harder, but the researchers did not establish that every related route is blocked. The source material also does not specify whether Mozilla independently reproduced the full attack chain.
The findings come from a lab environment using Ubuntu 26.04, default settings and official Firefox releases. They do not show that real users were attacked or that the model could exploit other browsers or software in the same way. Epoch’s failed Chrome effort is also specific to its test, not proof of broader protection. The real-world frequency of AI-assisted attacks and the time attackers might need remain unknown.
Update Firefox and Track Testing
Users should install Firefox 159 or later and restart the browser, according to the source report. Epoch’s next relevant step is to test whether its demonstration remains effective against the patched release; results were not available in the report published October 29. Further reporting may also clarify whether Mozilla has evaluated the model’s attack chain and whether the fix fully addresses the disclosed flaw.
For software teams, the immediate issue is how quickly users receive security updates after fixes become public. The report does not prescribe a specific new process, but it makes the timing between public code changes and user updates central to the risk. Any claims about broader attack rates or impacts will require evidence beyond this single controlled demonstration.
Key Questions
What did GLM 5.3 do in the Epoch AI test?
Epoch says the model built webpages that could read a local file when opened in six tested Firefox releases. The experiment was conducted in a lab, not against real users.
How did public Firefox fixes help the model?
The researchers say fixes visible in public code indicated where vulnerabilities existed before the corresponding stable updates reached users. That delay is known as the patch gap.
Did Mozilla fix the flaw used in the demonstration?
Epoch reported a previously unpublished flaw to Mozilla. The report says Mozilla patched it in Firefox 159, released October 27, 2026.
Does the study show that Firefox 159 is still vulnerable?
No. Epoch said it had not yet tested Firefox 159. The researchers expected the patch to make similar attacks substantially more difficult, but did not report a test confirming the outcome.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, as advised in the source report. The study does not say that real users were targeted.
Source: ThorstenMeyerAI.com
