🔍 Read the full analysis: 5 Takeaways From Epoch AI’s Firefox Attack Demonstration on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reported that GLM 5.3, an open-weight AI model, produced working attacks against six Firefox releases in a controlled test by analyzing publicly visible security fixes. Mozilla patched an additional, previously unpublished vulnerability used in the demonstrations in Firefox 159; the researchers have not yet tested whether their attack works against that release.
Epoch AI reported on October 29 that the open-weight model GLM 5.3 built working attacks against six Firefox releases in a controlled test, using security-fix information that was publicly available before the updates reached users. The demonstration matters because it suggests an AI model could help exploit the period between a security fix becoming visible and users installing it; Mozilla says the separate, previously unpublished flaw used in the attacks was fixed in Firefox 159, released October 27.
Epoch’s researchers tested releases 156.0 through 158.0.1, published between September 17 and October 26. Their task was to create a webpage that could read a local file when opened in a specified Firefox version. According to the report, the fastest successful run took 12 hours; Epoch allowed up to 48 hours per attempt. The researchers estimated about $1,000 in API fees for each version after the testing setup had been built, while developing and testing that setup cost Epoch more than $100,000.
The researchers say GLM 5.3 examined fixes visible in Firefox’s public code, identified bugs that had not yet been fixed in the stable release, and built an attack chain without further input from them. The test machine ran Ubuntu 26.04 with default settings and an official Firefox release. Epoch said it withheld internet access, so the model could not target a real website or user. The demonstrated attack read a file; the source material does not describe it as taking control of the computer.
Epoch also reported that each successful attack against recent versions depended on a second, unpublished vulnerability, which the model rediscovered during its attempts. The researchers disclosed that flaw to Mozilla. Mozilla patched it in Firefox 159. Epoch has not tested whether its attack works against that release, and the report says the researchers expect the fix to make similar attacks at least substantially more difficult.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Patch Gaps Change Browser Risk
The findings point to a risk in the timing of software updates. A security fix can reveal clues about the weakness it addresses before all users have installed it. Security researchers call the interval between that disclosure and broad deployment the patch gap. Epoch’s test suggests an AI model may be able to analyze those clues and help turn them into an exploit within hours, rather than requiring a human researcher to do all the work.
That does not show that ordinary users were attacked, or that the model can automatically compromise every browser. It does raise the stakes for prompt updates: once a fix is available, delaying installation may leave a system exposed to attacks based on information already in public code. Epoch’s result also concerns one model, one operating-system setup and one specific task, so it should not be treated as a measure of the capabilities of all AI systems.
For organizations, the report highlights the operational challenge of distributing security updates quickly across managed devices. A patch may be available while some systems remain unprotected. The demonstration does not establish a new timeline for real-world attacks, but it offers a concrete example of how automation could shorten the time needed to study a disclosed fix.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
What Epoch Tested in Firefox
Firefox is an open-source browser, and its publicly visible development history can include security-related changes before those changes reach the stable release installed by many users. Epoch focused on that interval, giving the model the relevant browser version and basic tools but not internet access. The researchers instructed it to examine bug fixes that had not yet appeared in the stable version, then let it work without additional guidance.
Epoch reported success against six consecutive releases: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. The researchers said each success involved a vulnerability indicated by an upcoming fix and the additional unpublished flaw that allowed the attack to bypass Firefox’s sandbox. The report says the model’s task was to read a local file, not to take over the machine.
The study also tested the same setup against Chrome, where it failed after about $100,000 in attempts, according to Epoch. That result is limited to the particular approach, resources and testing conditions used; it does not establish that Chrome is generally immune to AI-assisted attacks.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Testing Can Show
Epoch has not reported whether the demonstrated attack succeeds against Firefox 159, so the effect of Mozilla’s patch has not been confirmed by a post-fix test from the researchers. The source material says the researchers expect the fix to make similar attacks harder, but that remains an expectation rather than a published test result.
The report describes a controlled lab setup, not attacks against actual Firefox users. It does not establish whether anyone else used the same weaknesses, whether the model’s techniques would work under different operating systems or configurations, or how often comparable attacks could be built outside Epoch’s test. Epoch said earlier Firefox versions were likely vulnerable but had not systematically tested them.
The source material also notes that Mozilla’s Firefox 159 advisory listed 167 security fixes, while cautioning that a change in Mozilla’s counting method partly affects that total. That figure should not be read as a direct measure of the number of newly discovered, independently exploitable vulnerabilities.
Updates and Follow-Up Testing
Firefox users should install version 159 or later and restart the browser, according to the source material. Restarting matters because an update may not be fully applied until the browser has relaunched. Organizations that manage browsers across many devices will need to check that updates have reached their systems, rather than relying only on an update being available.
The next technical milestone is whether Epoch tests its attack setup against Firefox 159 and publishes the result. That would help establish whether the disclosed flaw’s repair blocks the demonstrated chain or leaves other routes to the same file-reading goal. The report does not give a date for such testing, and no outcome should be assumed before it is published.
Mozilla’s release advisory and any later Epoch findings may add detail about the patch and the test’s limits. Until then, the confirmed points are that Epoch demonstrated attacks in a lab against six earlier releases, disclosed an additional flaw to Mozilla, and Mozilla issued Firefox 159 with a fix.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch said the model built a webpage that could read a local file when opened in one of six tested Firefox releases. The test was conducted in a lab, without internet access to target real users.
Which Firefox versions did the demonstration affect?
Epoch reported successful attacks against versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. It said earlier releases were likely vulnerable but had not systematically tested them.
Did Mozilla fix the vulnerability?
Epoch said it reported an unpublished flaw used in the attacks to Mozilla, which patched it in Firefox 159, released October 27, 2026. Epoch had not yet tested the attack against that version.
Were real Firefox users attacked?
The source material describes a controlled research test, not an attack on real users. Epoch’s test machine had no internet access, and the report does not establish that anyone used the demonstrated attacks outside the lab.
What should Firefox users do?
Install Firefox 159 or later and restart the browser. As with other software vulnerabilities, updates reduce exposure, but no software update removes every possible security risk.
Source: ThorstenMeyerAI.com
