🔍 Read the full analysis: How AI Changed The Stakes For Firefox Security Fixes on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible before users received them. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159, released October 27; Epoch has not tested whether the attacks work against that version.
Epoch AI researchers report that the open-weight AI model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes that were public before the updates reached users. Mozilla released Firefox 159 on October 27 with a fix for an additional, previously unpublished flaw used in the tests; the findings show how quickly public patch information may help attackers, but do not establish that real users were attacked.
In a report published October 29, six Epoch AI researchers said they tested versions 156.0 through 158.0.1, released between September 17 and October 26. Their task was to build a webpage that could read a local file when opened in a specified Firefox version. Epoch said all six attempts succeeded, with the fastest taking 12 hours under a limit of 48 hours. Once its testing setup was built, the researchers estimated API costs at about $1,000 per version; developing and testing the setup cost more than $100,000.
The researchers said GLM 5.3 used information available publicly when each release appeared, including code changes that disclosed what Mozilla had fixed before all users had installed the update. Security researchers call the delay between a fix becoming visible and users applying it the patch gap. The study says the model selected relevant fixes, tested approaches, diagnosed failures and assembled the attack without further human input. Epoch reported no refusals or safeguards from the providers it tried, including GLM 5.3’s maker, Z.ai.
Epoch also said each successful attack against recent versions relied on a separate flaw that had not been publicly disclosed. The researchers reported that flaw to Mozilla, which patched it in Firefox 159.0, released October 27. Mozilla’s advisory for that release listed 167 security fixes, including 108 rated high, 52 moderate and seven low. Epoch has not tested whether its attacks work against Firefox 159.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Patch Gap Becomes Easier to Exploit
The report’s central concern is the time between a security fix becoming public and users installing it. A patch can reveal where software was vulnerable, even when the change is presented as an ordinary code update. If a model can help turn that information into an attack within hours, users and organizations may have less time to update before the weakness is exploited.
That finding does not mean Firefox users were targeted or that GLM 5.3 carried out attacks outside the researchers’ lab. It does suggest that the work of analyzing fixes and testing attack paths may no longer require a specialist to perform every step. For organizations, the practical implication is to treat browser updates as time-sensitive and to have a process for installing and restarting software promptly. Individual users should update Firefox to version 159 or later and restart the browser.
The demonstrated result was a local file read, not full control of a computer. Epoch said such access could expose sensitive material, depending on what files are available to the browser. The study therefore points to a serious risk without showing that every file, account or device would be compromised.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
FLEXISPOT EN1-PRO Electric Standing Desk, 79 x 32, Black Walnut
As an affiliate, we earn on qualifying purchases.
How the Firefox Tests Worked
Epoch ran the tests on a machine using Ubuntu 26.04, default settings and official Firefox releases. The model received the browser version, basic tools and public information available at the time. According to the researchers, it had no internet access, so it could not attack a live website or a person. Epoch instructed it to examine fixes not yet present in the stable release, then left it to work without additional guidance.
For the recent releases, the attacks combined a weakness made easier to identify by an upcoming fix with the separate, unpublished flaw that let the attack get past Firefox’s sandbox. A sandbox is a containment layer intended to limit what a compromised webpage can access. Epoch said it reported the latter flaw to Mozilla, which addressed it in version 159. The researchers did not publish detailed instructions for reproducing the attack in the material summarized here.
The result was not universal across browsers: Epoch said the same setup failed against Chrome after about $100,000 in attempts. The researchers said earlier Firefox versions were likely vulnerable too, but those releases were not systematically tested. The study’s results are therefore specific to its tested versions, configuration and attack goal.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What Firefox 159 Has Not Proven
Epoch has not tested the attacks against Firefox 159, so it is not yet clear whether the patched version blocks the demonstrated chain or how much harder exploitation has become. The researchers expect the fix to make similar attacks substantially more difficult, but that remains an expectation rather than a reported test result.
The study was a controlled exercise, not evidence that attackers used GLM 5.3 against Firefox users. The source material reports no real-world victims or exploitation. It also does not establish how often attackers will use this method, whether other models can reproduce the results, or how well the findings apply to different operating systems and browser configurations. Epoch’s claim that earlier Firefox releases were likely vulnerable is also not backed by systematic testing of those versions.
Updating Firefox and Testing the Fix
Firefox users should install version 159 or later and restart the browser, according to the guidance accompanying the report. Organizations will need to review how quickly browser updates reach managed devices, particularly when fixes are visible in public code before they are installed broadly.
The next major technical question is whether independent testing confirms that Firefox 159 prevents the demonstrated attack chain. Further work could also establish whether similar techniques apply to other browsers and whether models can reproduce the results under different conditions. Until those tests are reported, the study supports a warning about the patch gap—not a claim that current Firefox users are under attack.
Key Questions
What did GLM 5.3 do in the Firefox study?
Epoch AI said the model analyzed public Firefox security fixes and built webpages that could read a local file in six tested releases, from versions 156.0 to 158.0.1. The work took as little as 12 hours in the researchers’ lab.
Were real Firefox users attacked?
The report describes a controlled lab test, not attacks on real users. Epoch said its setup had no internet access, and the source material does not report real-world victims or exploitation.
Has Mozilla fixed the flaw used in the tests?
Mozilla released Firefox 159.0 on October 27 with a fix for an additional, previously unpublished flaw that Epoch said its successful attacks used. Epoch has not tested whether the attacks still work against version 159.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, as advised in the source material. The report does not say that users who have updated were targeted.
Source: ThorstenMeyerAI.com
