🔍 Read the full analysis: What Security Teams Can Learn From Epoch AI’s Firefox Attack Demo on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI researchers report that the open-weight model GLM 5.3 built working lab attacks against six Firefox releases by analyzing security fixes visible before users received them. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether similar attacks work against that release.
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes already visible in public code. Mozilla patched a separate flaw used in the lab tests in Firefox 159, released October 27; the researchers have not established whether similar attacks work against that version.
In the test, the model was asked to create a webpage that could read a local file when opened in a specified Firefox release. Epoch says GLM 5.3 succeeded against versions 156.0 through 158.0.1, covering six releases from September 17 to October 26. The researchers allowed up to 48 hours per attempt; the fastest successful run took 12 hours. After the testing setup was built, Epoch estimated the API cost at about $1,000 per version. Building and testing the setup cost the research group more than $100,000.
The researchers say the model used fixes disclosed in Firefox’s public code to identify weaknesses before those fixes reached stable-release users. That interval is commonly called the patch gap. In each successful test against recent releases, the attack also depended on a second flaw that Epoch says had not previously been published. The group reported that flaw to Mozilla, which addressed it in Firefox 159. The test machine ran Ubuntu 26.04 with default settings, and the model had no internet access; Epoch says the setup could not target real websites or people.
Epoch described GLM 5.3 as working without researcher input after receiving a basic instruction to examine fixes not yet in the stable release. The report says the model selected fixes, developed attack approaches and adjusted after crashes. The group said it encountered no refusals or safeguards from the providers it used. Those are findings from this particular test, not evidence that every model or security task will produce the same result.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
When Fixes Become Attack Clues
The report focuses security teams on a familiar weakness in patching: public fixes can reveal where software was vulnerable before all users have installed the update. Epoch’s results suggest that an AI model may be able to help turn that information into a working exploit, including by testing and revising approaches, rather than merely describing a potential weakness. The demonstrated sequence took hours in its fastest run, according to the researchers.
That matters for organizations that manage browsers across many devices. A patch is not protective simply because a vendor has released it; devices must receive the update and, where required, restart the software. The report supports attention to update speed and coverage, but it does not show that attackers used the method against people in the wild. Nor does it establish that all Firefox users, operating systems or configurations were vulnerable in the same way.
Epoch says the tested file-reading attack could expose browser-stored passwords, login cookies or private documents. The researchers also stress a boundary: the demonstrated attack read files and did not take over the computer. That distinction matters when weighing the potential harm. For security teams, the practical concern is the time available to deploy a fix, while the demonstrated capability should not be confused with evidence of real-world exploitation.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
Firefox is an open-source browser, so changes to its code can be publicly visible before a stable update reaches every user. A security fix may disclose enough about the repaired weakness to help someone investigate the affected code. Users who have not yet installed the corresponding update remain in what security practitioners call the patch gap. The underlying issue predates this experiment; Epoch’s report is about the model’s role in exploiting information available during that interval.
Epoch says it tested six releases issued between September 17 and October 26, and that each successful attack combined information associated with an upcoming fix and the additional, unpublished flaw it found. The group disclosed that flaw to Mozilla, which released Firefox 159 on October 27. Mozilla’s advisory for that release lists 167 security fixes: 108 rated high, 52 moderate and seven low, according to the supplied source material. Epoch also says the same setup failed against Chrome after roughly $100,000 in attempts. That result is specific to its test and does not establish that Chrome is generally immune to AI-assisted attacks.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI, describing the study’s central finding
What the Lab Test Cannot Confirm
Epoch says it has not tested Firefox 159 to determine whether similar attacks still work after Mozilla’s fix. The report therefore does not confirm that the patched version is vulnerable or that the change blocks every possible attack. The researchers also did not systematically test releases earlier than 156.0; their view that earlier versions are likely vulnerable is an estimate, not a confirmed test result.
The source material describes a controlled lab exercise, not an attack on real users. It does not establish that the method has been used outside the test, how often such attacks might occur, or whether other models can reproduce the results at similar cost and speed. The Chrome experiment’s failure is likewise limited to the setup Epoch tried. Mozilla’s response beyond releasing Firefox 159, and the technical details needed to independently assess the full attack chain, are not fully established in the supplied material.
Patch Deployment and Follow-Up Testing
The immediate step for Firefox users and administrators is to check that devices are running Firefox 159 or later and restart the browser after updating. Organizations can use the report as a reason to review how quickly browser updates reach managed devices, whether restarts are completed, and how they monitor devices that remain on older releases. The article does not establish a separate Mozilla deadline or a schedule for further fixes.
Further clarity depends on testing after the Firefox 159 release and on additional reporting from Mozilla or Epoch about the patch’s effect. Epoch’s published results may also prompt other researchers to examine whether similar methods apply to different software. Until that work is available, the confirmed finding is limited to the six Firefox releases tested and the controlled conditions described in the report.
Key Questions
What did Epoch AI demonstrate?
Epoch says GLM 5.3 built a webpage-based file-reading attack against six Firefox releases, using security-fix information already public when each release appeared. The work took place in a lab, with no access to real websites or users.
Was Firefox 159 tested in the study?
No. Epoch says it has not tested whether similar attacks work against Firefox 159. Mozilla released that version on October 27 and patched the additional flaw Epoch reported.
Did the attack take over a computer?
According to the source material, the demonstrated attack read a local file; it did not take over the computer. Epoch said a file read could expose browser-stored passwords, login cookies or private documents, but the test was not conducted against real users.
What should Firefox users do?
Check that Firefox is updated to version 159 or later, then restart it if needed to complete the update. Organizations should also check that updates reach managed devices rather than relying only on release availability.
Does the report show that AI attacks are happening in the wild?
No. The report describes a controlled experiment and does not establish that the demonstrated method has been used against real users. The possibility of similar activity outside the lab remains unconfirmed.
Source: ThorstenMeyerAI.com
