🔍 Read the full analysis: What To Do When AI Can Turn Firefox Fixes Into Working Attacks on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that the open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, using publicly visible security fixes and a previously unpublished flaw. Mozilla patched that flaw in Firefox 159, released October 27; the researchers have not yet tested whether their attack works against that version.
Epoch AI researchers say the open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, turning publicly visible security fixes into a route for a webpage to read a local file. The fastest attempt took 12 hours; Mozilla says it fixed a separate, previously unpublished flaw used in the attacks in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers described testing Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave the model a specific goal: create a webpage that could read a file from a computer running a targeted Firefox release. According to Epoch, GLM 5.3 succeeded against all six versions using information that was public when each version appeared.
The researchers say the model identified fixes visible in Firefox’s public code before those fixes reached stable-release users. Such a delay is commonly called the patch gap. Epoch allowed up to 48 hours for each attempt; the quickest took 12 hours. After researchers built the testing setup, the API fees for each version were about $1,000, while creating and testing that setup cost more than $100,000, according to the report.
Epoch says each successful attack against recent versions also depended on a flaw that had not been publicly disclosed. The researchers reported that flaw to Mozilla, which patched it in Firefox 159. The test ran in a lab without internet access, so it did not target actual users. The demonstrated capability was file reading, not control of a victim’s computer. Epoch also says its setup failed against Chrome after about $100,000 in attempts.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Why Patch Timing Now Matters
The findings point to a security risk between a fix becoming visible and users installing the update. A public code change can reveal information about the problem it addresses, giving attackers clues while some users remain on older software. Epoch’s experiment suggests that an AI model may be able to analyze those clues and assemble an exploit with limited human direction.
That does not show that real-world attackers have used GLM 5.3 this way, or that the tested method works against current Firefox. It does show why prompt software updates matter: users and organizations that delay installing security releases may remain exposed after information about a fix becomes public. The study also raises practical questions for software makers about how quickly fixes, updates and user adoption move in relation to one another.
Epoch says it encountered no refusals or safeguards from the model providers during the experiment. The researchers characterized the model’s actions as “indistinguishable from those of a real attacker.” That is their assessment of the test, not evidence that the model attacked users outside the lab.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How the Firefox Test Worked
Epoch’s test machine used Ubuntu 26.04, default settings and an official Firefox release. Researchers gave the model the target version, basic tools and public information, but no internet access. Apart from directing it to examine fixes not yet included in the stable release, they let it work without further input, according to the report.
The goal was to make a webpage read a local file. The researchers said that kind of access could expose sensitive material such as browser cookies, saved passwords or private documents, but the experiment did not establish that each of those items was accessed. Epoch says the model selected potential bugs, developed an attack chain and adjusted its approach after crashes.
The report’s results cover six releases, not every Firefox version. Epoch said older releases were likely vulnerable too, but it did not systematically test them. The study also found a different result with Chrome: the same setup did not produce a successful attack after roughly $100,000 in attempts. That comparison is limited to the researchers’ test and does not establish that Chrome is immune to AI-assisted exploitation.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What Firefox 159 Changes
Epoch had not tested whether the attack chain still worked against Firefox 159 when its report was published. The researchers expected Mozilla’s fix to make similar attacks substantially more difficult, but that remains an expectation rather than a reported test result.
The study also does not show whether the same model, or another one, has been used to exploit real Firefox users. Its lab environment had no internet access, and the experiment’s file-reading result should not be described as a full computer takeover. The report does not establish how often attackers can exploit patch gaps in practice, or whether results would carry over to other operating systems, configurations or browsers.
Epoch reported no safeguards or refusals during its attempts, but the available account does not establish how model providers may change their systems in response. The researchers’ reported cost figures cover their particular setup and API use; they are not a universal estimate for future attempts.
Update Firefox and Track Testing
Firefox users should install version 159 or later and restart the browser, according to the source report. Organizations should check that security updates have reached managed devices rather than relying only on the release of a patch.
The next technical question is whether Epoch or other researchers can reproduce the attack against Firefox 159 and later releases. Mozilla’s patch addresses the previously undisclosed flaw described in the report; further testing would clarify whether the specific attack chain has been blocked and how much protection the fix provides against related methods.
Key Questions
What did GLM 5.3 do in the test?
Epoch AI says it built a webpage that could read a local file on each of six tested Firefox releases, using public security-fix information and a previously undisclosed flaw. The test took place in a lab, not against real users.
How long did the attacks take?
Epoch allowed up to 48 hours for each attempt. The fastest successful run took 12 hours. The researchers said later attempts cost about $1,000 per Firefox version in API fees after the testing setup had been built.
Has Mozilla fixed the flaw?
Epoch says it reported the previously unpublished flaw to Mozilla, which patched it in Firefox 159, released October 27, 2026. Epoch had not yet tested whether its attack still worked against that release.
Should Firefox users update?
Yes. The source report advises users to install Firefox 159 or later and restart the browser. The experiment does not show that users were attacked, but running an updated browser reduces exposure to known security issues.
Does the study prove AI can take over a computer?
No. The reported demonstration read a local file; it did not take over the computer. It was a controlled lab test, and the researchers did not test the attack against real users or establish that it worked against Firefox 159.
Source: ThorstenMeyerAI.com
