TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Epoch AI reported that open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing publicly visible security fixes before users received the updates. The offline lab test took up to 48 hours per version; Mozilla patched a previously unpublished flaw used in the attacks in Firefox 159, released October 27.
Epoch AI reported on October 29 that open-weight model GLM 5.3 built a working file-reading attack against each of six Firefox releases in an offline lab test, using security-fix information that was public before the updates reached users. The test highlights how quickly attackers may be able to use public code changes to identify weaknesses; Mozilla says the key unpublished flaw involved was fixed in Firefox 159, released October 27.
Epoch’s researchers tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. For each attempt, the model was given a target version and public information available at that time, including changes that pointed to security issues fixed in upcoming releases. Epoch allowed up to 48 hours per attempt; its fastest successful run took 12 hours. The researchers said that after their test setup was built, API fees were about $1,000 for each version.
The task was to create a webpage that could read a local file when opened in the specified Firefox version. Epoch says the successful attempts combined a weakness indicated by an upcoming fix with a second, previously unpublished flaw that allowed the attack to get past Firefox’s sandbox. The researchers reported that flaw to Mozilla, which patched it in Firefox 159. The test demonstrated file access, according to the report; it did not take control of the computer.
The experiment ran on a lab machine using Ubuntu 26.04 and an official Firefox release, with no internet access. That kept the test from reaching real websites or users. Epoch said it saw no safety refusals from the providers it used, including Z.ai, the model’s maker. The group also reported that the same setup failed against Chrome after about $100,000 in attempts, a result limited to its tested approach.
SECURITY RESEARCH · EPOCH AI · OCTOBER 2026
How Epoch AI Tested an Accessible AI on Firefox Security Fixes
An offline lab study found that open-weight model GLM 5.3 could turn public clues in upcoming Firefox fixes into working file-reading attacks against six releases. Mozilla patched a second, previously unpublished flaw in Firefox 159.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
EPOCH AI RESEARCHERSto receive the reported patch.
AT A GLANCE
The patch gap became the test surface
Epoch AI reported on October 29 that GLM 5.3 built a webpage that could read a local file in each tested Firefox version. The model examined public security-fix information that appeared before users received the corresponding updates.
Public code changes
Upcoming fixes can reveal what changed and give researchers clues about the underlying weakness.
Model-assisted research
Given a target version, GLM 5.3 selected fixes, tried approaches, and adjusted after crashes.
File access in a lab
Successful attempts combined clues from an upcoming fix with a second flaw that bypassed Firefox’s sandbox.
HOW THE EXPERIMENT WORKED
From visible fix to demonstrated access
The researchers tested Firefox 156.0 through 158.0.1, releases dated September 17 to October 26, in an isolated Ubuntu 26.04 lab with no internet access.
Provide a target
Specify a Firefox version and the information public at that point.
Inspect fix clues
Analyze changes addressing security issues in upcoming releases.
Build and adapt
Try approaches for a webpage that could read a local file.
Report the flaw
Share the unpublished sandbox bypass with Mozilla for a patch.
WHAT THE FINDING MEANS
Speed matters between disclosure and update
The patch gap is the time between a fix becoming visible and users installing the version that contains it. Public fixes help defenders, but can also expose clues. Epoch’s results suggest a model can help turn those clues into a working exploit within hours under the study’s conditions.
Epoch recommends updating Firefox to version 159 or later and restarting the browser. Mozilla released Firefox 159 on October 27, patching the key unpublished flaw used in the successful recent-version tests.
The study puts focus on the interval between publishing a fix and users applying it. More evidence is needed to determine which release and update practices best reduce that exposure.
SCOPE & LIMITS
A controlled demonstration, not an incident report
The experiment ran offline and did not reach real websites or users.
It demonstrated file access; it did not take control of the computer.
The report gives no evidence that the attack was used outside the lab.
Earlier Firefox versions were described as likely vulnerable, but were not systematically tested.
Epoch said the same setup failed against Chrome after about $100,000 in attempts. This does not establish that Chrome is immune to other methods. The researchers also reported no safety refusals from providers they used, including Z.ai.
KEY QUESTIONS
What the report answers
Were Firefox users attacked?
The report describes a controlled lab test and provides no evidence that real users were targeted or affected.
Which version contains the reported fix?
Firefox 159, released October 27, 2026. Update to version 159 or later and restart Firefox.
Does this prove every public fix can be exploited?
No. It shows what happened in this test; it does not establish how often similar methods will work in real incidents.
Does the Chrome result prove Chrome is safe?
No. The reported failure applies to Epoch’s tested approach and attempts, not every possible method.
The Risk Between Fix and Update
The test focuses on the time between a security fix becoming visible and users installing the version that contains it. In an open-source project, code changes can reveal what a fix addresses. Epoch’s results suggest that an AI model can help turn those clues into a working exploit within hours under the study’s conditions. That could increase the speed and availability of vulnerability research, including work by people who do not have specialist exploit-development teams.
The finding does not show that GLM 5.3 attacked Firefox users or that every public fix can be exploited this way. It does show why update timing matters: users who have not installed a security release may remain exposed to flaws that are easier to study once a fix becomes public. Epoch recommends updating Firefox to version 159 or later and restarting the browser.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
DJI Mini 5 Pro Fly More Combo Plus with DJI RC 2
As an affiliate, we earn on qualifying purchases.
How Public Fixes Expose Clues
Security teams often publish fixes before every user has installed them. In Firefox, researchers can inspect public code changes, while users may still be running an earlier stable release. The period between a fix becoming visible and the update being widely installed is commonly called the patch gap. A fix can help defenders understand what changed, while also giving potential attackers clues about the weakness.
Epoch asked the model to examine fixes not yet present in the stable version and find a way to read a file. The researchers describe the setup as largely autonomous after an initial instruction: GLM 5.3 selected fixes, tried approaches, and adjusted after crashes. Epoch says it spent more than $100,000 building and testing the setup. That figure refers to the research effort, while the roughly $1,000 figure refers to API fees for each later Firefox-version attempt.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What the Lab Test Cannot Show
The results come from a controlled, offline experiment, not observation of attacks against Firefox users. Epoch did not establish how often attackers will use similar methods in real incidents, or how many users remained exposed before installing Firefox 159. The report also does not establish that the same approach works across other browsers, operating systems, or security fixes.
Epoch said earlier Firefox releases were likely vulnerable, but it did not systematically test them. Its failed Chrome attempts describe one setup and one set of attempts; they do not show that Chrome is immune to AI-assisted analysis. The report provides no evidence that the tested attack was used outside the lab.
Firefox Updates and Further Testing
Firefox users can install version 159 or later and restart the browser to receive the patch described by Epoch. Mozilla’s release on October 27 closed the key flaw used in the successful recent-version tests, according to the source material. The researchers’ report leaves open how quickly other public fixes might be converted into exploits and whether further testing will reproduce the result on different targets.
For software makers, the episode puts attention on the time between disclosing a fix and users applying it. Further evidence would be needed to determine how often this kind of model-assisted work leads to real-world attacks and what release or update practices reduce that risk.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch said the model built webpages that could read a local file in each of six tested Firefox releases, using public information about security fixes. The experiment took place offline in a lab.
Were Firefox users attacked?
The report describes a controlled test and provides no evidence that real users were targeted or affected by the demonstrated attacks.
Which Firefox version contains the reported fix?
Epoch said Mozilla patched the key unpublished flaw in Firefox 159, released October 27, 2026. The source recommends updating to version 159 or later and restarting Firefox.
Does the test show Chrome is safe from similar attacks?
No. Epoch reported that its setup failed against Chrome after about $100,000 in attempts. That result applies to the tested setup and does not establish that Chrome is immune to other approaches.
Source: Thorsten Meyer AI
