🔍 Read the full analysis: What To Do After AI Turns Firefox Fixes Into Working Attacks on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that the open-weight model GLM 5.3 built attacks against six Firefox releases by analyzing publicly visible security fixes, with its fastest run taking 12 hours. The attacks also relied on a separate, previously unpublished flaw that Epoch reported to Mozilla; Mozilla says Firefox 159, released October 27, fixes it. The work was a controlled lab test, not an attack on real users.
Epoch AI reported on October 29 that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible in public code before users received the corresponding stable updates. In the researchers’ controlled test, a webpage could read a local file when opened in a vulnerable browser; Mozilla says it patched a separate, previously unpublished flaw used in the attacks in Firefox 159, released October 27.
Epoch’s six researchers tested Firefox versions 156.0 through 158.0.1, released from September 17 to October 26. The model was given up to 48 hours per attempt and completed its fastest run in 12 hours. Epoch estimates that, after its testing setup was built, each additional Firefox version cost about $1,000 in API fees. The group says developing and testing the setup cost it more than $100,000.
The task was to create a webpage that could read a file on a computer running a specified Firefox version. Epoch says GLM 5.3 selected relevant fixes from public information and assembled an attack chain without further human input during the runs. The researchers report that each successful attack on recent versions also used a separate flaw that had not been publicly disclosed. They reported that vulnerability to Mozilla, which fixed it in Firefox 159. Epoch says it did not test whether similar attacks work against that release.
The experiment was conducted in a lab, on a test machine running Ubuntu 26.04 and an official Firefox release. Epoch says the model had no internet access, so it could not target real websites or users. The reported capability was to read local files; the study does not say the attacks took control of a computer. Epoch also reports that its setup failed against Chrome after about $100,000 in attempts.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Shorten Attack Timelines
The findings focus attention on the patch gap: the period after a security fix becomes visible but before users install an update. Public fixes help developers and users understand what has changed, but they can also reveal clues about the weakness being addressed. Epoch’s test suggests that a capable, widely available model can help turn those clues into an exploit more quickly than many defenders may expect.
That does not establish that attackers have used GLM 5.3, or another model, to target Firefox users. The study was a controlled demonstration, and its results depend on the researchers’ setup and chosen target. Still, if similar methods are applied outside a lab, the time available to install a browser update may matter more. For organizations, the practical concern is how quickly they can test, distribute and apply security updates across managed devices.
For individual users, the immediate step is straightforward: update Firefox to version 159 or later and restart it. Keeping software current reduces exposure to known flaws, though no update can guarantee protection from every vulnerability. Browser and operating-system security remain layered defenses, and the risk of exploitation cannot be assessed from this study alone.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
As an affiliate, we earn on qualifying purchases.
How Firefox Fixes Became Clues
Firefox is an open-source project, and security-related changes may be visible in public code before a stable release reaches all users. Epoch describes the resulting exposure period as the patch gap. The broader issue predates this experiment: security researchers have long studied whether a patch can help reveal the bug it fixes. The development Epoch emphasizes is that an open-weight model performed much of that analysis and attack construction in its test.
Epoch says the model was instructed to examine fixes not yet included in the stable version and given basic tools and version information. Researchers allowed it to work without intervening during each run. The test target was deliberately limited to reading a local file, rather than taking over the machine. Epoch says such access could expose sensitive material, including saved passwords, login cookies or private documents, but the experiment does not show that any such data was taken from real users.
Mozilla released Firefox 159 on October 27, two days before Epoch’s report. The supplied source says Mozilla’s advisory, MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low. It also cautions that Mozilla changed its counting method, so the total should not be treated as a like-for-like comparison with earlier releases.
What the Lab Test Cannot Establish
Epoch’s results do not establish that the attacks were used against real Firefox users. Its test environment had no internet access, and the researchers say the model could not reach a real website or person. The study also does not show that GLM 5.3 can reliably produce the same result against other browsers, operating systems or configurations. Epoch reports that its attempt against Chrome did not succeed, but that finding is limited to its own setup and spending.
It remains unclear whether Firefox 159 fully prevents variants of the demonstrated attack. Epoch says it has not tested that version and expects the reported fix to make attacks substantially more difficult. The source material does not provide an independent replication of the experiments, details of any real-world exploitation, or evidence that users’ files were accessed. Epoch also says earlier Firefox versions were likely vulnerable, but it did not systematically test them.
Update Firefox and Watch Advisories
Firefox users should install version 159 or later and restart the browser, following Mozilla’s update guidance. Organizations that manage browser deployments can review their update status and Mozilla’s security advisory, then apply the release through their usual testing and rollout process. Users should also keep operating systems and other software current, since the study does not address every layer that can affect security.
The next evidence to watch for is whether Epoch or independent researchers test Firefox 159 and publish results, and whether Mozilla issues further advisories related to the reported flaw. The source material does not give a date for additional testing or report any real-world attacks linked to the experiment. Until more information is available, the study is best understood as a warning about the speed of lab-developed attacks during the patch gap—not proof that Firefox users were targeted.
Key Questions
What did Epoch AI report?
Epoch says GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing public security-fix information. The work was conducted in a controlled lab test, not against real users.
Was the attack used against Firefox users?
The source material reports no real-world attack. Epoch says its test machine had no internet access and could not reach real websites or people.
Which Firefox version includes Mozilla’s fix?
Mozilla released Firefox 159 on October 27, 2026. Users should update to version 159 or later and restart the browser. Epoch says it has not tested whether similar attacks work against version 159.
What did the demonstrated attack do?
In the researchers’ test, a webpage could read a local file on a computer running a targeted Firefox version. The study does not report a computer takeover or theft of files from real users.
Does the study show that AI can attack every browser?
No. Epoch reports that its setup failed against Chrome after about $100,000 in attempts. That result applies to the researchers’ test and does not establish how the model would perform against other browsers or configurations.
Source: ThorstenMeyerAI.com
