🔍 Read the full analysis: Why AI-Driven Firefox Attack Research Calls For A Response on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers say the open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases by examining security fixes that were public before users received the updates. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether similar attacks still work against that version.
Epoch AI researchers say an open-weight model, GLM 5.3, built working attacks against six Firefox releases by using publicly visible security fixes to identify weaknesses before those fixes reached stable-version users. Mozilla released Firefox 159 on October 27, patching a separate, previously unpublished flaw that the attacks also used; the researchers have not yet tested whether similar attacks work against that version.
In a report published October 29, six Epoch AI researchers described tests against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. The model was asked to create a webpage that could read a local file when opened in a specified Firefox version. Epoch says the fastest successful run took 12 hours; researchers allowed up to 48 hours for each attempt. Once the test setup had been built, the reported API cost was about $1,000 per version. The setup itself cost Epoch more than $100,000 to build and test.
The researchers say GLM 5.3 identified fixes in public Firefox code that had not yet reached the stable release and used them to locate bugs. Epoch describes this period between a fix becoming visible and users receiving it as the patch gap. In successful tests against recent releases, the model also rediscovered an unpublished vulnerability that helped the attack get beyond Firefox’s sandbox. Epoch disclosed that flaw to Mozilla, which patched it in Firefox 159. The reported attack read files; it did not take control of the computer.
Epoch says the tests ran in a lab on Ubuntu 26.04, using official Firefox releases and publicly available information. The model had no internet access, and researchers did not target real people or websites. The report says the model received basic tools and an instruction to examine fixes not yet included in the stable release, then worked without further researcher input. Epoch reported no safety refusals or safeguards from the providers it tried, including GLM 5.3’s maker, Z.ai. That is the researchers’ account of their test, not evidence that the model has been used against Firefox users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Patch Visibility Changes Risk
The findings matter because security fixes can disclose clues about the bugs they repair before every user has installed the update. That timing gap is a longstanding software-security problem; Epoch’s report argues that capable, widely available models may make it easier to turn those clues into working attacks. The model did not need access to secret information about the published fixes, according to the researchers. It also found a separate unpublished flaw during the exercise, which Epoch reported to Mozilla.
The practical concern is not that the study proves an attack is underway. It is that defenders may have less time between a fix becoming public and attackers identifying how to exploit the underlying weakness. A file-reading vulnerability could expose sensitive information such as browser-stored credentials, login cookies or documents, though Epoch’s test demonstrated file access rather than confirming that any real user’s data was taken. Updating promptly remains the direct user response: the source advises Firefox users to install version 159 or later and restart the browser.
For software teams, the report puts attention on how releases, public code changes and security updates interact. Faster updates can shorten users’ exposure, while public disclosure of fixes can help both defenders and potential attackers understand what changed. Epoch’s experiment supports concern about that trade-off, but it does not establish how often such attacks will occur or how widely the technique can be applied.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Public Fixes to Firefox Tests
Firefox is an open-source browser, so code changes can be publicly visible. The report describes how a fix may be available in project code, or in a test build, before the corresponding stable release reaches users. During that interval, users on an older version may remain exposed. The patch gap predates this study; the reported development is that an AI model was able to use public fix information as part of an automated attack-development process.
Epoch tested six consecutive Firefox releases from September 17 to October 26, covering versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. The researchers say every successful attempt against those versions also involved the unpublished flaw later patched by Mozilla. They did not systematically test earlier releases, which Epoch says may also have been vulnerable.
The report’s results were not universal across browsers. Epoch says the same setup failed against Chrome after about $100,000 in attempts. That result is limited to the researchers’ particular setup and effort; it does not establish that Chrome is immune to AI-assisted vulnerability research or that the Firefox result generalizes to other software.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers, as quoted in the report
What Firefox 159 Tests Have Not Shown
Epoch has not tested Firefox 159 to determine whether similar attack chains still work after Mozilla’s patch. The researchers expect the fix to make them substantially more difficult, but that is an expectation rather than a demonstrated result. The report also does not show that any real users were attacked or that the model’s method has been used outside the controlled exercise.
The findings have limits beyond the untested version. The researchers tested six releases and said earlier ones were likely vulnerable, but did not systematically assess them. The study does not establish whether other models can reproduce the results, how frequently attackers might attempt this approach, or whether comparable methods work against other browsers. Epoch’s failed Chrome attempts describe its own test setup, not a general security verdict on Chrome.
The report says Mozilla’s Firefox 159 advisory, MFSA 2026-118, lists 167 security fixes: 108 rated high, 52 moderate and seven low. It cautions that part of the total reflects a change in Mozilla’s counting method; the source excerpt does not provide the full explanation of that change. The advisory’s overall count should not be read as a measure of how many flaws were involved in Epoch’s experiment.
Updates and Independent Follow-Up
Firefox users should install version 159 or later and restart the browser, according to the source report. Users can check their browser’s version through its update controls. The study does not establish that updating alone addresses every risk, but Firefox 159 includes Mozilla’s fix for the unpublished flaw disclosed by Epoch.
The next important technical check is whether the attack chain still works against Firefox 159 or later. Epoch had not completed that test when the report was published. Further assessment could clarify the effect of Mozilla’s patch, the role of the public fixes, and whether the method can be reproduced on other browser versions or systems.
For Mozilla and other software developers, the report adds evidence to a continuing question: how quickly can fixes reach users when code changes are public and tools for analyzing them are increasingly capable? The study does not prescribe a single release or disclosure policy. Its immediate, confirmed outcome is narrower: Epoch reported the additional flaw, Mozilla patched it in Firefox 159, and the researchers’ post-patch testing remains outstanding.
Key Questions
What did GLM 5.3 do in the Firefox study?
Epoch AI says GLM 5.3 built webpages that could read a local file when opened in six tested Firefox releases. The model used public information about security fixes, alongside a separate unpublished flaw it rediscovered during the tests.
Were Firefox users attacked in this experiment?
No real users or websites were targeted in the reported work. Epoch says the exercise took place in a lab, with no internet access for the model. The report does not establish that anyone used the technique against users outside the test.
Has Mozilla fixed the flaw used in the tests?
Mozilla patched the unpublished flaw Epoch reported in Firefox 159, released October 27, 2026. Epoch had not tested whether similar attacks still work against version 159 when it published its report.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, as the source report advises. The study does not provide evidence about the status of any individual user’s device.
Does the study show that AI can attack every browser?
No. Epoch reports that its setup failed against Chrome after about $100,000 in attempts, but that result applies to this experiment. It does not prove that Chrome or other browsers are immune to AI-assisted vulnerability research.
Source: ThorstenMeyerAI.com
