🔍 Read the full analysis: Why Firefox Fixes Became Working Attacks In Epoch AI’s Demo on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reported that GLM 5.3 created working attacks against six Firefox releases by analyzing security fixes visible before users received updates. The tests were conducted in a lab, and Mozilla patched a separate, previously unpublished flaw used in the attacks in Firefox 159. The researchers have not reported testing the attacks against that release.
Epoch AI says an experiment with the open-weight model GLM 5.3 produced working attacks against six Firefox releases, by using security fixes visible in public code before those fixes reached users. In the researchers’ lab, the attacks made a webpage read a local file when opened in a targeted Firefox version; Mozilla has since patched a separate flaw used to complete the attacks in Firefox 159.
In a report published October 29, six Epoch AI researchers described testing versions 156.0 through 158.0.1, released from September 17 to October 26. The team gave the model up to 48 hours per attempt; its fastest successful run took 12 hours. Epoch reported about $1,000 in API fees for each version after researchers had built the test setup. Building and testing that setup cost the group more than $100,000, according to its account.
The researchers asked GLM 5.3 to make a webpage that could read a local file when visited in a specified Firefox version. They say the model examined publicly available information, including fixes in code that had not yet reached stable releases, and selected bugs and assembled an attack chain without further human input. Epoch said it had no internet access in the test environment, so the experiment did not target a live website or a real user. The result was a lab demonstration, not a reported attack in the wild.
Epoch says each successful attack against the recent releases also required a separate, unpublished vulnerability that let the chain get past Firefox’s sandbox. The researchers reported that issue to Mozilla, which patched it in Firefox 159.0, released October 27. Epoch has not said it tested the same attack against version 159. It expects the patch to make comparable attacks substantially harder, but that expectation is not a reported test result.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Why Public Fixes Can Aid Attackers
Firefox’s open development makes security changes visible in public code, while updates may take time to reach users. That creates a patch gap: someone can study a fix to infer what was vulnerable while some users still run the older version. Epoch’s experiment suggests, in this particular setup, an AI model could automate much of that analysis and turn it into a working attack within hours.
The practical concern is not that the study proves every newly published fix will be exploited quickly. It shows how a public repair can provide clues, and that an open-weight model was able to combine those clues with another flaw in a controlled test. If similar techniques are used outside a lab, the time between a patch becoming public and users installing it could matter more. The report does not establish that attackers have used this method against Firefox users.
For users, the direct step is to update Firefox to version 159 or later and restart it, as the source report advises. For software maintainers and organizations, the demonstration underscores the value of timely updates and careful handling of security disclosures. It does not establish that delaying publication of fixes is safer overall, or that any one update strategy prevents exploitation.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Logitech MX Keys S Wireless Keyboard, Graphite
FLEXISPOT EN1 Electric Standing Desk, 48 x 24 in, Black
As an affiliate, we earn on qualifying purchases.
How Firefox’s Patch Gap Worked
The experiment concerns a familiar timing problem in software security. A developer fixes a bug, but the change can become visible before every user has installed the update. In open-source projects such as Firefox, researchers and potential attackers can inspect code changes. Epoch’s report says Mozilla’s fixes were presented as ordinary code changes, but GLM 5.3 still identified changes relevant to security.
Epoch tested the model on a machine running Ubuntu 26.04 with default settings and an official Firefox release. It supplied the browser version and basic tools, along with public information available at the time, and instructed the model to examine fixes not yet included in the stable release. The researchers say the model diagnosed crashes, abandoned unsuccessful approaches and continued without additional human direction.
The target was a file-reading attack, not a full takeover of the computer. Epoch said access to a local file could expose sensitive material such as browser-saved passwords, login cookies or private documents. The report also says the same setup failed against Chrome after about $100,000 in attempts. That result applies to this experiment; it does not show that Chrome is immune to other approaches.
“widely available open-weight models can now do much, or even all, of this work on their own”
— Epoch AI researchers
What the Demonstration Does Not Establish
The findings are from a controlled lab test; Epoch did not report an attack on real Firefox users. The report describes six tested releases, but does not establish how often similar attacks could be built against other software, models or operating systems. Epoch said earlier Firefox releases were likely vulnerable, but they were not systematically tested.
It also remains unclear whether the same attack chain works against Firefox 159 or how much the patch changes the effort required. Epoch’s expectation that the fix will make attacks substantially harder is not a substitute for testing. The source material does not describe independent validation of the demonstrations, and it does not establish that model providers had been contacted about safeguards beyond Epoch’s statement that the researchers encountered no refusals or safeguards from providers, including GLM 5.3’s maker, Z.ai.
The report’s figures also describe different costs: about $1,000 in API fees per version after the setup existed, and more than $100,000 for building and testing that setup. Those amounts are Epoch’s estimates for this experiment, not a general cost benchmark for AI-assisted attacks. The source material notes that Mozilla changed its method of counting security fixes, so totals in its Firefox 159 advisory need that qualification; the supplied account does not give the full explanation.
Firefox Updates and Follow-Up Testing
Users should install Firefox 159 or later and restart the browser, according to the source report. Mozilla’s release of version 159 on October 27 included the patch for the previously unpublished flaw reported by Epoch. Users and organizations can check that their deployed browsers have received the update rather than assume a download or installation has completed.
The next key evidence would be testing against Firefox 159 and determining whether the patched browser resists the demonstrated chain. Epoch’s report, as described in the supplied material, does not provide that result. Further work could also clarify how broadly the approach applies beyond the six tested releases and whether other models can reproduce the findings under comparable conditions.
For now, the established development is narrower than a claim that AI is attacking Firefox users: Epoch reported a successful lab demonstration using public fixes and a separate flaw, and Mozilla patched that flaw. Whether similar attacks are occurring outside research settings, and how quickly comparable methods can be applied to other software, remain unanswered.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch AI says the model built webpages that could read a local file when opened in six specified Firefox releases. The work happened in a controlled lab environment, not in reported attacks on real users.
How did public Firefox fixes help the model?
The researchers say GLM 5.3 analyzed fixes visible in public code before those fixes had reached the stable browser used in each test. A code change can reveal information about the bug it repairs, creating a period when users may still have an older version.
Did the attacks work against Firefox 159?
Epoch had not reported testing the attacks against Firefox 159. Mozilla released that version with a patch for a separate, previously unpublished flaw used in the demonstrations; Epoch expected the patch to make similar attacks substantially harder.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser, as the source report advises. The report does not say that real users were targeted in the experiment.
Does the report show that AI attacks are happening in the wild?
No. It describes a lab demonstration and does not establish that the technique has been used against real Firefox users. Whether similar attacks are occurring outside research settings remains unclear.
Source: ThorstenMeyerAI.com
