🔍 Read the full analysis: How To Think About AI Risks After Epoch AI’s Firefox Demonstration on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Epoch AI reports that GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing security fixes visible in public code before users received updates. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether similar attacks work against that release.
Epoch AI researchers report that the open-weight model GLM 5.3 developed working attacks against six Firefox releases by analyzing security fixes visible in public code before those fixes reached users. The lab test demonstrated how attackers could use that interval, known as the patch gap, to create a webpage that reads a local file when opened; Mozilla has since patched an additional vulnerability used in the tests in Firefox 159.
In its report published October 29, Epoch said it tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. The model was given up to 48 hours per attempt; the fastest successful run took 12 hours. Epoch estimated that testing each new version cost about $1,000 in API fees after researchers had built the setup. Building and testing that setup cost Epoch more than $100,000, according to the report.
The researchers asked the model to create a webpage that could read a file from a computer running a specified Firefox version. They say GLM 5.3 selected relevant fixes from public information, developed an attack chain, and adjusted its work after failed attempts. The test machine used Ubuntu 26.04 and a default Firefox installation. It had no internet access, and Epoch says the experiment did not target real users.
Epoch reports that the successful attacks combined information about bugs addressed by upcoming Firefox fixes with a second, previously unpublished vulnerability that helped bypass the browser’s sandbox. The researchers disclosed that flaw to Mozilla. Mozilla released Firefox 159.0 on October 27 with a fix, according to Epoch. The reported attack could read files; the source material does not say it took control of the computer.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
When Public Fixes Become Attack Clues
The study draws attention to a security problem that predates generative AI: fixes can become public before every user installs them. In open-source projects, changes in public code may reveal where a vulnerability was found. During the patch gap, a person who has not updated may remain exposed while that information is available to others.
Epoch’s finding is that an open-weight model was able to help turn those clues into a working attack in a controlled test, without researchers guiding each step. If similar capabilities are accessible beyond a lab, defenders may have less time between publishing a fix and facing attempts to exploit it. The report does not establish how often attackers are doing this in the wild, or whether this particular demonstration has been used against real people.
For users, the immediate practical step is to install Firefox 159 or later and restart the browser, following the source’s advice. For organizations, the report underscores the value of applying browser updates promptly and accounting for restart requirements. Those measures address the update window; they do not establish that every system or attack path is covered.
Popular right now
Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Almond Cream (KSM150PS)
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
The patch gap is the period after a security fix becomes visible but before a user installs the update that includes it. Firefox is open source, and code changes can provide clues about the problem being corrected. Epoch says the model was allowed to use public information available when each tested version was released, including fixes not yet included in the stable release.
The report describes a test of Firefox releases 156.0 to 158.0.1, not a broad assessment of all browsers or users. Epoch says the attacks also required a separate flaw that had not been published, which it reported to Mozilla. Its researchers did not test the same setup against Firefox 159. The source also says the setup failed against Chrome after roughly $100,000 in attempts; that result applies to this experiment and does not establish that Chrome is generally resistant to AI-assisted attacks.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What the Firefox Test Cannot Show
The reported results come from a controlled lab experiment, not evidence of attacks on Firefox users. Epoch says it tested six releases; it did not systematically test earlier versions. The source characterizes those earlier releases as likely vulnerable, but that remains an estimate rather than a reported test result.
Epoch had not tested whether its attack chain still worked against Firefox 159, so the effect of Mozilla’s patch on this specific method was not confirmed in the report. The source says Epoch expected the fix to make similar attacks substantially more difficult, but does not provide a post-patch result.
The report also does not establish how often models can reproduce the result across other software, operating systems, or configurations, or whether attackers have used comparable methods outside the lab. Epoch says it received no refusals or safeguards from the providers it tried, including GLM 5.3’s maker, Z.ai. That finding describes its test experience; it does not by itself show how every provider or model would respond to other requests.
Updates and Post-Patch Testing
Users should check that Firefox is version 159 or later and restart it after updating. Mozilla’s Firefox 159 advisory, identified in the source as MFSA 2026-118, lists 167 security fixes. The source notes that Mozilla changed its counting approach, so that total should not be read as a direct measure of how the release compares with earlier advisories.
A key next step is whether Epoch tests its setup against Firefox 159 and publishes the result. Further testing would help establish whether the disclosed fix blocks the demonstrated chain or changes its difficulty. The report also leaves open how consistently this approach works on other targets and what safeguards AI providers may add in response.
Key Questions
What did Epoch AI demonstrate?
Epoch reports that GLM 5.3 used publicly visible Firefox security fixes to develop working file-reading attacks against six browser releases in a lab. The test did not target real users.
What is the patch gap?
It is the period between a security fix becoming visible and users installing the update that contains it. Public code changes can sometimes give attackers clues about the weakness a fix addresses.
Did Mozilla fix the flaw used in the test?
Epoch says it reported a previously unpublished flaw to Mozilla, which patched it in Firefox 159.0, released October 27. Epoch had not yet tested whether similar attacks worked against that release.
Was this an attack on Firefox users?
No real users were targeted in Epoch’s described test. The setup had no internet access, and the reported result was a lab demonstration, not evidence that the method has been used in the wild.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, as advised in the source material. The report does not establish that updating addresses every possible security risk.
Source: ThorstenMeyerAI.com
