🔍 Read the full analysis: Epoch AI’s Demonstration: Downloadable AI, Firefox Fixes, And What Now on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI researchers report that downloadable open-weight model GLM 5.3 built attacks against six Firefox releases by using publicly visible security fixes and rediscovering an unpublished flaw. Mozilla patched that additional flaw in Firefox 159, released October 27, 2026. The work was a controlled lab test, not an attack on users; Epoch says its setup failed against Chrome after about $100,000 in attempts.
Epoch AI researchers report that downloadable open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible in public code before those releases reached users. Mozilla patched an additional, previously unpublished flaw the model used in Firefox 159, released October 27; the research was conducted in a controlled lab, not against real users.
In the study, six Epoch AI researchers gave GLM 5.3 the task of building a webpage that could read a local file when opened in a specified Firefox version. According to their report, the model succeeded against versions 156.0 through 158.0.1, released between September 17 and October 26. Epoch allowed up to 48 hours for each attempt; its fastest successful run took 12 hours.
The model was provided with the relevant browser version and basic tools, but Epoch says it had no internet access and could not target a real person or website. It used publicly available information, including Firefox code changes that revealed details of fixes before users had installed them. After the initial setup, Epoch estimated API fees at about $1,000 per version. The research group said creating and testing the setup cost more than $100,000.
Epoch says each successful attack on recent versions also depended on a flaw that had not been publicly disclosed. The researchers reported it to Mozilla, which fixed it in Firefox 159. Epoch said it received no refusals or safeguards from the providers involved, including GLM 5.3’s maker, Z.ai. Those are findings from Epoch’s account of its experiment; they do not establish that the model was used to attack Firefox users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
When Public Fixes Become Attack Maps
The study draws attention to the period between a security fix becoming visible and users installing the update, often called the patch gap. Public code can help developers and security researchers understand a repair, but it can also reveal what an attacker might need to exploit. Epoch’s experiment suggests that an open-weight model could automate parts of that analysis and produce a working attack within hours in this particular test.
That matters because open-weight models can be downloaded and run outside a single provider’s service. The results raise a practical concern for software makers and users: publishing a fix does not immediately protect devices that have not yet received or installed it. At the same time, the study does not show that the model can attack every browser, that the approach works at scale, or that real-world attackers have used it. Epoch’s Chrome test failed after about $100,000 in attempts, a reminder that results can depend on the target and resources.
For Firefox users, the direct action is straightforward: install Firefox 159 or later and restart the browser. The research does not say that updating removes every possible browser risk, but Mozilla’s release includes the reported fix for the additional flaw.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
DJI Mini 5 Pro Fly More Combo Plus with DJI RC 2
Logitech MX Mechanical Wireless Illuminated Performance Keyboard – Clicky
As an affiliate, we earn on qualifying purchases.
How Firefox’s Patch Gap Was Tested
Software developers often publish code changes that expose the nature of a security issue before every user has installed the corresponding update. That interval can leave older releases vulnerable even though the repair is already public. Epoch focused on this window, supplying the model with information that was available when each tested Firefox version came out.
The target was a file-reading attack triggered when a user opened a webpage. Epoch says its test environment used Ubuntu 26.04, default settings and Firefox downloaded from the official release. The researchers reported that the attack chain combined information from a forthcoming fix with a separate flaw that could get past Firefox’s sandbox, a containment layer intended to restrict what a compromised webpage can access. The researchers did not publish operational details of the chain in the source account.
Epoch describes the experiment as an autonomous run: after giving the model a basic instruction to examine fixes not yet present in the stable release, researchers did not guide its choices. The model selected bugs, tried approaches and adjusted after crashes, according to the report. The group’s broader conclusion is that widely available open-weight models can do much of this work independently; that conclusion is Epoch’s interpretation of its test, not a finding established across software products.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Firefox Test Cannot Show
The study does not establish whether comparable attacks are being attempted against real Firefox users, or how frequently AI-assisted exploitation occurs outside a lab. Epoch has not yet tested whether the reported attack chain works against Firefox 159; it said the patch is expected to make similar attacks “at least substantially more difficult.” That expectation is not the same as a demonstrated result.
The supplied account also does not provide enough information to assess how the findings might transfer to other systems, or how often attackers could reproduce the results with different models and resources. Epoch said the same setup failed against Chrome after about $100,000 in attempts, but that single result does not settle the wider question of browser security. The experiment demonstrated a file-read capability; it did not take over the computer, according to the source material.
Install Firefox 159 and Watch for Retesting
Firefox users should update to version 159 or later and restart the browser, according to the source account. Mozilla released version 159 on October 27 and patched the additional flaw Epoch reported. The study says earlier Firefox versions are likely vulnerable, but those releases were not all systematically tested, so that possibility should not be treated as a confirmed result for every version.
The next key evidence would be testing of the attack against Firefox 159 and further independent work on whether similar methods apply to other software. Epoch’s report describes the test and its limits; the supplied material does not state a date for any follow-up study. Until more results are available, the confirmed points are the six successful lab tests reported by Epoch, Mozilla’s release of the patch, and the absence of evidence in this account that real users were attacked.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch says the model built a webpage-based attack that could read a local file when opened in six tested Firefox releases. The test ran in a controlled environment and had no internet access.
Was the attack used against Firefox users?
The source material describes a lab experiment, not an attack on real users. It provides no evidence that the demonstrated chain was used outside the test.
Which Firefox version includes Mozilla’s fix?
Mozilla released Firefox 159 on October 27, 2026, including a fix for the additional flaw Epoch reported. Users should update to version 159 or later and restart the browser.
Did Epoch confirm the attack no longer works in Firefox 159?
No. Epoch had not yet tested the attack against version 159 in the supplied account. It said the fix was expected to make similar attacks substantially more difficult.
Does the study prove open-weight AI can attack any browser?
No. The findings concern a specific Firefox test. Epoch says its setup failed against Chrome after about $100,000 in attempts, and the experiment does not establish how the method would perform across other products.
Source: ThorstenMeyerAI.com
