🔍 Read the full analysis: How A Downloadable AI Turned Firefox Fixes Into Working Attacks—and What To Do on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that the downloadable, open-weight model GLM 5.3 built attacks against six Firefox releases by analyzing publicly visible security fixes, with its fastest attempt taking 12 hours. Mozilla says Firefox 159, released October 27, patched a separate flaw used in the attacks; users should update and restart. The results came from a controlled lab test, not attacks on real users.
Epoch AI researchers say an open-weight AI model, GLM 5.3, built working attacks against six Firefox releases by studying security fixes that were publicly visible before users received the updates. Mozilla released Firefox 159 on October 27, patching an additional vulnerability the researchers reported; the study, published October 29, describes a controlled experiment, not an attack on Firefox users.
The researchers tested versions 156.0 through 158.0.1, released between September 17 and October 26. They instructed the model to create a webpage that could read a local file when opened in a specified Firefox version. Epoch says the model succeeded against all six releases, using public information available when each version was released. The fastest successful run took 12 hours; Epoch allowed up to 48 hours per attempt.
According to Epoch, the model used upcoming security fixes in public code to identify weaknesses before those fixes reached stable-release users—a period known as the patch gap. Each successful attack also relied on a second flaw that had not been publicly disclosed. Epoch says GLM 5.3 rediscovered that flaw during each attempt and reported it to Mozilla, which patched it in Firefox 159.
Epoch estimated marginal API costs at about $1,000 per Firefox version once the testing setup was built. The research group said building and testing that setup cost it more than $100,000. It reported no safety refusals from the providers it tried, including Z.ai, the model’s maker. The test environment had no internet access, and researchers say the model did not target real people or websites.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk of the Patch Gap
The findings suggest that public security fixes can give attackers a faster route to finding weaknesses in software versions that have not yet been updated. The immediate concern is the interval between a fix becoming visible and users installing it: a disclosure intended to help defenders may also provide clues to someone trying to build an exploit. Epoch argues that open-weight models make this work more accessible, though its experiment does not establish how often such attacks will occur outside a lab.
The test’s file-reading goal could expose sensitive browser-accessible information, such as saved credentials, cookies or private documents, the researchers said. That is different from taking control of an entire computer. Epoch’s reported attack chain crossed Firefox’s sandbox, the isolation layer designed to restrict what a compromised webpage can access, but the study does not show a real-world compromise or demonstrate that Firefox 159 remains vulnerable.
For users, the practical response is straightforward: install Firefox 159 or later and restart the browser so the update takes effect. For software teams, the report highlights the importance of reducing delays between releasing a fix and getting it onto users’ devices, while recognizing that rapid disclosure can expose a patch gap.
Popular right now
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Roborock F25 BX Cordless Wet Dry Vacuum Mop
As an affiliate, we earn on qualifying purchases.
How Epoch Ran the Test
Epoch AI says it gave GLM 5.3 a specific Firefox version, basic tools and public information, but no internet connection. The model was told to examine fixes not yet present in the stable release and was then allowed to work without further researcher input. It selected fixes, tried approaches, diagnosed crashes and built a multi-stage attack, according to the report.
The researchers used a machine running Ubuntu 26.04 with default settings and an official Firefox release. They say they chose a local-file-reading target because it could have serious consequences if used against a real person. The experiment covered six releases from September 17 to October 26; Epoch said it did not systematically test earlier versions, which it described as likely vulnerable.
The reported success depended on both information revealed by upcoming fixes and an additional undisclosed flaw. Epoch disclosed that flaw to Mozilla before publication, according to the source report. The supplied material also says the same setup failed against Chrome after about $100,000 in attempts; that result is specific to this experiment and does not establish that other browsers are generally safe from AI-assisted attacks.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI
What the Experiment Cannot Show
The study does not establish whether a similar attack works against Firefox 159. Epoch said it had not tested that release and expected Mozilla’s fix to make the attack substantially more difficult. The supplied material does not include an independent assessment of the patch or a statement from Mozilla about the study’s findings.
It is also unknown how frequently attackers will use open-weight models this way, whether other models can reproduce the results, or how reliably the method would work beyond Epoch’s test setup. The researchers allowed as much as 48 hours per attempt and spent more than $100,000 building and testing their system, so the per-version API estimate does not represent the full cost of the research. No real-world victim or attack is reported.
The source material says Mozilla’s Firefox 159 advisory listed 167 security fixes, including 108 rated high, 52 moderate and seven low. It also cautions that the total was affected by a change in Mozilla’s counting method; the material provided does not explain the change in full. Those advisory figures should not be read as a count of vulnerabilities used by the AI experiment.
Update Firefox and Watch for Testing
Firefox users should update to version 159 or later and restart the browser. Users who are unsure which version they have can check the browser’s About Firefox information and apply any offered update. The report does not describe a separate user action beyond installing the patched release.
The next technical question is whether the attack chain still works against Firefox 159 or later. Epoch said it had not yet tested the patched release, so independent or follow-up testing would help establish the fix’s effect. Further reporting may also clarify Mozilla’s assessment of the flaw and how the company’s revised security-fix counting method affects the advisory totals.
Key Questions
What did GLM 5.3 do in the study?
Epoch AI says the model built attacks against six Firefox releases by analyzing publicly available security fixes and using another, undisclosed flaw. Its target was a webpage that could read a local file in a specified Firefox version.
Is Firefox 159 affected by the reported attack?
Epoch said it had not tested Firefox 159. Mozilla released that version on October 27 with a patch for the additional flaw the researchers reported, but the study does not verify how the attack performs against the patched release.
What should Firefox users do?
Install Firefox 159 or later and restart the browser. The source report does not identify a known attack on real users from this experiment.
Did the study show that AI took over computers?
No. The reported test aimed to read a local file; it did not demonstrate full computer takeover. Epoch ran the test without internet access and says it did not target real users or websites.
How much did the attacks cost?
Epoch estimated about $1,000 in marginal API fees per Firefox version after its setup was built. The group said building and testing the setup cost more than $100,000, so the per-version figure is not the total research cost.
Source: ThorstenMeyerAI.com
