🔍 Read the full analysis: Epoch AI’s Firefox Demo: What Happened And What To Do Next on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reports that GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing publicly visible security fixes, with the fastest run taking 12 hours. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159; Epoch has not reported testing whether the attack still works against that release. Firefox users should update to version 159 or later and restart the browser.
Epoch AI says an open-weight AI model, GLM 5.3, developed working attacks against six Firefox releases by analyzing security fixes visible in public code before those fixes reached users. The lab tests took as little as 12 hours; Mozilla separately patched an unpublished flaw used in the attacks in Firefox 159, released October 27. The results show how quickly public patch information may help attackers, but they do not establish that users were targeted or that the demonstrated attacks work on Firefox 159.
In a report published October 29, Epoch AI researchers said they tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They asked GLM 5.3 to create a webpage that could read a local file when opened in a particular Firefox version. According to the researchers, the model succeeded against all six tested releases, using information public when each version was released. Epoch estimated about $1,000 in API fees per version once its test setup was built; building and testing that setup cost more than $100,000.
The researchers said the model identified security fixes in public Firefox code that had not yet reached stable-release users, then used those fixes as clues to the vulnerabilities they addressed. Each successful attack on a recent version also relied on a separate, unpublished flaw, which Epoch said the model rediscovered during each attempt. The demonstration’s stated result was reading a file from the computer, not taking control of the entire device.
Epoch said it disclosed the unpublished flaw to Mozilla. Mozilla released Firefox 159.0 on October 27, before the report appeared, and the source material identifies that release as containing the fix. Epoch allowed up to 48 hours for a run, and said no provider safeguards or refusals stopped the model in its tests. These findings come from a controlled experiment, not reports of attacks against Firefox users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Patches Can Guide AI Attacks
The results focus attention on the time between a security fix becoming visible and users installing the update. In open-source projects, changes to public code can reveal what was repaired. Epoch’s experiment suggests that an AI system can use those clues to help construct an attack within hours, rather than requiring a person to analyze each change alone.
That does not mean every published patch can be turned into a working exploit, or that the model can attack any browser. The study shows one model, one target and a defined laboratory setup. Still, it gives software users and organizations a practical reason to install security updates promptly: a fix that protects updated systems may also signal where unpatched systems remain exposed.
For individuals, the immediate step is straightforward: update Firefox to version 159 or later and restart it. For organizations, the report underscores the value of timely browser updates and clear processes for checking that managed devices have restarted into patched versions.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
A patch gap is the period after information about a vulnerability or its fix becomes public but before affected users have installed the repair. In the experiment described by Epoch, researchers gave the model access to public information available when each Firefox version was released. They directed it toward fixes that had not yet appeared in the stable release, then allowed it to work without further input.
Epoch said the test environment used Ubuntu 26.04, default settings and Firefox downloaded from its official release. The model had basic tools but no internet access, and the researchers say the setup could not reach real websites or users. Epoch chose file reading as its test objective because access to local browser data or documents could have serious privacy consequences.
The report also describes a limit: the same setup failed against Chrome after about $100,000 in attempts. That finding does not establish that Chrome is immune; it records the outcome of this particular test. Epoch said earlier Firefox versions were likely vulnerable too, but it had not systematically tested them.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Lab Test Cannot Establish
Epoch’s report describes a controlled lab test, not a confirmed campaign against real Firefox users. The researchers disabled internet access, and the source material reports no evidence that anyone used the demonstrated technique outside the experiment. The test also measured a specific file-reading objective; it did not show full computer takeover.
Epoch had not tested whether the attack remained possible against Firefox 159 when the source material was published. Mozilla’s patch addresses the unpublished flaw Epoch reported, but the report does not establish whether that repair blocks every related attack path. The number of earlier Firefox versions affected also remains uncertain because those versions were not systematically tested.
The source material says Firefox 159’s advisory lists 167 security fixes, but cautions that Mozilla had changed its counting approach. The figures alone should not be treated as a direct measure of the release’s severity compared with earlier updates. The precise extent to which the result generalizes to other models, software and real-world attackers is also unknown.
Update Firefox and Watch Testing
Firefox users should install version 159 or later and restart the browser so the update takes effect. Users can check their installed version through Firefox’s update settings. People using managed work devices should follow their organization’s update process and contact its support team if they cannot install or restart promptly.
Epoch’s next useful step would be to test the attack setup against Firefox 159 and publish the result, while keeping any details that could enable misuse appropriately limited. Mozilla’s security advisories and subsequent Firefox releases will show whether further fixes or guidance are issued. Organizations should check that updates have reached devices, rather than relying only on a policy requiring users to install them.
The report’s immediate lesson is narrower than a claim that AI can attack any browser: in this test, a model turned public information about Firefox fixes into attacks against unpatched versions, and Mozilla patched a separate flaw the model used. How often that capability transfers beyond this setup remains to be established.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch AI says the model analyzed public Firefox security-fix information and developed webpages that could read a local file in six tested Firefox releases. The work took as little as 12 hours in the fastest run.
Were Firefox users attacked?
The source material describes a lab experiment and reports no confirmed attacks on real users. The test environment had no internet access, according to Epoch.
What should Firefox users do now?
Update to Firefox 159 or later, then restart the browser. Users of managed devices should follow their organization’s update process.
Does the study show that Firefox 159 is vulnerable?
No. Epoch had not tested whether the demonstrated attack still worked against Firefox 159. The report says Mozilla patched the separate unpublished flaw used in the tests, but the release’s effectiveness against similar attack paths had not been established by Epoch’s testing.
Did the attack take over a computer?
The demonstrated objective was to read a local file. The source material says the experiment did not show full computer takeover.
Source: ThorstenMeyerAI.com
