🔍 Read the full analysis: What Does It Take For AI To Turn A Firefox Fix Into An Attack? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI researchers report that open-weight model GLM 5.3 built a working file-reading attack for each of six Firefox releases, using public security-fix information and a separate unpublished flaw. The fastest attempt took 12 hours; Mozilla patched the reported flaw in Firefox 159, but Epoch has not tested whether similar attacks work against that release.
Research group Epoch AI says the open-weight model GLM 5.3 built working webpages that could read a local file when opened in each of six Firefox releases, with the fastest attempt taking 12 hours. The lab test used public security-fix information and a separate, unpublished vulnerability; Mozilla says it patched that vulnerability in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers described testing Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave the model a target: produce a webpage that could read a file from a computer running a specified Firefox version when the user visited it. Epoch says the model succeeded against all six releases, using information that was public when each version came out.
The researchers allowed up to 48 hours per attempt; the quickest successful run took 12. After building the test setup, Epoch put the API cost at about $1,000 per version. The group says preparing and testing the overall setup cost more than $100,000. Those figures describe the study’s costs, not a general estimate of what any attacker would spend.
Epoch says GLM 5.3 identified fixes in public Firefox code before those fixes reached stable-release users, then combined one of those clues with a vulnerability that had not been publicly disclosed. The researchers reported the latter flaw to Mozilla. According to Epoch, Mozilla fixed it in Firefox 159. The study tested a controlled machine without internet access; researchers say it did not target real users, and the demonstrated impact was reading a file, not taking control of the computer.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Exploits
The finding matters because a security patch can reveal where a weakness existed before every user has installed the update. That interval, often called the patch gap, gives attackers a potential lead: the public change may provide clues for reproducing the bug while some devices remain unpatched. Epoch’s result suggests an AI model can help turn those clues into a working attack chain, rather than merely summarize code changes.
However, the report does not show that a real attacker used this method or that Firefox users were targeted. It also does not establish that the model can independently exploit arbitrary software. The test depended on a specific browser version, a defined goal, researchers’ prepared environment and a second flaw that Mozilla has since patched. The practical concern is the possibility of faster vulnerability research, not evidence of an ongoing campaign.
For users, the immediate step is to install Firefox 159 or later and restart the browser. For software makers, the study adds pressure to reduce the time between a fix becoming public and users receiving and applying it. The same public transparency that helps developers and security researchers can also expose useful clues to automated systems.
Popular right now
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How the Patch Gap Worked
Firefox is an open-source browser, so changes to its code can be inspected publicly. A fix may become visible in source code or preliminary builds before it reaches the stable version most people use. Epoch’s test focused on that interval: the model received the release version and available public information, including changes associated with fixes not yet present in that stable release.
The researchers describe the task as a security exercise and say they did not give the model internet access. Its output was intended to work against a local test machine, not a live victim. Epoch says the model chose fixes, attempted exploit paths, diagnosed crashes and changed approaches without further human input during runs. The study’s “no human input” description applies to the experiment after researchers had supplied the task and setup; people designed and funded the testing environment.
Epoch also tried the same general setup against Chrome. The group says it did not succeed after about $100,000 in attempts. That result is limited to the researchers’ test and does not establish that Chrome is immune or that the method cannot work against it under other conditions.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Firefox 159 Has Not Been Retested
Epoch said it had not tested whether similar attacks remained possible against Firefox 159. Its view that Mozilla’s fix should make them “at least substantially more difficult” is an expectation, not a confirmed result. The report also does not establish whether the attacks could be adapted to other operating systems, browser configurations or software.
The researchers reported that the successful runs used an unpublished vulnerability alongside clues from public fixes. The supplied material does not specify the vulnerability’s technical details or how broadly it could have been exploited before the patch. It also provides no evidence that the flaw or the model-generated attacks were used outside the lab. Epoch’s statement that it encountered no model refusals or safeguards describes its own testing; it does not establish how every provider or configuration would respond.
Mozilla’s Firefox 159 security advisory lists 167 fixes, but the source notes that Mozilla changed its counting approach. The total should not be read as a direct measure of how many newly discovered vulnerabilities were present without further detail on that accounting change.
Install the Patched Firefox Release
Firefox users should update to version 159 or later and restart the browser, as the source report advises. People who manage computers for an organization can check whether devices have completed the update, rather than relying only on a download or update prompt.
The next key technical question is whether the reported method still works against Firefox 159. Epoch said it had not completed that test at publication. Further findings from the researchers or Mozilla could clarify the effectiveness of the patch and whether comparable risks affect other browsers. Until then, the reported successes are evidence from a controlled Firefox experiment, not confirmation of attacks against users in the wild.
Key Questions
What did GLM 5.3 do in the study?
Epoch AI says the model created a webpage that could read a local file when opened in each of six tested Firefox releases. The study took place in a controlled environment, not against real users.
Did the model exploit a Firefox bug using public information alone?
Not according to Epoch’s description of the successful tests. The attacks used clues from public Firefox fixes as well as a separate, unpublished vulnerability, which Epoch reported to Mozilla.
Has Mozilla fixed the reported vulnerability?
Epoch says Mozilla fixed the reported flaw in Firefox 159, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that version.
Were Firefox users attacked in the real world?
The source material describes a lab test and gives no evidence that real users were targeted. The researchers’ test machine had no internet access.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser, following the source report’s recommendation.
Source: ThorstenMeyerAI.com
