🔍 Read the full analysis: Can AI Turn A Firefox Security Fix Into A Working Attack? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that GLM 5.3, an open-weight model, built attacks against six Firefox releases by analyzing publicly visible security fixes. The lab tests used an additional, previously unpublished flaw that Epoch reported to Mozilla; Mozilla patched it in Firefox 159, released October 27. The researchers have not tested the setup against Firefox 159, and the work was not an attack on real users.
Epoch AI researchers say the open-weight model GLM 5.3 built working attacks against six successive Firefox releases by analyzing security fixes visible in public code before those fixes reached stable users. In the researchers’ lab test, a webpage could read a local file when opened in the targeted browser; Mozilla has since patched a second, unpublished flaw used in the attacks in Firefox 159, released October 27.
Epoch’s report, published October 29, describes tests against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. The researchers gave the model up to 48 hours per attempt. Its fastest successful run took 12 hours; after the test setup was built, Epoch estimated API costs of about $1,000 per version. The group says developing and testing that setup cost more than $100,000.
The task was to create a webpage that could read a file from the test computer when opened in a specified Firefox release. Epoch says the model used security fixes already visible in public source code to identify weaknesses, then combined them with a separate flaw that had not been publicly disclosed. That second flaw helped the attack get past Firefox’s sandbox, a security boundary intended to limit what a compromised webpage can access.
Epoch says it reported the unpublished flaw to Mozilla, which fixed it in Firefox 159. The report describes a controlled lab exercise, not an incident involving real Firefox users. Researchers ran the test on Ubuntu 26.04 with default settings and no internet access, so the environment could not target outside websites or people. The demonstrated result was file reading, not full control of a computer.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk in Public Patch Gaps
The finding focuses attention on the period between a security fix becoming visible and users installing an update. In open-source projects, changes to public code can reveal which part of a program was vulnerable. That information helps defenders understand and verify a patch, but it may also give attackers clues about what to investigate in versions that have not yet received it.
Epoch argues that the work shows widely available open-weight models can automate much of this analysis and attack development. In its experiment, GLM 5.3 selected fixes, tested approaches and recovered from crashes without further researcher input. That does not establish how often such attacks will occur outside a lab, but it indicates that the time and expertise needed to turn patch information into an exploit may be changing.
For users, the immediate practical point is to install current browser security updates and restart the browser when required. For software makers and organizations, the report highlights the value of reducing delays between publishing fixes and deploying them. The attack also depended on an additional flaw, so the public patch information alone was not the entire route to the demonstrated file access.
Products Worth Considering
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
Apple Mac mini Desktop Computer with M4 chip, 10‑core CPU and GPU, 24GB Unified Memory, 512GB SSD, Gigabit Ethernet
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
As an affiliate, we earn on qualifying purchases.
How Firefox Fixes Became Clues
A patch gap is the interval after a fix or details about it become available but before all affected systems have installed the update. Epoch’s test examined this gap by giving GLM 5.3 the public information available at the time each Firefox version was released. The researchers said Mozilla’s code changes were presented as ordinary updates; the model was instructed to examine fixes that had not yet reached the stable release.
Epoch tested six releases in sequence, from Firefox 156.0 to 158.0.1. It says all six attempts succeeded under the study’s conditions. The researchers also tried the same general setup against Chrome, where it failed after about $100,000 in attempts. That comparison is limited to this particular setup and does not establish that Chrome or other browsers are generally safe from AI-assisted exploitation.
Mozilla’s Firefox 159 release included the fix for the flaw Epoch reported. The source material says Mozilla’s advisory, MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low. The number of fixes should be read in the context of Mozilla’s stated counting approach, rather than treated by itself as a direct measure of the browser’s security.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Testing Will Show
Epoch says it has not tested the same setup against Firefox 159. The researchers expect Mozilla’s patch to make the demonstrated attack substantially more difficult, but the report does not establish whether another route could work or whether similar methods apply to other browsers and software.
The six successful runs were controlled experiments on specified releases and a particular operating-system setup. Epoch says earlier Firefox versions are likely vulnerable, but it did not systematically test them. The study also does not show that an attacker used GLM 5.3 against actual users, or establish how frequently models could produce working attacks in real-world conditions.
Epoch reported that it encountered no refusals or safeguards from the providers whose systems it used, including GLM 5.3’s maker, Z.ai. That observation concerns the researchers’ test and its framing as a security exercise; it does not, by itself, describe every provider’s policies or model behavior in other circumstances.
Updates and Follow-Up Tests
Mozilla has released Firefox 159 with the fix for the unpublished flaw identified by Epoch. Users should update to version 159 or later and restart the browser so the update takes effect. Organizations can check that managed devices have received the release and that older, unsupported versions are not still in use.
The next evidence point is whether Epoch or other researchers test the reported attack chain against Firefox 159 and publish the results. Further work would also be needed to establish how well the method transfers to other browsers, operating systems and real-world environments. Until those details are available, the report supports a specific finding about six lab-tested Firefox releases—not a claim that current Firefox users are being attacked.
Key Questions
Did GLM 5.3 attack Firefox users?
No real users were targeted in the reported work. Epoch describes a lab test using an isolated machine without internet access.
What could the demonstrated attack do?
In the test, a webpage could read a local file when opened in a targeted Firefox version. The report does not say the attack took over the computer.
Which Firefox versions did Epoch test?
Epoch reports successful tests against Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. It says earlier versions were not systematically tested.
Has Mozilla fixed the flaw?
Mozilla released Firefox 159 on October 27, including a fix for the unpublished flaw Epoch reported. Epoch has not yet tested the same setup against that release.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. Organizations should confirm that managed devices have installed the update.
Source: ThorstenMeyerAI.com
