🔍 Read the full analysis: Firefox Fixes And Downloadable AI: Understanding Epoch AI’s Demo on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that the open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing security fixes visible before users received updates. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether similar attacks work against that release. The experiment was conducted in a lab, not against real users.
Epoch AI says an open-weight model, GLM 5.3, built working attacks against six Firefox releases in controlled tests by analyzing security fixes that were public before users received the updates. The attacks could read a local file when a test user opened a webpage; Mozilla has since patched an additional flaw used in the experiments in Firefox 159, but the researchers have not tested whether similar attacks still work against that version.
In its report published October 29, six Epoch AI researchers describe asking GLM 5.3 to make a webpage that could read a file on a computer running a specified Firefox release. The test covered versions 156.0 through 158.0.1, released from September 17 to October 26. Epoch says the model succeeded on all six, using information available publicly when each version appeared.
The researchers gave the model up to 48 hours per attempt; the fastest successful run took 12 hours. Epoch estimates the API fees for each additional release at about $1,000 once its test setup was built. It says creating and testing that setup cost more than $100,000. The researchers also report that they encountered no provider safeguards or refusals during the work, including from GLM 5.3’s maker, Z.ai.
Epoch says the model identified security fixes already visible in public Firefox code but not yet included in the stable version available to users. It also found a separate, then-unpublished flaw that helped the attack get beyond Firefox’s sandbox. Epoch reported that flaw to Mozilla, which fixed it in Firefox 159.0, released October 27. The demonstrated attack read files; the report does not say it took control of the test computer.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Why Public Fixes Can Become Attack Clues
The tests draw attention to the patch gap: the period after a vulnerability’s fix becomes visible but before users install an update. Public code changes help developers and users understand software updates, but they can also give attackers clues about what was vulnerable. Epoch’s result suggests that an open-weight model could help turn those clues into a working exploit faster than some organizations may expect.
That is a potential security concern, not evidence that Firefox users were attacked this way. The experiment ran in an isolated lab with no internet access, and Epoch describes a target built to read a local file rather than take over a computer. Still, a file-reading flaw could expose sensitive material on an affected machine, depending on what is stored there and how an attack is carried out.
For users, the immediate step is to update Firefox to version 159 or later and restart it. For software teams, the report raises a practical question: whether current processes for publishing and installing security updates leave enough time between a fix becoming visible and users receiving protection. The study does not establish how often such techniques are being used outside testing.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
DJI Mini 4K Fly More Combo
Bose QuietComfort Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
Firefox is an open-source browser, so changes to its code can be publicly inspected. According to Epoch, the model was given each Firefox version, basic tools and public information, but no internet access. Researchers instructed it to examine fixes that had not yet reached the stable release, then let it work without further input. The team says it selected the bugs and built the attack chain on its own, including diagnosing crashes and abandoning unsuccessful approaches.
The idea behind the test is not new: a security fix can reveal details about the weakness it addresses. Epoch’s report focuses on whether a broadly available model can automate enough of the work to make that information useful quickly. Researchers tested six releases and say earlier versions are likely vulnerable too, but they did not systematically test those versions.
The authors also tried the same setup against Chrome. According to Epoch, it failed after about $100,000 in attempts. That result applies to this setup and test; it does not show that Chrome cannot be attacked or that the same methods would fail in other conditions.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Tests Do Not Establish
Epoch says it has not tested Firefox 159 to determine whether attacks of this kind still work after Mozilla’s fix. The researchers expect the patch to make similar attacks “at least substantially more difficult,” but that is an expectation, not a reported test result. The study also does not establish whether the model’s approach has been used against real users, or how often comparable attacks occur outside a research setting.
The findings are limited to one model, one test environment and a particular file-reading target. Epoch says the setup failed against Chrome, but that outcome cannot settle the broader question of how other models or attack methods would perform. The report also does not quantify how many users may have run the tested Firefox versions while they were exposed to the relevant flaws.
Firefox Updates and Follow-up Testing
Firefox users should install version 159 or later and restart the browser, as the source report advises. Mozilla’s release of version 159 included the patch for the additional flaw disclosed by Epoch. The report does not provide a timetable for further testing of Firefox 159 or say whether Epoch plans to publish results from such tests.
The next points to watch are whether researchers test the patched release, whether Mozilla or other browser makers issue further information about the risks, and whether security teams adjust how they manage the time between publicly visible fixes and user updates. Until more evidence is available, the experiment is best understood as a controlled demonstration of a possible risk, not proof of attacks on Firefox users.
Key Questions
What did Epoch AI demonstrate?
Epoch AI reports that GLM 5.3 built file-reading attacks against six Firefox releases in a controlled lab test. The model used public information about security fixes and a separate flaw that was not publicly known at the time.
Were real Firefox users attacked?
The report describes a lab experiment, not attacks on real users. Epoch says the test machine had no internet access, and the source material does not establish that the method was used outside the experiment.
Has Mozilla fixed the flaw used in the tests?
Epoch says it disclosed the additional flaw to Mozilla, which patched it in Firefox 159.0, released October 27, 2026. Epoch had not tested whether similar attacks still work against version 159 when its report was published.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, following the advice in the source report. Keeping browser software updated helps users receive security fixes.
What does “patch gap” mean?
The patch gap is the time between a security fix becoming visible and users installing an update that contains it. Public fixes can reveal clues about the weakness they address, while unupdated systems may remain exposed.
Source: ThorstenMeyerAI.com
