🔍 Read the full analysis: AI-Based Attack Research Meets Firefox Fixes: Epoch AI’s Findings on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that GLM 5.3 built a working file-reading attack for six Firefox releases by examining publicly visible security fixes before users had updated. Mozilla fixed an additional, previously unpublished flaw used in the tests in Firefox 159; the lab results do not establish that the same attack works against that release or that real users were targeted.
Epoch AI researchers report that the open-weight model GLM 5.3 built a webpage-based attack against six Firefox releases, using public information about security fixes that had not yet reached users of those versions. The tests took as long as 48 hours per attempt, with the fastest completed in 12 hours; Mozilla subsequently patched an additional flaw used in the successful tests in Firefox 159, released October 27.
In the study, published October 29, Epoch researchers instructed GLM 5.3 to create a webpage that could read a local file when opened in a specified Firefox release. The researchers say the model examined publicly available changes to Firefox code, identified security fixes, and built attacks against versions 156.0 through 158.0.1, released from September 17 to October 26. Each run had a 48-hour limit; the quickest took 12 hours. Epoch estimated API fees of about $1,000 for each new version once its test setup had been built. It said that setup and testing cost more than $100,000.
Epoch says each successful attack against recent versions combined information from a visible fix with a second flaw that had not been publicly disclosed. The researchers reported that additional vulnerability to Mozilla, which fixed it in Firefox 159.0 on October 27. The test targeted reading a file, not taking control of the computer. Epoch said the researchers’ environment had no internet access, so the test could not reach real websites or people.
The researchers said GLM 5.3 received no refusal or other safety intervention from the providers they tested, including its maker, Z.ai. Epoch described the requested work as a security exercise but said the model’s actions were “indistinguishable from those of a real attacker.” That is the researchers’ characterization of the test, not evidence that an attacker used the method against Firefox users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Exploit Work
The study highlights a timing problem for software users and developers: security details can become visible in a project’s code before all users have installed the corresponding update. Epoch calls this interval the patch gap. The report’s significance is that, in this controlled test, an open-weight model used that public information to produce attacks within hours, rather than merely identifying a potential weakness.
That result may matter to security teams because it suggests attackers could use automation to study new fixes quickly and repeatedly. Epoch’s cost estimate applies to its particular setup and API use; it does not establish the cost of attacks in the wild or predict how often they will occur. The test also does not show that anyone exploited these Firefox versions outside the lab. Users can reduce exposure to patched vulnerabilities by updating their browsers and restarting them, while organizations may need to account for the time between a fix becoming public and updates reaching managed devices.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How the Firefox Tests Worked
Firefox is an open-source browser, and its code changes can reveal details about security fixes before every user has installed a release. In the scenario Epoch tested, an attacker could compare that public information with an older release to look for a vulnerability that the fix addresses. The researchers gave the model the target Firefox version, basic tools and public information available when that release appeared. They did not give it internet access or direct it toward a real victim.
Epoch reported successful tests against six releases: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. The group said its setup did not work against Chrome after about $100,000 in attempts. It also said earlier Firefox versions were likely vulnerable but had not been systematically tested. Those limits matter: the findings describe one model, a defined task and a particular lab environment, not a broad comparison of browser security or a measure of real-world attack rates.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Firefox 159 Remains Untested
Epoch said it had not tested whether similar attacks worked against Firefox 159 after Mozilla patched the additional flaw. The researchers expected the fix to make such attacks “at least substantially more difficult,” but that expectation is not the same as a verified test result. The report also does not establish that users were attacked, that the method works against every system configuration, or that other models can reproduce the results.
The source material says Mozilla’s Firefox 159 advisory lists 167 security fixes, including 108 rated high, 52 moderate and seven low. It also cautions that the count is affected by a change in Mozilla’s counting method; the full explanation is not available in the supplied material. The number should not be read as a direct measure of newly discovered vulnerabilities without that context.
Updates and Follow-Up Testing
Firefox users should check that they are running version 159 or later and restart the browser after updating, as recommended in the source report. Organizations that manage browser installations can check whether the update has reached their devices, while recognizing that the study does not quantify the risk to any particular organization.
Further evidence would come from testing the attack method against Firefox 159 and later releases, and from independent attempts to reproduce Epoch’s results. The supplied material does not give a date for such testing or describe a further Mozilla response. Until those results are available, the established findings are limited to the six tested releases, the lab conditions and the patch Mozilla released for the additional flaw.
Key Questions
What did Epoch AI say GLM 5.3 did?
Epoch said the model built a webpage-based attack that could read a local file in each of six tested Firefox releases. It used public information about security fixes and, according to the report, an additional unpublished flaw.
Did the tests target real Firefox users?
No. Epoch said the work took place in a lab environment without internet access, so the test could not reach real websites or people. The report does not establish that real users were attacked.
Has Mozilla fixed the flaw described in the report?
Epoch said it reported the additional unpublished flaw to Mozilla and that Mozilla fixed it in Firefox 159.0, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that release.
What should Firefox users do?
Check that Firefox is updated to version 159 or later and restart it after updating. The research does not show that every user or configuration was exposed to a working attack.
Does the study show that AI can attack every browser?
No. Epoch reported that the same setup failed against Chrome after about $100,000 in attempts. Those results concern the specific model, task and test conditions in the study and do not establish how other models or browsers would perform.
Source: ThorstenMeyerAI.com
