🔍 Read the full analysis: How To Prepare For AI That Analyzes Firefox Fixes For Attacks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing public security fixes, with its fastest attempt taking 12 hours. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether similar attacks work against that release. The study was conducted in a lab, not against real users.
Epoch AI researchers report that open-weight AI model GLM 5.3 turned public security-fix information into working attacks against six Firefox releases, with the fastest attempt taking 12 hours. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159, released October 27; the study was a controlled lab exercise, not an attack on browser users.
In its October 29 report, Epoch AI said it tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. The task was to make a webpage that could read a local file when opened in a specified Firefox version. Researchers gave the model public information available when each release appeared, basic tools and a machine running Ubuntu 26.04. The test environment had no internet access, so the experiment could not reach real websites or people.
Epoch allowed up to 48 hours per attempt; its quickest successful run took 12 hours. Once researchers had built the setup, they estimated API fees at about $1,000 per Firefox version. Developing and testing the setup cost Epoch more than $100,000, according to the report. Researchers said the model selected relevant fixes, tested approaches and adjusted after failures without further human input.
The successful attacks combined information from fixes that had become public with a previously unpublished flaw that the model rediscovered during each attempt. Epoch reported that flaw to Mozilla, which fixed it in Firefox 159. The researchers said they encountered no provider safeguards or refusals during the exercise, including from the model’s maker, Z.ai. These results describe this particular test, not the capabilities of every AI model or a confirmed attack against users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk in Public Security Fixes
When a software fix is visible before everyone installs the update, it can reveal which part of a program was vulnerable. That period is commonly called the patch gap. Epoch’s findings suggest that a readily available model may be able to analyze such information and help build an exploit faster than many users and organizations can update their software.
The practical concern is not that the study proves an AI attack is inevitable. Rather, it highlights a possible change in the time and expertise needed to turn a disclosed weakness into a working attack. If the gap between a fix becoming public and users installing it is measured in days, an attack developed in hours could leave some systems exposed. The report therefore reinforces the value of applying browser updates promptly and restarting the browser when required.
For defenders, the experiment also shows why publishing a patch does not immediately remove risk from systems that have not received it. Organizations may need to track browser versions across their devices and prioritize updates when security fixes are released. The study does not establish how often attackers will use AI this way or whether the reported method can be repeated outside the test conditions.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
Firefox is an open-source browser, and its code and changes can be publicly visible. Epoch says GLM 5.3 examined security fixes that were available in public code but had not yet reached users through the stable browser release. The researchers’ instruction was to inspect fixes not yet present in the target release and build a webpage capable of reading a local file.
According to Epoch, the model’s successful attempts used a chain involving a flaw indicated by an upcoming fix and a second, unpublished flaw that allowed the attack to get beyond Firefox’s sandbox. A sandbox is intended to limit what a compromised webpage can access. The researchers characterized the target as serious because a local file read could expose sensitive information, but they did not report that the test stole anyone’s data.
Mozilla released Firefox 159 on October 27, before Epoch’s report was published. The supplied source says Mozilla’s security advisory for that release listed 167 fixes: 108 rated high, 52 moderate and seven low. It also cautions that the count is affected by a change in Mozilla’s counting practices. The number should not be read as a direct measure of newly discovered, exploitable vulnerabilities without that qualification.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers, as quoted in the report
What Firefox 159 Has Not Settled
Epoch said it had not tested Firefox 159 to determine whether similar attacks remain possible. Its expectation that the patch will make them substantially more difficult is a research assessment, not a confirmed result from testing the updated browser. The supplied source advises users to update to Firefox 159 or later and restart, but it does not establish that every version or configuration is protected against every related method.
The study also does not show that real attackers used GLM 5.3 against Firefox users, that files were taken from users’ computers, or that the model’s results generalize to other browsers. Epoch’s setup failed against Chrome after about $100,000 in attempts, according to the report, but that single test does not prove Chrome or other software cannot be attacked this way. The source says earlier Firefox releases were likely vulnerable but were not systematically tested.
Other open questions include whether future models can repeat the work more cheaply or quickly, how often public fixes can be converted into practical attacks, and whether model providers will add safeguards for security-related requests. The report’s cost estimates apply to Epoch’s setup and API use; they are not a universal price for conducting such research or attacks.
Update Firefox and Monitor Follow-Up
Firefox users should install version 159 or later and restart the browser, following Mozilla’s update guidance. People who manage company devices can check which browser versions are deployed and prioritize updates on machines that remain behind. The source does not give a timetable for further Epoch testing or a Mozilla statement about whether the reported attack chain works against Firefox 159.
The next useful evidence would be independent or follow-up testing of patched releases, alongside any further technical details Mozilla or Epoch choose to publish. Until then, the report is best understood as a lab demonstration of a risk: public fix information helped an AI system construct attacks in a controlled setting, while the tested browser flaw has since been patched.
Key Questions
What did GLM 5.3 do in the Firefox study?
Epoch AI says the model built webpages that could read a local file in six specified Firefox releases, using public information about security fixes. The experiments took place in an offline lab, not on users’ computers.
Is Firefox 159 vulnerable to the attacks in the report?
Epoch had not tested Firefox 159 when it reported its findings. Mozilla released that version with a fix for the previously unpublished flaw used in the successful tests. Epoch expected the fix to make similar attacks substantially more difficult, but that expectation was not confirmed by testing in the report.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. Organizations should check that managed devices have received the update rather than relying on users to install it later.
Did the study show that real users were attacked?
No. Epoch described a controlled test environment with no internet access. The report does not establish that real users were targeted, that files were stolen, or that the model’s attacks were used outside the lab.
Does the result apply to Chrome or every AI model?
No. Epoch reported that the same setup failed against Chrome after about $100,000 in attempts. That result is limited to the researchers’ test, and the Firefox findings do not show that all models can reproduce the attacks.
Source: ThorstenMeyerAI.com
