🔍 Read the full analysis: Epoch AI’s Firefox Findings: The Risk And The Response on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that open-weight model GLM 5.3 produced working file-reading attacks against six Firefox releases in a controlled test, using publicly visible security fixes and a separate unpublished flaw. Mozilla patched that flaw in Firefox 159, released October 27; Epoch has not yet tested whether similar attacks work against that version.
Epoch AI reported on October 29 that the open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, turning public security fixes into a way to read a local file through a webpage. Mozilla had already released Firefox 159 on October 27, which patched a separate, previously unpublished flaw used in the successful tests; Epoch says it has not yet tested the attack against that version.
Epoch’s six researchers tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. For each attempt, the model had up to 48 hours; the fastest successful run took 12 hours. Epoch estimates API costs of about $1,000 per version after its research team had built the testing setup, a process that cost more than $100,000. These are the study’s reported figures, not a measure of what every attacker would spend.
The researchers told the model to build a webpage that could read a local file when opened in a specified Firefox version. They report that GLM 5.3 identified security fixes already visible in public code but not yet included in stable releases, then used those clues to develop attacks. The test ran on Ubuntu 26.04 with default settings and had no internet access, so it could not target real websites or users. Epoch says it observed no model refusals or provider safeguards during the experiment.
In each successful test against the recent releases, the attack also depended on a flaw that was not publicly known. Epoch says it reported that vulnerability to Mozilla, which addressed it in Firefox 159. The demonstrated result was reading a file, not taking control of the computer. Epoch also says its setup failed against Chrome after about $100,000 in attempts, a result limited to this experiment rather than a general comparison between browsers.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Patch Gap Becomes Easier to Exploit
The study highlights a security exposure that exists between a fix becoming public and users installing the update. In open-source software, code changes can reveal what was repaired. Epoch’s result suggests that an available model may be able to analyze those changes and develop an exploit faster than many users or organizations can update their systems. The researchers describe this as a shift in who can carry out that work, not proof that every public patch can be turned into an attack.
For users, the practical point is straightforward: install Firefox 159 or later and restart the browser, as the source report advises. For organizations, the finding puts attention on update speed and how security fixes are disclosed and deployed. The tested attack required a user to open a webpage, but Epoch’s requested outcome involved no additional click or download after the page was opened. The test itself was isolated, and the researchers did not attack real users.
The result also has limits. Epoch’s team spent more than $100,000 building and testing its setup, despite the lower marginal API cost it reports for each later Firefox version. The experiment shows what GLM 5.3 did under the study’s conditions; it does not establish how often criminals will attempt similar attacks, how reliably they would work outside the lab, or whether other models can reproduce them.
Products Worth Considering
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 1TB SSD, Wi-Fi 7, Space Black
Apple MacBook Pro 16-inch (2021) – M1 Pro Chip, 10-Core CPU, 16-Core GPU, 16GB RAM, 1TB SSD, Space Gray
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
How Public Fixes Informed the Test
When developers publish or release a security fix, information about the weakness can become available before all users have installed the update. Epoch calls this period the patch gap. In its Firefox test, the researchers said they gave the model only information that was public when each browser version was released. They asked it to focus on fixes not yet present in the stable version, then allowed it to proceed without further human input.
The attacks required more than identifying a repaired bug. According to Epoch, each successful chain also used a separate flaw that had not been published, allowing the attack to get past Firefox’s sandbox, a boundary intended to limit what a compromised webpage can access. The researchers say the model rediscovered that flaw during each successful attempt and disclosed it to Mozilla. Mozilla’s Firefox 159 security advisory, MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low. The source report cautions that Mozilla had changed its counting method, so the total should not be treated as a direct comparison with earlier advisories.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Has Not Yet Proven
Epoch has not reported a test of its attack setup against Firefox 159, so it is not yet clear whether related attacks remain possible or how effective Mozilla’s patch is under the same conditions. The researchers expect the fix to make the attack substantially more difficult, but that remains an expectation rather than a verified result in the supplied report.
The study also does not establish whether the same approach would work against other systems, browser configurations or models. Epoch says earlier Firefox versions may also be vulnerable, but it did not test them systematically. Its Chrome attempts failed after about $100,000, yet the result does not show that Chrome is immune to other techniques. No evidence in the source material indicates that real users were targeted or that the lab attacks were used outside the test.
Update Now; More Testing Remains
Firefox users should install version 159 or later and restart the browser, according to the source report. The next key evidence will be whether Epoch or other researchers test the patched release and publish results. Mozilla’s release and security advisory document the fix, but the supplied material does not say whether Mozilla plans further changes to its disclosure or release process.
For security teams, the report points to the time between a fix becoming public and deployment across devices. The study does not set a universal update deadline or show that every patch creates an exploitable opening. Further tests would be needed to establish how often models can reproduce this result, how the Firefox 159 fix performs, and whether safeguards or changes to patch handling reduce the risk.
Key Questions
What did Epoch AI say GLM 5.3 achieved?
Epoch reports that GLM 5.3 built working attacks against six Firefox releases, from 156.0 to 158.0.1, in a controlled test. The attacks used public information about fixes and a separate unpublished flaw, and could read a local file when a test user opened a webpage.
Did the test attack real Firefox users?
No. Epoch says the testing setup had no internet access and could not target real websites or users. The report describes a lab experiment, not a confirmed attack in the wild.
Has Mozilla fixed the flaw used in the tests?
Epoch says it disclosed the previously unpublished flaw to Mozilla, which addressed it in Firefox 159, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that version.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, following the guidance in the source report. The study does not establish that real users were attacked.
Does the report show that AI can compromise any browser?
No. The finding concerns a specific GLM 5.3 experiment against six Firefox releases. Epoch reports that its setup failed against Chrome after about $100,000 of attempts, but that result does not prove Chrome or other browsers are immune to other methods.
Source: ThorstenMeyerAI.com
