🔍 Read the full analysis: AI And Firefox Patches: What Epoch AI Showed Security Researchers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that the open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing publicly visible security fixes before users received updates. Mozilla patched an additional, unpublished flaw used in the tests in Firefox 159; the experiment was conducted in a lab, and Epoch has not tested whether the attacks still work against that release.
Epoch AI says the open-weight model GLM 5.3 built working attacks against six consecutive Firefox releases by studying security fixes that were public before users received the corresponding updates. The lab attacks could make a browser read a local file when a user opened a webpage; Mozilla patched an additional flaw used in the tests in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers said they tested Firefox releases 156.0 through 158.0.1, which appeared between September 17 and October 26. The model used information available at each release date, including fixes visible in Firefox’s public code but not yet included in the stable version many users had installed. That period between disclosure of a fix and users receiving or applying it is commonly called the patch gap.
Epoch set a limit of 48 hours per attempt; the fastest successful run took 12 hours. The researchers estimate that repeating the process against each new Firefox version cost about $1,000 in API fees once their setup was built. They say developing and testing that setup cost more than $100,000. Those figures describe the study’s resources and test conditions, not a guaranteed cost or timeline for attacks outside the lab.
The researchers asked the model to create a webpage that could read a local file in a specified Firefox version. According to Epoch, GLM 5.3 selected bugs, developed an attack chain and responded to crashes without additional guidance. Each successful test also used a flaw that had not been publicly disclosed. Epoch reported that vulnerability to Mozilla, which fixed it in Firefox 159. The researchers said they encountered no safety refusal from the providers they tried, including the model’s maker, Z.ai.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Public Fixes Can Aid Attackers
The report highlights a practical risk in the timing of software updates: a public fix can reveal where a weakness existed before every user has installed the correction. Security researchers have long recognized that attackers can study patches. Epoch’s finding is that an available open-weight model could automate much of that analysis and produce a working lab attack in hours, rather than requiring a specialist to do every step manually.
That does not establish that GLM 5.3 or another model has attacked Firefox users in the wild. The tested outcome was reading a local file, not taking control of the computer, and the researchers’ environment had no internet access. Still, the results are relevant to software makers and organizations that need to prioritize updates: a patch’s public release may give attackers useful information quickly, increasing the value of installing security updates promptly.
For Firefox users, the immediate practical step is to update to version 159 or later and restart the browser, in line with the source report’s guidance. The study does not show that every user on an older release was exposed, nor that updating alone resolves all browser security risks.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
As an affiliate, we earn on qualifying purchases.
The Firefox Patch Gap Test
Firefox is an open-source browser, so changes to its code can be inspected publicly. Epoch focused on security fixes visible in development or public code before they reached the stable release being tested. The model was directed to examine fixes not yet present in that release; the researchers say it had basic tools and version information but no internet access. It could not visit real websites or target people during the experiment.
The test ran on Ubuntu 26.04 with default settings and an official Firefox release. Epoch chose file reading as its target because access to browser-held information or private documents could be harmful. The researchers say the successful chains combined a weakness revealed through an upcoming fix with a separate, unpublished flaw that bypassed Firefox’s sandbox, which is intended to limit what a compromised webpage can access.
Epoch also tried the setup against Chrome, but says it failed after about $100,000 in attempts. The report does not establish that Chrome is broadly resistant to AI-assisted vulnerability research; it records the outcome of this particular effort. Epoch said earlier Firefox releases were likely vulnerable too, but it did not systematically test them.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Firefox 159 Has Not Been Tested
Epoch said it had not tested whether similar attacks work against Firefox 159. The report therefore does not confirm that the new release blocks every relevant attack path; the researchers expect the fix to make similar attempts substantially more difficult. The source material also does not report evidence of real-world exploitation, identify affected users, or establish how often attackers are using AI in this way.
The six-release result applies to the versions and setup Epoch tested. Its estimate that earlier releases were likely vulnerable is not based on systematic testing. The reported costs and fastest run time also depend on the study’s particular model access, tools and prebuilt setup, and should not be read as universal estimates.
The source notes that Mozilla’s Firefox 159 advisory lists 167 security fixes: 108 rated high, 52 moderate and seven low. It also cautions that the total is affected by a change in Mozilla’s counting method. The material provided does not give enough detail to compare those figures directly with earlier advisories.
Update Firefox and Watch for Testing
Firefox users should install version 159 or later and restart the browser, as the source report advises. Organizations should check that managed browsers receive security updates promptly, particularly when public code or advisories can expose details about vulnerabilities before every device is patched.
The next technical question is whether independent testing confirms how effectively Firefox 159 addresses the attack paths Epoch used. Epoch may publish further results, and Mozilla may provide additional information through security advisories. Until then, the reported lab successes and Mozilla’s patch are confirmed by the supplied account, while the fix’s performance against similar attacks remains untested in Epoch’s study.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model used public Firefox code and security-fix information to build webpages that could make tested browser versions read a local file. The work was carried out in a lab, not against real users.
Which Firefox versions did the researchers test?
The report says the successful tests covered six releases from 156.0 to 158.0.1, issued between September 17 and October 26, 2026. Epoch said it did not systematically test earlier releases.
Did Mozilla fix the flaw found during the experiment?
According to Epoch, it reported an additional, unpublished flaw to Mozilla, which patched it in Firefox 159, released October 27, 2026. Epoch had not tested whether similar attacks still work against that version.
Was this an attack on Firefox users?
No real-world attack is reported in the supplied material. Epoch described a controlled test with no internet access; the demonstrated outcome was file reading, not full computer takeover.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. The report does not say that every older installation was exploited or that the experiment establishes ongoing attacks.
Source: ThorstenMeyerAI.com
