🔍 Read the full analysis: Downloadable AI And Firefox Security: What Epoch AI Showed on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI says the downloadable, open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled lab test, using security-fix information that was public before users had installed the updates. The tests also relied on a separate, previously unpublished vulnerability that Epoch reported to Mozilla; Mozilla says Firefox 159, released October 27, fixed it. The study did not test attacks on real users or establish whether the method works against Firefox 159.
Epoch AI reported October 29 that the open-weight AI model GLM 5.3 built working attacks against six Firefox releases in a controlled test, using security fixes visible in public code before those fixes reached users. The attacks could make a webpage read a local file when opened in the tested browser, according to the researchers. Mozilla released Firefox 159 on October 27, fixing a separate, previously unpublished vulnerability used in the successful tests; Epoch has not yet tested whether similar attacks work against that version.
The researchers tested Firefox releases 156.0 through 158.0.1, released between September 17 and October 26. Epoch said GLM 5.3 succeeded against all six versions, with each attempt allowed up to 48 hours; the fastest took 12 hours. The model received the relevant browser version and basic tools, but had no internet access and could not target a real website or user.
Epoch described the method as exploiting the patch gap: the period after a security fix becomes visible in public code but before users have installed the updated release. The model identified fixes that were not yet in the stable version and used them to help find weaknesses. In each successful attack on recent releases, it also used a separate flaw that had not been publicly disclosed, according to the report.
Epoch said it reported that additional vulnerability to Mozilla, which fixed it in Firefox 159.0. The researchers estimated API fees of about $1,000 per tested version once their setup was ready. Building and testing that setup cost Epoch more than $100,000, according to its account. These are research costs, not estimates of the expense or effort required in other settings.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Patch Gaps Change Security Risk
The findings matter because software fixes can reveal where a weakness was, even when the update itself has not yet been installed by everyone. If AI systems can help turn those public clues into working exploits quickly, the period between a fix being disclosed and users applying it may carry added risk. Epoch’s test suggests that this work may be within reach of an open-weight model available for download, rather than limited to specialist teams or restricted systems.
The report does not show that GLM 5.3 attacked Firefox users, nor does it establish how often such attacks would happen outside a lab. But it gives browser makers, security teams and organizations another reason to shorten the time between a security release and installation. For individual users, the direct practical step is to update Firefox to version 159 or later and restart it, as the source report advises.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
HP 4×6 Direct Thermal Shipping Label Printer, 203 DPI
As an affiliate, we earn on qualifying purchases.
From Public Fixes to Test Attacks
Firefox is an open-source browser, so changes to its code can be publicly visible. Security fixes may appear in development or public code before the corresponding stable release is installed by users. That creates a period in which the weakness addressed by a fix may be easier to identify for someone examining the change. Epoch calls this interval the patch gap; it is not a new feature of AI or a new type of software risk.
Epoch said its experiment was designed to test whether a model could act on that public information with limited human guidance. Researchers gave GLM 5.3 a target—make a webpage read a local file in a specified Firefox version—and let it run without further input beyond a basic instruction to examine relevant fixes. The test environment used Ubuntu 26.04, default settings and official Firefox releases. Epoch also said the same setup failed against Chrome after about $100,000 in attempts, underscoring that its result was specific to the tested browser and method.
The tested file-reading capability could expose sensitive material, such as browser-stored credentials or private documents, if used against a real target. Epoch’s environment did not permit that: there was no internet access and the work was confined to lab systems. The report therefore describes a demonstrated capability under test conditions, not a confirmed incident affecting Firefox users.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What the Firefox Test Cannot Establish
The results come from one controlled research setup, not reports of attacks against real Firefox users. Epoch has not yet tested whether the same approach succeeds against Firefox 159, so the effect of Mozilla’s fix on this particular attack chain remains unverified. The report says the fix is expected to make similar attacks at least substantially more difficult, not that it proves every related route is closed.
The source account also says earlier Firefox versions were likely vulnerable but were not systematically tested. It does not establish how broadly the method generalizes to other software, models or attackers. Epoch’s failed Chrome attempts are a result for that setup, not proof that Chrome or other browsers cannot be targeted. The report says no provider safeguards or refusals interrupted the work, including those of GLM 5.3’s maker, Z.ai; the test was framed as security research, and that observation does not determine how safeguards would respond to other prompts or settings.
Firefox Updates and Follow-Up Testing
Firefox users should install version 159 or later and restart the browser, according to the source report. Mozilla’s Firefox 159 security advisory, identified there as MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low. The report cautions that the count is affected by a change in Mozilla’s counting method, so the total should not be read as a direct measure of a sudden increase in risk.
Epoch’s next relevant step would be testing whether the reported attack method works against Firefox 159 after Mozilla’s patch. The account does not give a timetable for that testing. Security teams will also need to judge how quickly they can deploy browser updates and monitor the time between public fixes and installation. For now, the confirmed result is limited to the six tested releases and the lab conditions described by Epoch.
Key Questions
What did Epoch AI report?
Epoch said the open-weight model GLM 5.3 built working attacks against six Firefox releases, using public information about security fixes before those fixes reached stable versions.
Were Firefox users attacked in the experiment?
No. Epoch described a controlled lab test with no internet access. The report does not describe attacks against real users or websites.
Does Firefox 159 fix the vulnerabilities?
Mozilla released Firefox 159 on October 27 and fixed the separate, previously unpublished vulnerability that Epoch said the successful tests used. Epoch had not yet tested the method against Firefox 159, so the report does not establish whether all similar attacks are blocked.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, following the recommendation in the source report.
Does this show AI can exploit any browser?
No. The result concerns the tested GLM 5.3 setup and six Firefox releases. Epoch said its setup failed against Chrome after about $100,000 in attempts, but that does not prove other browsers cannot be targeted.
Source: ThorstenMeyerAI.com
