🔍 Read the full analysis: What Should Teams Do About AI-Powered Attacks On Firefox Fixes? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reported that open-weight model GLM 5.3 created working attacks against six Firefox releases by analyzing publicly visible security fixes. The fastest attempt took 12 hours; Mozilla fixed an additional, previously unpublished flaw used in the tests in Firefox 159. The research was conducted in a lab, not against real users.
Epoch AI reported on October 29 that open-weight model GLM 5.3 built working attacks against six Firefox releases by using security-fix information visible in public code before updates reached users. The fastest run took 12 hours. Mozilla had patched an additional, previously unpublished flaw used in the tested attacks in Firefox 159, released October 27; the research was a controlled lab test, not an attack on people browsing the web.
Epoch’s six researchers tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave the model the browser version, basic tools and public information available at the time, then asked it to build a webpage that could read a local file when opened in the specified Firefox version. The test ran on Ubuntu 26.04 using official Firefox releases. The researchers said they provided no internet access, preventing the test from targeting a real website or user.
According to Epoch, GLM 5.3 succeeded against all six tested releases. Researchers allowed up to 48 hours for each attempt; the fastest took 12 hours. They estimated that, after building the initial setup, each additional Firefox version cost about $1,000 in API fees. Developing and testing the setup cost Epoch more than $100,000, the report said. The researchers said they encountered no provider safeguards or refusals during the experiments.
The attack chain used public information about fixes not yet included in the stable browser, along with a separate flaw that had not been publicly disclosed. Epoch reported that second vulnerability to Mozilla, which addressed it in Firefox 159.0 on October 27. The researchers described the tested outcome as reading a local file; the source material does not report a complete takeover of the computer. Mozilla’s Firefox 159 advisory lists 167 security fixes, though the provided account notes that Mozilla changed its counting approach.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
How Public Fixes Can Aid Attackers
The findings focus attention on the period between a security fix becoming visible and users installing the update. In open-source software, code changes can reveal what a developer has repaired. Epoch’s results suggest that an AI system can help analyze those changes and produce an exploit quickly, reducing the time and specialist effort needed for this kind of work. That could make patch timing and deployment speed more important for organizations responsible for many devices.
The demonstrated impact was limited to a lab scenario involving local-file access, not a confirmed campaign against Firefox users. Still, files accessible to a browser may contain sensitive material, depending on a user’s setup. Organizations should treat browser updates as security work with operational priority: update managed installations promptly, verify that devices have restarted into the patched version, and follow Mozilla’s advisories. The experiment does not establish that every public fix can be turned into an attack, or that attackers have used this method in the wild.
Popular right now
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
Shark Rotator Lift-Away Vacuum with DuoClean PowerFins (LA555) – Dark Grey
Dyson V8 Cyclone Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
The Firefox Patch-Gap Test
Software updates can expose information about a vulnerability before every user has installed the repair. Epoch describes this interval as the patch gap. Its researchers instructed GLM 5.3 to examine fixes that appeared in public Firefox code but were not yet in the stable release. The model selected relevant changes, tested approaches and built a multi-stage attack chain, according to their report.
Epoch said each successful attack on recent releases combined a weakness indicated by an upcoming fix with the additional unpublished vulnerability that allowed the attack past Firefox’s sandbox. The researchers reported the latter to Mozilla, which patched it in Firefox 159. Epoch’s test against Chrome did not succeed after about $100,000 in attempts, according to the source material. That result is specific to this setup and does not establish that Chrome is generally resistant to AI-assisted attacks.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Lab Test Cannot Show
The report does not show that GLM 5.3 or another model attacked real Firefox users, nor does it establish that anyone has used the demonstrated chain outside the lab. Epoch had not tested Firefox 159 at the time described in the source, so the effect of Mozilla’s patch on comparable attacks remained unverified by the researchers. It is also unclear whether the same results would hold across different operating systems, browser configurations or other versions.
Epoch said earlier Firefox releases were likely vulnerable but did not systematically test them. The supplied account also does not provide a detailed independent assessment of the study’s results. Its findings concern one model, one target and a defined test environment; they should not be treated as proof that AI can routinely exploit any newly published security fix. The exact potential exposure of files depends on the machine and the browser’s access to them.
Patch, Restart and Verify
Mozilla has released Firefox 159, which includes the fix for the additional flaw reported by Epoch. Users and IT teams should update to Firefox 159 or later and restart the browser so the patched version is running. Organizations can check managed-device inventories, confirm update completion and review Mozilla’s security advisories for affected versions and deployment guidance.
The next research milestone is whether similar attack chains remain viable against patched Firefox versions; Epoch said it had not yet tested version 159. Security teams should also watch for further technical details or advisories from Mozilla and Epoch. The report does not specify a date for follow-up testing, and no confirmed real-world exploitation was identified in the supplied material.
Key Questions
What did Epoch AI report?
Epoch said GLM 5.3 built working attacks against six Firefox releases, from 156.0 to 158.0.1, by using publicly visible security-fix information. The tests took up to 48 hours, with the fastest reported run taking 12 hours.
Was this an attack on real Firefox users?
No real users or websites were targeted in the described experiment. Epoch says the testing took place in a lab without internet access. The report does not establish that this attack chain has been used in the wild.
Has Mozilla fixed the flaw described in the report?
Epoch reported an additional, previously unpublished vulnerability to Mozilla. The researchers said Mozilla patched it in Firefox 159.0, released October 27, 2026. Epoch had not yet tested whether comparable attacks still worked against that release.
What should Firefox users and IT teams do?
Update Firefox to version 159 or later and restart it. IT teams should verify that managed devices have installed the update and are running the patched browser.
Does the research prove AI can exploit every browser fix?
No. The findings concern one model, six Firefox releases and a specific controlled setup. Epoch’s reported Chrome test failed, but that result does not establish general protection for Chrome or other browsers.
Source: ThorstenMeyerAI.com
