🔍 Read the full analysis: AI Turned Firefox Security Patches Into Attacks: What Epoch AI Found on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI researchers say the open-weight model GLM 5.3 produced working attacks against six Firefox releases by analyzing publicly visible security fixes before users had installed them. Mozilla fixed an additional, previously unpublished flaw used in the test in Firefox 159, released October 27. The work took place in a lab, and Epoch has not reported testing the attack against Firefox 159.
Epoch AI researchers reported that the open-weight model GLM 5.3 built working attacks against six Firefox releases, using public security-fix information to create webpages that could read a local file when opened. The lab tests covered releases from September 17 to October 26, 2026; Mozilla says it fixed a separate flaw used in the attacks in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers said they gave GLM 5.3 a task: make a webpage that could read a file on a computer running a specified Firefox version. The researchers say the model succeeded against Firefox versions 156.0 through 158.0.1. In the fastest run, it took 12 hours; Epoch allowed up to 48 hours for an attempt. The researchers estimated API fees at about $1,000 per version after their test setup had been built, while building and testing that setup cost Epoch more than $100,000.
Epoch said the model used information visible in public code, including fixes that had not yet reached the stable release. That interval between a fix becoming public and users installing it is often called the patch gap. Researchers said GLM 5.3 identified relevant fixes and developed an attack without further input after receiving the target version and basic tools. The test environment had no internet access, according to Epoch, so the experiment did not target real websites or users.
The attacks also relied on a second vulnerability that Epoch said was not publicly known. The researchers reported that issue to Mozilla, which addressed it in Firefox 159. Epoch described the test as a local-file read, not a takeover of the computer. The report said the accessed files could include sensitive information, but the material provided does not establish that any real user’s data was accessed.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
When Public Fixes Become Attack Clues
The report highlights a security risk in the time between a software fix becoming visible and users receiving or installing the update. A patch can reveal details about the weakness it corrects. Epoch’s result suggests that, in this lab test, an accessible AI model could help analyze those changes and turn them into an attack within hours. That may shorten the time defenders have to update systems after fixes become public.
The findings do not show that GLM 5.3 attacked Firefox users, or that every public patch can be converted into a working exploit. They do show why organizations may need to treat patch publication and deployment as closely linked security steps. For individual users, Epoch’s report points to installing Firefox 159 or later and restarting the browser, though the article’s source material does not independently verify current version availability or update status.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
Firefox is an open-source browser, so changes to its code can be examined publicly. Epoch said its test gave the model access to information that was public when each browser release appeared, including code changes tied to fixes not yet included in the stable version. The model was instructed to examine those changes; it was not given a secret exploit or access to a victim’s computer.
Epoch tested six consecutive releases dated September 17 through October 26: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. The research group said it did not systematically test earlier releases, though it considered them likely vulnerable. It also reported that the same setup failed against Chrome after roughly $100,000 in attempts. That comparison is limited to Epoch’s particular test and does not establish that Chrome is broadly immune to AI-assisted exploitation.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
Firefox 159 Has Not Been Tested
Epoch had not tested whether the same attack chain works against Firefox 159 when the report was published. The researchers expected Mozilla’s fix to make similar attacks substantially more difficult, but that expectation is not a confirmed test result. The source material also does not provide a complete technical account of the attack or establish how often such model-assisted work could succeed outside this particular setup.
Epoch said it encountered no refusals or safeguards from the providers it used, including model maker Z.ai. That is the researchers’ report about their experiment; it does not establish how all providers or model versions would respond to other prompts. No real-world compromise was reported in the supplied material.
Patch Deployment and Follow-Up Testing
The immediate step for Firefox users is to install version 159 or later and restart the browser, following Mozilla’s update guidance. Organizations can review whether Firefox updates are being deployed promptly, particularly when public code changes may reveal details about repaired vulnerabilities.
Further testing against Firefox 159 would help establish how much the Mozilla fix changes the attack’s feasibility. Epoch’s report also leaves open whether similar methods will work against other software and how reliably models can reproduce the result. Until such evidence is available, the study is best read as a controlled demonstration of a patch-gap risk, not proof of an ongoing attack campaign.
Key Questions
What did GLM 5.3 do in the Epoch AI test?
Epoch says it built webpages that could read a local file when opened in each of six specified Firefox releases. The tests ran in an isolated lab environment, not against real users.
How did public Firefox fixes help the model?
According to Epoch, the model examined public code changes associated with fixes that had not yet reached the stable browser release. Those changes could provide clues about the underlying security weaknesses.
Did the attacks affect Firefox users?
The supplied report describes lab tests and does not report that real users were attacked or that user data was accessed. Epoch said the environment had no internet access.
Did Mozilla fix the vulnerabilities?
Mozilla released Firefox 159 on October 27, 2026, and Epoch said that release fixed a separate, previously unpublished flaw used in the successful tests. Epoch had not yet tested the attack against version 159.
What should Firefox users do?
Install Firefox 159 or a later version and restart the browser. The source material does not establish whether the attack chain works against Firefox 159.
Source: ThorstenMeyerAI.com
