🔍 Read the full analysis: AI And Firefox Security: What Epoch AI Demonstrated And What Comes Next on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that GLM 5.3 built working attacks against six Firefox releases by examining security fixes visible before users received updates. Mozilla fixed a separate, previously unpublished flaw used in the attacks in Firefox 159; the researchers have not yet established whether similar attacks work against that release.
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six successive Firefox releases in a controlled test, using public information about security fixes before those fixes reached users. The attacks could make a browser visit read a local file, the researchers said; Mozilla patched a separate vulnerability used in the tests in Firefox 159, released October 27.
In the test described in a report published October 29, Epoch gave the model a specific objective: create a webpage that could read a file from a computer when opened in a specified Firefox version. The researchers tested releases 156.0 through 158.0.1, covering six versions released from September 17 to October 26. Epoch says GLM 5.3 succeeded against each one. It did not test the attack against real users: the test environment had no internet access.
The model used details exposed by Firefox’s public code and security fixes that were not yet included in the stable version being tested. This period between a fix becoming visible and users installing the update is known as the patch gap. Epoch allowed up to 48 hours for each attempt; its fastest successful run took 12 hours. The researchers estimate that, after developing the test setup, each additional Firefox version cost about $1,000 in model API fees. Building and testing the setup cost more than $100,000, according to Epoch.
Epoch says each successful attack on the recent releases also depended on a second, previously unpublished vulnerability that GLM 5.3 rediscovered during testing. The researchers reported that flaw to Mozilla, which patched it in Firefox 159. Epoch’s account says the attack could read a local file; it did not take control of the computer. The report also says the model encountered no provider safeguards or refusals during the attempts. That finding describes Epoch’s particular test and is not proof that every model or security setting behaves the same way.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Why the Patch Gap Matters
The test points to a security risk in the time between a software fix becoming public and users applying it. A fix can disclose clues about the weakness it addresses. Epoch’s result suggests an AI model may be able to use those clues to develop an exploit quickly, reducing the time and expertise needed to turn a patch into an attack. That is the researchers’ interpretation of their findings, not evidence that this attack was used against people.
A successful file read could expose sensitive information, depending on what files the attack could reach. Epoch cited saved passwords, browser login cookies and private documents as examples of potentially valuable data. The tested chain also relied on a separate flaw to get past Firefox’s sandbox, which is designed to limit what a compromised webpage can access. Mozilla’s patch to that flaw addresses a known part of the tested chain, but Epoch has not reported a post-patch test confirming how effective the update is against related approaches.
For users, the immediate practical step is to install Firefox 159 or later and restart the browser. For software makers and security teams, the report raises a question about how quickly public fixes can be analyzed and turned into attacks. It does not establish that attackers are already doing so at the same speed, or that every public patch can be exploited this way.
Products Worth Considering
Philips Hue Festavia 130-Foot Indoor/Outdoor Smart String Lights, 500 LEDs
Roborock F25 GT Set Cordless Wet Dry Vacuum Cleaner and Mop with 2 Brushes
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
How Researchers Tested Firefox
Epoch framed the exercise as a security test and gave the model the browser version, basic tools and information that was public when each release appeared. The test machine ran Ubuntu 26.04 with default settings and an official Firefox release. Apart from a broad instruction to examine fixes not yet in the stable release, Epoch says it let the model work without further human input. The researchers report that it selected bugs, built an attack chain, diagnosed crashes and changed approaches when attempts failed.
Epoch described the result as evidence that widely available open-weight models can perform much of the work involved in exploiting a patch gap. The report’s scope is narrower than an assessment of AI cybersecurity overall: it covers one model, one browser, a defined file-reading objective and a laboratory setup. The same setup did not succeed against Chrome after about $100,000 in attempts, according to Epoch. The report does not establish why those attempts failed or how the result would change under different conditions.
Mozilla’s Firefox 159 security advisory, identified in the source material as MFSA 2026-118, lists 167 fixes: 108 rated high, 52 moderate and seven low. The source notes that Mozilla changed how it counts security issues, so the total should not be read as a direct measure of a sudden increase in risk. The specific unpublished flaw reported by Epoch is part of the story; the advisory’s full list covers a wider set of security issues.
““Our central finding is that widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Lab Test Cannot Show
The report does not show that GLM 5.3 attacked Firefox users, that the technique has been used outside the lab, or that a real-world attacker has reproduced the results. Epoch’s test machine was isolated from the internet. It is also not yet clear whether the attacks described still work against Firefox 159: Epoch says it had not tested that release, while expecting Mozilla’s fix to make similar attacks substantially more difficult.
Other limits matter. Epoch systematically tested six releases, not every earlier version; it described earlier versions as likely vulnerable but did not establish that through the same testing. The Chrome attempts failed, but one unsuccessful setup does not show that Chrome or other browsers are broadly immune. The report also does not establish how often attackers could exploit a patch gap in real conditions, or whether other safeguards would prevent a file from being read.
Updates and Follow-Up Testing
Users should check that Firefox is updated to version 159 or later and restart it so the update takes effect. Organizations should apply browser security updates promptly and review their update practices, while treating Epoch’s results as a warning about the possible speed of patch analysis rather than evidence of a confirmed attack campaign.
The next key evidence would be testing against Firefox 159 and later versions, with results that clarify whether the reported attack chain has been blocked and whether related approaches remain possible. Mozilla’s release addresses the flaw Epoch disclosed; the report does not provide a broader assessment of all vulnerabilities in the browser or a timeline for further findings.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model built webpages that could read a local file when opened in each of six tested Firefox releases, from 156.0 through 158.0.1. The work took place in an isolated lab, not against real users.
What is the Firefox patch gap?
It is the period after a security fix or information about it becomes public but before users receive or install the update. Epoch says GLM 5.3 used public information about fixes during that gap to help build attacks.
Did Mozilla fix the vulnerability described in the report?
Epoch says it reported a previously unpublished flaw to Mozilla, which patched it in Firefox 159, released October 27. The researchers had not yet tested whether similar attacks work against Firefox 159.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. The report does not say that users were attacked or that the laboratory exploit was used in the wild.
Does the report prove AI can attack any browser?
No. Epoch tested GLM 5.3 against six Firefox releases in a particular lab setup. Its attempt to use the same setup against Chrome failed, and the report does not establish that other browsers are immune or vulnerable.
Source: ThorstenMeyerAI.com
