🔍 Read the full analysis: Epoch AI Put A Downloadable Model To Work On Firefox Fixes on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Epoch AI reports that the downloadable open-weight model GLM 5.3 built working attacks against six Firefox releases, using publicly visible security fixes and a separate, unpublished flaw. Mozilla patched that flaw in Firefox 159, but Epoch says it has not tested whether similar attacks work against that release. The work was conducted in a lab, not against real users.
Epoch AI reports that the downloadable, open-weight model GLM 5.3 built working attacks against six Firefox releases by studying security fixes visible in public code before users had installed the updates. In the researchers’ lab test, a crafted webpage could read a local file when opened in a targeted Firefox version; Mozilla has since patched a separate flaw used in the attacks in Firefox 159.
The report, published October 29 by Epoch AI, describes tests against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. Epoch gave the model up to 48 hours per attempt. The fastest successful run took 12 hours, and the researchers estimated API fees of about $1,000 for each new version after the test setup had been built. They said building and testing that setup cost more than $100,000.
The model’s task was to make a webpage that could read a file from the computer of someone opening it in the targeted browser. Epoch says GLM 5.3 identified relevant fixes in public Firefox code, selected bugs, and developed the attack chain without researcher input during the attempts. The researchers reported that the tested setup had no internet access, limiting the work to a controlled environment rather than contact with real websites or users.
According to Epoch, each successful attack against the recent releases combined a weakness indicated by an upcoming security fix with a separate, unpublished vulnerability that could bypass Firefox’s sandbox. The researchers disclosed that second flaw to Mozilla. Mozilla addressed it in Firefox 159.0, released October 27. Epoch says it has not yet tested whether the same kind of attack works against version 159.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Speed Attack Development
The report highlights the risk created when a security fix becomes public before users have installed it. For open-source software such as Firefox, code changes can reveal where a weakness was found. Attackers may use that information to study older, still-installed versions. The period between a fix becoming visible and users applying it is commonly called the patch gap.
Epoch’s test suggests that an open-weight model can help automate parts of this work, including finding relevant changes and iterating on an exploit. That does not establish that the model can attack every browser or that real-world attackers have used this method. It does show why software makers and users may face pressure to close the patch gap quickly, particularly when fixes are publicly documented.
For users, the direct step is to install Firefox 159 or a later release and restart the browser, following the source report’s guidance. For organizations, the findings point to the value of prompt browser updates and a clear process for deploying security patches. The test does not show that updating alone removes every risk, but Mozilla has patched the specific undisclosed flaw Epoch reported.
Products Worth Considering
DJI Mini 4K Fly More Combo
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
Firefox’s security changes can become visible in public code before the corresponding stable release reaches every user. Epoch says it gave GLM 5.3 only information that was public when each tested version appeared, along with the target version and basic tools. The model was instructed to examine fixes not yet included in the stable release, then allowed to work without further human direction.
The researchers chose local file reading as the goal because access to browser-saved credentials, cookies or private documents could cause harm. In the reported chain, one weakness was suggested by the forthcoming fix; a second, not-yet-published flaw helped the attack get past Firefox’s sandbox, which is designed to restrict what a compromised webpage can access. The report says the test read files; it does not describe a full takeover of the computer.
Epoch also tested the same general setup against Chrome, but reported that its effort did not succeed after about $100,000 in attempts. The source says earlier Firefox versions were likely also vulnerable, but they were not systematically tested. These limits matter: the results describe a particular model, setup and target, not a measured rate of attacks across browsers or users.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
Firefox 159 Has Not Been Retested
Epoch has not tested Firefox 159 to determine whether similar attacks still work after Mozilla’s fix. Its researchers expect the patch to make such attacks substantially more difficult, but that remains an expectation rather than a reported test result. The source also does not establish whether any real users were targeted or harmed; the described work was a controlled lab experiment.
The findings are limited to one model and a specific Linux and Firefox setup. Epoch’s reported Chrome test failed, and the researchers did not systematically test earlier Firefox versions. The report therefore does not show how often this technique would succeed across different systems, configurations or browsers. Mozilla’s advisory for Firefox 159 lists 167 security fixes, but the source notes that changes in Mozilla’s counting practices affect how such totals should be interpreted.
Update Firefox and Watch for Testing
Firefox users should install version 159 or later and restart the browser, according to the source report. Organizations using Firefox should check that updates reach managed devices, since a released patch does not protect systems that continue running an older version.
The next key evidence would be testing of Firefox 159 and any further technical or security updates from Epoch AI or Mozilla. The source does not give a date for such testing or identify a planned follow-up report. Until more results are available, the confirmed development is that Mozilla patched the disclosed flaw, while the effectiveness of comparable attacks against the patched release remains unverified.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model built webpages that could read a local file when opened in six tested Firefox releases, using public security-fix information and a separate unpublished flaw.
Was this an attack on real Firefox users?
No real-user attack is described. Epoch says the experiment ran in a controlled lab environment without internet access; the report does not establish that users were targeted or harmed.
Did Mozilla fix the flaw?
Mozilla patched the separate, unpublished flaw reported by Epoch in Firefox 159.0, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that version.
How quickly did the model produce an attack?
Epoch allowed up to 48 hours per attempt and reported that its fastest successful run took 12 hours. After the setup was built, the researchers estimated API fees at about $1,000 per tested Firefox version.
What should Firefox users do?
Install Firefox 159 or a later release and restart the browser, as advised in the source report. The report does not establish whether the tested attack works against version 159.
Source: ThorstenMeyerAI.com
