🔍 Read the full analysis: Firefox Security Fixes Under The AI Lens: Epoch AI’s Findings on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing public security fixes before users had installed updates. Mozilla patched a separate, previously unpublished flaw used in the attacks in Firefox 159; Epoch has not yet tested whether the attacks still work on that version.
Epoch AI reported that open-weight model GLM 5.3 built working attacks against six Firefox releases by studying security fixes visible in public code before those fixes reached stable-browser users. Mozilla released Firefox 159 on October 27 with a patch for a separate, previously unpublished flaw the attacks also used; Epoch says it has not yet tested the attacks against that release.
In the lab test, researchers asked GLM 5.3 to build a webpage that could read a local file when opened in a specified Firefox version. The model succeeded against versions 156.0 through 158.0.1, released from September 17 to October 26, according to Epoch’s October 29 report. The researchers allowed up to 48 hours for each attempt; the fastest successful run took 12 hours.
Epoch says the model examined security fixes that were public when each browser version came out, identified bugs that had not yet been fixed in the stable version, and developed an attack chain without further input. The researchers estimated API charges of about $1,000 per version once their testing setup was built. They said creating and testing that setup cost more than $100,000, so the per-version figure does not represent the total cost of the research.
The attack also depended on a separate flaw that Epoch says had not been publicly disclosed. Researchers reported it to Mozilla, which patched it in Firefox 159.0, released October 27. Epoch says the tested attacks involved reading files, not taking over a computer. It also said the work took place in a controlled lab environment with no internet access, rather than against real users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Attacks
The report points to a practical risk in the time between a security fix becoming visible and users installing the update. In open-source projects such as Firefox, code changes can reveal where a vulnerability was found. An attacker who studies that change may be able to work out how to exploit the weakness on systems that have not yet received the patch. Security researchers call this interval the patch gap.
Epoch’s result suggests that an AI model can help automate parts of that analysis and attack development. The report does not establish that GLM 5.3 or another model has been used this way against real Firefox users. But if the lab result generalizes, the time and expertise needed to turn a public fix into an attempted exploit could be lower. That makes timely browser updates more consequential for both individuals and organizations.
Readers should distinguish the report’s demonstrated capability from an observed incident: Epoch describes controlled testing, not a breach, and says it prevented the model from reaching real websites or people. The findings are about what the model could do under the researchers’ conditions, not evidence that users were targeted.
Popular right now
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
De'Longhi Magnifica Evo Fully Automatic Espresso Machine with Manual Milk Frother, Silver
Ninja Hot & Iced XL Coffee Maker with Rapid Cold Brew, Black, CM371
As an affiliate, we earn on qualifying purchases.
How the Patch Gap Appeared
A software fix can become visible before every user has installed it. In Firefox, security-related changes may appear in public code or earlier development versions. That can give defenders information to repair systems, but it can also tell a technically capable observer where a weakness existed. Until an update is installed and the browser restarted, a user may still be running the affected version.
Epoch’s researchers focused on that exposure window. They gave GLM 5.3 the target browser version, basic tools and information available publicly at the time, then allowed it to work without ongoing researcher input. Epoch says the model selected fixes, tested approaches, diagnosed crashes and built a multi-stage chain. The researchers reported that the same setup failed against Chrome after about $100,000 in attempts; that is a result from their test, not proof that Chrome is immune to similar methods.
The report says each successful attack against recent Firefox releases combined a weakness indicated by an upcoming fix with the unpublished flaw later reported to Mozilla. Firefox 159’s advisory, identified as MFSA 2026-118, lists 167 security fixes, according to the source material. That count includes 108 rated high, 52 moderate and seven low; the report cautions that Mozilla’s counting practices changed, limiting comparisons with earlier advisories.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI
Firefox 159 Still Needs Testing
Epoch has not reported whether the attack chain still works against Firefox 159, or whether other methods could exploit the same general patch-gap information. Its expectation that the update makes the tested approach substantially more difficult is not a confirmation that all related risks are gone.
The study also does not show that real users were attacked, how often models could reproduce the results outside this setup, or whether other AI systems would perform similarly. Epoch says earlier Firefox versions were likely vulnerable but were not systematically tested. Its Chrome attempts failed under the reported conditions, but the source does not establish a broader comparison between browser security or AI performance.
Install the Patched Firefox Release
Firefox users should update to version 159 or later and restart the browser, according to the source report. Organizations should check that managed devices have received the update, while recognizing that the study does not document an active attack campaign.
The next key evidence will be whether Epoch or other researchers test the reported method against Firefox 159 and publish results, and whether Mozilla issues further guidance. Epoch’s report describes disclosure of the additional flaw and Mozilla’s patch, but the source material does not identify a date for further testing or a follow-up advisory.
Key Questions
What did Epoch AI find?
Epoch says GLM 5.3 built working file-reading attacks in a lab against six Firefox releases, from 156.0 through 158.0.1, using security fixes that were publicly visible before users had installed them.
Were Firefox users attacked?
The report describes a controlled lab test, not attacks against real users. Epoch says the setup had no internet access and could not reach real websites or people.
Did Mozilla fix the flaw used in the tests?
According to Epoch, it reported a previously unpublished flaw to Mozilla, which patched it in Firefox 159.0, released October 27. Epoch has not confirmed whether the full attack still works on that version.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. The source report does not provide evidence of an active campaign targeting users.
Does the study show AI can attack any browser?
No. Epoch reports that its setup failed against Chrome after about $100,000 of attempts. That result applies to the researchers’ test and does not establish that other browsers are immune or that other AI systems would behave the same way.
Source: ThorstenMeyerAI.com
