🔍 Read the full analysis: What Does Epoch AI’s Firefox Demo Mean For AI Security? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible before updates reached users. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159. The work was conducted in a lab, and Epoch has not established whether the demonstrated attack works against Firefox 159.
Epoch AI reported October 29 that open-weight model GLM 5.3 built attacks against six Firefox releases by studying security fixes that were public before the corresponding updates reached users. Mozilla had already released Firefox 159 on October 27, patching a separate, previously unpublished flaw used in the demonstrations; Epoch has not yet tested whether the attack works against that version.
In the researchers’ lab setup, the model was asked to create a webpage that could read a local file when opened in a specified Firefox release. Epoch says GLM 5.3 succeeded against releases 156.0 through 158.0.1, covering six versions released between September 17 and October 26. The fastest successful run took 12 hours; Epoch allowed as much as 48 hours per attempt.
The researchers say the model used publicly available information, including changes in Firefox’s code that revealed details about vulnerabilities fixed in upcoming updates. This interval between a security fix becoming visible and users receiving or installing the update is commonly called the patch gap. Epoch estimated about $1,000 in API fees per version once its testing setup was built, while developing and testing that setup cost the research group more than $100,000.
Each successful attack on recent releases also relied on a second flaw that Epoch says was not publicly known. The researchers reported that flaw to Mozilla, which patched it in Firefox 159. The demonstrated capability was to read files, not to take control of a computer, and Epoch says the experiment ran in a controlled environment without internet access or real-world targets.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Public Fixes Can Guide Attack Development
The study highlights a security timing problem: patch information can help attackers as well as defenders. Once code changes or release notes reveal what a fix addresses, a technically capable adversary may use that information to search for related weaknesses before all users have installed the update. Epoch’s results suggest that an open-weight model could reduce the expertise and time needed for that work, although the experiment does not establish how often this would happen outside a lab.
For users and organizations, the practical implication is to install browser security updates promptly and restart when required. For software makers, the result adds pressure to shorten the period between preparing a fix and getting it to users, and to consider how public development details affect that window. It does not show that AI has made browsers generally easy to compromise or that the specific attack remains effective against current Firefox versions.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
How the Firefox Tests Worked
Epoch gave GLM 5.3 a target and access to the relevant Firefox version, basic tools and information that was public at the time. The model did not have internet access. Researchers told it to examine fixes not yet present in the stable release, then allowed it to proceed without further input. According to Epoch, it selected bugs, tested approaches and assembled the attack chain.
The target was a webpage that could read a local file in the specified browser. The researchers chose file access because it could expose sensitive material, such as saved credentials, cookies or documents. Their report says the attack combined information from an upcoming fix with an additional flaw that bypassed Firefox’s sandbox, the isolation intended to limit what a compromised page can access.
Epoch also tried its setup against Chrome, but says it did not succeed after spending about $100,000 on attempts. That result applies to this particular experiment; it does not establish that Chrome is immune to AI-assisted vulnerability research. Epoch says earlier Firefox versions may also be vulnerable, but it did not test them systematically.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Lab Test Cannot Establish
The study does not show that real users were attacked, or that GLM 5.3’s demonstration can be used against Firefox 159. Epoch says it has not tested the latest version; its expectation that the patch makes similar attacks substantially harder is not a verified test result. The report also does not establish whether the same technique would work on other systems, configurations or browser versions.
Epoch reported that none of the model providers involved refused the task or activated safeguards. That finding describes this evaluation and its prompts, not every model, provider policy or security-testing situation. The source material says Mozilla’s Firefox 159 advisory lists 167 security fixes, but also notes a change in how Mozilla counts fixes, so the total should not be treated as a direct comparison with earlier releases without that accounting context.
Update Firefox and Watch for Tests
Firefox users should install version 159 or later and restart the browser if required, according to the source report. Organizations should confirm that managed devices receive the update rather than assuming it has been applied automatically.
The next technical question is whether Epoch or other researchers can reproduce comparable results against Firefox 159 and later releases, and whether the Mozilla patch blocks the demonstrated chain. Further testing could clarify how broadly the method applies and what safeguards or update practices reduce the risk. Until those results are available, the documented evidence remains a lab demonstration against six earlier Firefox releases, not a report of exploitation in the wild.
Key Questions
What did Epoch AI demonstrate?
Epoch AI says GLM 5.3 built webpages that could read local files in six Firefox releases, from 156.0 to 158.0.1, by using public information about security fixes and an additional flaw.
Was Firefox 159 shown to be vulnerable?
No. Mozilla released Firefox 159 on October 27 and patched the previously unpublished flaw used in the demonstrations. Epoch said it had not yet tested whether similar attacks work against version 159.
Were real Firefox users attacked in the test?
No real-world attack was reported. Epoch describes a controlled lab test with no internet access, not exploitation against users or live websites.
What should Firefox users do?
Install Firefox 159 or a later version and restart the browser if prompted. Keeping the browser updated reduces the time a device remains on an older release with known security fixes outstanding.
Does the study show that AI can compromise any browser?
No. The finding concerns a particular test against six Firefox releases. Epoch said its setup failed against Chrome after about $100,000 in attempts, but that result does not prove Chrome is immune to other methods.
Source: ThorstenMeyerAI.com
