🔍 Read the full analysis: Working Attacks From Firefox Fixes: The Role Of A Downloadable AI on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that downloadable, open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible in public code before users received updates. The attacks also depended on an unpublished flaw that Epoch reported to Mozilla; Mozilla says Firefox 159, released October 27, fixes it. The work was conducted in a controlled lab, and the researchers have not reported testing the attack against Firefox 159.
Researchers at Epoch AI report that the downloadable open-weight model GLM 5.3 built working attacks against six Firefox releases by studying publicly visible security fixes before those updates reached users. Mozilla has patched an additional, unpublished flaw used in the lab attacks in Firefox 159, released October 27, according to the researchers; whether the attack still works against that release has not been tested.
In the report published October 29, six Epoch AI researchers describe instructing GLM 5.3 to create a webpage that could read a local file when opened in a specified Firefox release. The researchers say the model succeeded against versions 156.0 through 158.0.1, spanning releases from September 17 to October 26. Epoch allowed up to 48 hours for each attempt; its fastest successful run took 12 hours.
The model’s main source of clues was the set of fixes already visible in public Firefox code but not yet included in the stable version installed by users. Epoch describes the exposure period between a fix becoming public and users installing the update as the patch gap. For attacks on recent versions, the researchers say GLM 5.3 also found an unpublished vulnerability that helped it get past Firefox’s sandbox, a security boundary intended to restrict what a compromised webpage can access. Epoch reported that flaw to Mozilla, which fixed it in Firefox 159.
Epoch says each attempt cost about $1,000 in API fees after researchers had built their testing setup, which cost more than $100,000. The report says the model received no internet access, so it could not target real websites or people, and researchers observed no refusals or safeguards from the providers involved. These are the researchers’ findings from a controlled test, not evidence that users were attacked.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Shorten Attack Windows
The findings suggest that an attacker may be able to use a public software fix as a guide to the weakness it addresses, even before many users have installed the update. Epoch’s experiment adds a new concern: a widely available model was able to carry out much of the analysis and testing without a researcher directing each step. That could make some vulnerability research faster or more accessible, though the study does not establish how often this would happen outside its test setup.
The demonstrated consequence was a webpage able to read a local file in the tested environment. Epoch says such access could expose sensitive material, including saved passwords, login cookies or private documents. The researchers did not report that the attack took over the computer, and their lab configuration prevented contact with real targets. The practical message for users is straightforward: apply browser security updates promptly. For software makers and organizations, the report highlights the time between publishing a fix and deploying it as a period that may carry security risk.
Popular right now
Shark HydroVac MessMaster Corded Wet/Dry Vacuum, Mop & Self-Clean (WD161)
TCL QM64L 85-Inch QD-Mini LED 4K Smart Fire TV
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
Firefox is an open-source browser, so code changes that address security problems can become visible before a corresponding update is installed across users’ devices. In the scenarios Epoch tested, GLM 5.3 examined those changes to identify weaknesses that were being fixed, then attempted to construct an attack for the earlier release. The researchers say Mozilla presents security-related code changes in ways that do not necessarily label them as fixes, but the model still identified useful information.
The study focused on six successive Firefox releases and a specific outcome: reading a local file from a browser session. Epoch says it gave the model the relevant release version and basic tools, while restricting internet access and allowing it to operate without ongoing human input. It reports that the model selected fixes, pursued attack paths and adjusted after crashes. This describes the researchers’ account of their experiment; it does not show that every open-weight model can perform the same task, or that every public security fix can be converted into an attack.
Epoch also reports a limit: the same setup did not succeed against Chrome despite roughly $100,000 in attempts. The report says earlier Firefox releases are likely vulnerable too, but those versions were not systematically tested. Mozilla’s Firefox 159 security advisory lists 167 fixes, according to the source material, but that total alone does not establish the severity or exploitability of every issue in the browser.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
Firefox 159 Has Not Been Tested
Epoch says it has not tested whether the attack works against Firefox 159, the version Mozilla released with a fix for the unpublished flaw. The researchers expect the fix to make similar attacks at least substantially more difficult, but that is an expectation rather than a reported test result. The source material does not include a statement from Mozilla about the experiment or the effectiveness of the patch.
The study also does not establish whether attackers have used GLM 5.3 or similar models against real Firefox users. Its tests had no internet access and targeted a local lab environment. Epoch’s reported results apply to the releases and setup it tested; older versions were not systematically assessed, and the Chrome attempts were unsuccessful under the researchers’ setup.
Install the Patched Firefox Release
Firefox users should update to version 159 or later and restart the browser, as advised in the source report. Organizations should check that managed devices have received the update rather than assuming that making a patch available means it has been installed.
The next evidence to watch for is whether Epoch or another research group tests the attack against Firefox 159 and reports results, and whether Mozilla comments further on the disclosed flaw. The broader question raised by the study is how software makers and users can reduce the period in which fixes are public but installations remain outdated. No real-world exploitation linked to this experiment is confirmed in the supplied material.
Key Questions
What did GLM 5.3 do in the experiment?
According to Epoch AI, it built webpages that could read a local file when opened in six tested Firefox releases. The work was performed in a controlled environment without internet access.
How did public Firefox fixes help the model?
The researchers say the model analyzed code changes that were publicly visible before users had received the corresponding stable update. Those changes provided clues about the weaknesses being fixed.
Did Mozilla fix the unpublished flaw?
Epoch says it reported the flaw to Mozilla and that Mozilla patched it in Firefox 159, released October 27, 2026. Epoch had not yet tested whether its attack still worked against that version.
Does the study show that Firefox users were attacked?
No such real-world attack is reported in the supplied material. Epoch describes a lab test with no internet access, not an incident involving users or live websites.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser, according to the source report. The study does not establish that older versions were attacked in the wild.
Source: ThorstenMeyerAI.com
