🔍 Read the full analysis: Can You Download An AI That Turns Firefox Fixes Into Attacks? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
In a controlled test, Epoch AI researchers used the open-weight model GLM 5.3 to create file-reading attacks against six Firefox releases by analyzing publicly visible security fixes. Mozilla patched an additional, previously unpublished flaw used in the attacks in Firefox 159, but Epoch has not yet tested whether similar attacks work against that release.
Epoch AI researchers report that the downloadable open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, turning publicly visible security fixes into a route to read a file on the test computer. Mozilla released Firefox 159 on October 27, patching a separate, previously unpublished flaw that the successful attacks also used; Epoch has not yet tested whether comparable attacks work against that version.
In the study, published October 29, six Epoch AI researchers gave GLM 5.3 a specific task: create a webpage that could read a local file when opened in a specified Firefox version. The model succeeded against six releases from 156.0 through 158.0.1, released between September 17 and October 26. Epoch allowed up to 48 hours for each attempt; its fastest successful run took 12 hours.
The researchers say the model used information that was public when each version came out, including security changes in Firefox’s public code that had not yet reached stable-release users. Epoch describes the interval between a fix becoming visible and users installing it as the patch gap. The researchers said they gave the model basic tools and version information, then let it select fixes and work on the attack without further human input.
Each successful attack also used a flaw that had not been publicly disclosed, according to Epoch. The researchers reported that vulnerability to Mozilla, which fixed it in Firefox 159.0. Epoch estimates that, after its test setup was built, each additional Firefox-version attempt cost about $1,000 in API fees. Building and testing the setup cost the research group more than $100,000, according to its account.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Exploits
The study highlights a security risk that can arise before users install an update: a public repair can reveal information about the weakness it addresses. A person analyzing a code change may be able to use it as a clue to identify and exploit a still-unpatched version. Epoch’s test suggests that a widely available model can help automate parts of that work, potentially reducing the specialist effort needed.
That does not show that GLM 5.3 attacked Firefox users in the wild. The researchers ran a controlled lab experiment without internet access, and the demonstrated result was file reading, not control of the whole computer. Still, the reported speed matters to defenders: if a model can turn public fixes into working techniques within hours, organizations may have less time to update systems after security details become visible.
For individual users, the practical step is to install Firefox 159 or a later release and restart the browser so the update takes effect. Organizations may also need to account for how quickly they can distribute browser updates across managed devices. The study does not establish how often attackers will use this approach or how reliably it works outside the tested environment.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones – Active Over‑Ear Noise Cancelling with Mic, USB‑C Charging, Deep Bass, up to 24 h Playtime,
De'Longhi La Specialista Touch Semi-Automatic Espresso Machine with Grinder
TCL 65-Inch 4K UHD Smart LED TV (65S425)
As an affiliate, we earn on qualifying purchases.
How the Firefox Test Worked
Firefox is an open-source browser, so changes to its code can be visible before an update is installed by all users. Epoch’s researchers focused on security fixes that were public in the project’s code but had not yet reached the stable version being tested. Their goal was to see whether a model could use those changes to build a webpage that read a local file when opened in that version of Firefox.
The test ran on Ubuntu 26.04 with default settings and an official Firefox release. Epoch says the model had no internet access, so it could not target a real website or person. In the successful runs, the model combined clues from a forthcoming fix with a second flaw that helped the attack get past Firefox’s sandbox, the boundary intended to keep a compromised page away from local files.
The researchers reported successes on Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. They did not systematically test earlier versions. The report also says the same setup failed against Chrome after about $100,000 in attempts; that result describes this particular experiment, not all models or possible attacks on Chrome.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Changes
Epoch has not reported testing whether the attack chain, or similar approaches, works against Firefox 159. Its expectation that the patch makes such attacks substantially harder is not a confirmed test result. The report also does not establish whether anyone used GLM 5.3 or another model to exploit Firefox users outside the lab.
The findings apply to the specific model, task, system configuration and versions tested. Epoch says earlier Firefox releases are likely also vulnerable, but it did not systematically test them. The researchers reported no refusals or safeguards from the providers they used during the experiment, including the model’s maker, Z.ai; that observation concerns this test and does not establish how every user or deployment would behave.
Mozilla’s Firefox 159 security advisory lists 167 fixes: 108 rated high, 52 moderate and seven low. The source report cautions that the count is affected by a change in Mozilla’s counting method. The figures do not, by themselves, show that all listed fixes were used in Epoch’s attacks or that every user faces the same level of risk.
Update and Retest the Browser
Users should install Firefox 159 or a later version and restart the browser. Organizations that manage Firefox centrally can check whether the update has reached their devices. The account provided for this report does not give a separate Mozilla estimate of how many users remain on affected releases.
The next significant evidence would be Epoch’s testing of Firefox 159 and further technical details from the researchers or Mozilla. Until that testing is reported, the effect of the patch on this specific attack method remains uncertain. The broader question raised by the experiment is how quickly software teams can get fixes to users when public code changes may also help others identify the bugs.
Key Questions
What did GLM 5.3 do in the test?
Epoch AI says the model built webpages that could read a local file when opened in each of six tested Firefox releases, from 156.0 to 158.0.1. The experiment took place in a lab without internet access.
Did the test show that Firefox users were attacked?
No. The report describes a controlled experiment, not an attack on real users. It does not establish that anyone used the model against people outside the test.
Has Mozilla fixed the vulnerability used in the attacks?
Epoch says it reported a previously unpublished flaw to Mozilla, which patched it in Firefox 159.0, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that release.
What should Firefox users do?
Install Firefox 159 or a later release and restart the browser. The report does not provide evidence that updating alone addresses every possible risk from similar techniques.
How quickly did the model build an attack?
Epoch allowed up to 48 hours per attempt; the fastest successful run took 12 hours. The researchers estimated about $1,000 in API fees for each additional version after they had built their test setup.
Source: ThorstenMeyerAI.com
