TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Epoch AI researchers say open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases in an offline lab test, using security fixes that were public before users received the updates. Mozilla patched a separate, unpublished flaw used in the attacks in Firefox 159, released October 27; the test did not target real users.
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases in an offline lab test, using security fixes that had become public before the corresponding updates reached users. The attacks could read a local file when a test browser visited a webpage, and Mozilla says the separate, unpublished flaw needed for the tested attack was fixed in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers said they tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave the model up to 48 hours per attempt. The fastest successful run took 12 hours; after researchers built the testing setup, they estimated API costs at about $1,000 per version. Epoch said development and testing of that setup cost more than $100,000.
The model received a Firefox version and basic tools, but had no internet access. Researchers instructed it to examine public fixes not yet included in the stable version. Epoch says GLM 5.3 identified relevant changes and built a multi-stage attack without further human input. Each successful attack relied both on information from an upcoming fix and on a second, unpublished flaw that allowed it to get past Firefox’s sandbox. Epoch reported that flaw to Mozilla, which patched it in Firefox 159.0.
The result was a file read in a controlled environment, not a demonstrated takeover of a computer or an attack on people using Firefox. Epoch says the lab machine ran Ubuntu 26.04 with default settings and an official Firefox release. The researchers also reported that the same setup failed against Chrome after about $100,000 in attempts. That result describes this test, rather than establishing that Chrome is immune to similar methods.
AI Security Briefing · October 2026
What Does The Epoch AI Research Mean For Firefox Security?
Epoch AI says open-weight model GLM 5.3 built file-reading attacks against six Firefox releases in an offline lab. Mozilla fixed a separate flaw used in the tests in Firefox 159. The experiment did not target real users.
01 / At a glance
What happened in the lab
Researchers gave GLM 5.3 a browser release and basic tools, then asked it to study public security fixes that had not yet reached that stable version.
Open-weight GLM 5.3
Epoch reported that the model identified relevant code changes and built a multi-stage attack without further human input.
A controlled local file read
When a test browser visited a webpage, the attack could read a local file by combining patch clues with a separate flaw.
No real users targeted
This was an offline lab test. It did not demonstrate a computer takeover or establish real-world exploitation.
02 / The patch gap
How public fixes expose clues
The interval between a visible fix and broad installation of the update is often called the patch gap. The risk predates AI; automation may change how quickly some work can be done.
A fix becomes public
Code changes or release notes reveal what was altered.
Users await updates
Some devices still run the earlier stable release.
Model studies the change
GLM 5.3 looked for clues in upcoming fixes.
Attack tested in the lab
A second, unpublished flaw helped bypass the sandbox.
03 / Evidence and limits
What the report establishes
Epoch’s findings describe one model, one test setup, and six Firefox releases. They do not measure the scale of any exposure outside the lab.
- Tested Firefox versions 156.0 through 158.0.1, released September 17 to October 26, 2026.
- Researchers allowed up to 48 hours per attempt; the fastest successful run took 12 hours.
- Epoch reported setup development and testing costs above $100,000.
- Mozilla patched the separate unpublished flaw in Firefox 159.0, released October 27.
04 / Time and effort
A costly test with a fast best run
Epoch’s reported figures show substantial setup effort alongside a successful attempt completed in half a day.
05 / Practical response
What users and teams can do
The source’s immediate advice is straightforward: apply the browser update and make sure it takes effect.
Update to version 159 or later
Restart Firefox after updating so the patched version is running.
Check update coverage
Review whether managed devices receive browser updates promptly, especially when security changes become public early.
Seek broader replication
Tests across other versions and software could clarify how general the method is and whether independent teams can reproduce it.
06 / Key questions
What to take away
A concise guide to the reported test, the patch, and what remains unknown.
Which releases were tested?
156.0, 156.0.1, 157.0, 157.0.1, 158.0, and 158.0.1, released from September 17 to October 26, 2026.
Has Mozilla fixed the reported flaw?
Epoch says Mozilla patched the unpublished flaw in Firefox 159.0, released October 27. Update to 159 or later and restart.
Were Firefox users attacked?
The report describes a controlled lab test and does not report attacks against real users. Use outside the test is not established.
Does the Chrome result prove it is safe?
No. Epoch reported that its setup failed against Chrome within its attempt and budget; that does not prove immunity.
The Risk Before Updates Arrive
The report draws attention to the patch gap: the period after a security fix becomes visible but before users install the update. In open-source projects, code changes can be public ahead of a stable release. A fix can therefore provide clues about the weakness it addresses. Epoch’s experiment suggests that an AI model may be able to use those clues to build an attack quickly, reducing the time and expertise needed for some forms of vulnerability research.
For users, the practical response is to update Firefox to version 159 or later and restart it, as the source advises. For organizations, the episode highlights the value of distributing browser updates promptly. The report does not show that ordinary users were targeted or that the tested attack was used outside the lab, so it does not establish the scale of any real-world exposure.
Products Worth Considering
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
DJI Mini 4K Fly More Combo
As an affiliate, we earn on qualifying purchases.
How Public Fixes Expose Clues
Software vendors regularly disclose security fixes through release notes and code changes. When a fix is public before all users have installed the patched version, researchers and attackers can compare versions to infer what changed. This interval is often called the patch gap. It predates AI; the new question raised by Epoch is whether widely available models can automate more of the work involved in exploiting it.
Epoch describes GLM 5.3 as an open-weight model, meaning its model weights are available for download. The group’s broader claim is that such models can now perform much of this work autonomously. That is the researchers’ interpretation of their experiment; one model, one browser test setup and six releases cannot establish how often comparable attacks will succeed across other software or environments.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What the Lab Test Cannot Show
The test does not show whether anyone used the technique against Firefox users, how many users could have been exposed before version 159, or whether the relevant attack details are practical outside Epoch’s setup. The source says the researchers did not systematically test Firefox releases earlier than 156.0, describing them only as likely also vulnerable.
The reported Chrome result is limited to Epoch’s attempt and budget. It does not establish that other browsers or Firefox versions are safe from AI-assisted vulnerability research. The source also does not provide independent replication of the results or a detailed account of how Mozilla assessed the reported flaw.
Updates and Further Testing
Firefox users should install version 159 or later and restart the browser to apply the fix described in the report. Organizations can review whether browser updates are reaching managed devices promptly, particularly when security changes are publicly visible before stable releases are widely installed.
Further reporting or research could clarify whether the method works against other browser versions and software, and whether similar tests can be reproduced independently. Epoch’s report establishes what happened in its lab; evidence of real-world exploitation or broader impact has not been provided in the source material.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model built webpages that could read a local file when opened in each of six tested Firefox releases. The work took place in an offline lab, not against real users.
Which Firefox versions were tested?
The report covers versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, released from September 17 to October 26, 2026.
Has Mozilla fixed the flaw described in the report?
Epoch says it reported the unpublished flaw used in the attacks and that Mozilla patched it in Firefox 159.0, released October 27. The source advises users to update to version 159 or later and restart the browser.
Does the report show that Firefox users were attacked?
No. It describes a controlled lab test and does not report attacks against real users. Whether the technique was used outside the test is not established by the source material.
Source: Thorsten Meyer AI
