🔍 Read the full analysis: Responding To The AI Security Risk In Epoch AI’s Firefox Demo on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases by analyzing security fixes that were public before users received the updates. The attacks also relied on a separate, unpublished flaw that Epoch reported to Mozilla; Mozilla patched it in Firefox 159. The work was a controlled lab test, and Epoch has not reported testing the attack against Firefox 159.
Researchers at Epoch AI say an open-weight model, GLM 5.3, built working attacks against six consecutive Firefox releases by analyzing security fixes that were public before the updates reached users. The attacks could make a browser open a webpage that read a local file, according to the researchers; Mozilla patched a separate, previously unpublished flaw used in the demonstrations in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers said they tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. For each version, the model was asked to create a webpage that could read a file on a test computer when opened in that version of Firefox. Epoch allowed up to 48 hours per attempt; the fastest successful run took 12 hours. The group estimated API costs at about $1,000 for each version once its testing setup was built. Building and testing that setup cost more than $100,000, the report said.
The researchers said GLM 5.3 identified fixes in public Firefox code that had not yet reached the stable release, then used those clues to find vulnerabilities. The demonstrations also depended on a second flaw that had not been publicly disclosed. Epoch said it reported that flaw to Mozilla, which addressed it in Firefox 159. The researchers described the exposed data as potentially including saved passwords, browser cookies or private documents, but the test demonstrated file reading, not a full takeover of the computer.
Epoch said the model completed the task without researcher guidance after the initial setup and that it encountered no safety refusals from the providers it tested, including Z.ai, the model’s maker. That is the researchers’ account of their experiment, not evidence that GLM 5.3 has been used to attack real Firefox users. The test environment had no internet access, and Epoch said its setup failed against Chrome after about $100,000 in attempts.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk Before Users Update
The report highlights a security problem that exists between the publication of a software fix and the point when users install it. Public code changes can reveal what developers repaired, giving attackers information about the weakness while some devices may still run the older version. That delay is often called the patch gap.
Epoch’s findings suggest that capable, openly available models may lower the specialist effort needed to turn that information into an exploit. The researchers said the model selected relevant fixes, tested approaches and adjusted after failures. If similar work can be repeated outside a lab, defenders may have less time to update systems before an exploit becomes practical. The report does not establish how often this will happen or whether attackers have used this method in the wild.
For individuals, the immediate practical step is to install Firefox 159 or later and restart the browser, as the source report advises. For organizations, the episode points to the value of rapid patch deployment and monitoring for delayed updates. It does not mean every user of an earlier version was attacked, nor does it show that all browsers are equally exposed.
Products Worth Considering
Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
How Public Fixes Became Clues
Open-source projects publish code changes that can disclose details about a security repair before every user has installed the corresponding update. In Epoch’s account, GLM 5.3 used those changes as clues to identify weaknesses in older Firefox releases. The researchers describe that interval between a fix becoming visible and users receiving it as the patch gap.
Epoch set up a controlled test on Ubuntu 26.04 with default settings and official Firefox releases. The model received the version it was targeting and basic tools, but no internet access; researchers did not provide step-by-step guidance once the task began. The goal was to produce a webpage that could read a local file in the specified browser version. Epoch said the successful attempts combined information from an upcoming fix with another flaw that could get past Firefox’s sandbox, which is intended to restrict a webpage’s access to the rest of the system.
The researchers tested six releases systematically, from Firefox 156.0 to 158.0.1. They said earlier versions may also be vulnerable but were not tested in the same way. Mozilla’s Firefox 159 security advisory lists 167 fixes, according to the source report, though that total includes a change in Mozilla’s counting approach and should not be treated as a direct measure of the severity of this particular issue.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers, as quoted in the report
What the Lab Test Cannot Show
The report describes a controlled experiment, not an attack on real users. It does not establish that anyone used the method outside Epoch’s test environment, how many systems remained on affected versions, or whether other models can reproduce the results. The test targeted a specific setup and demonstrated file reading; it did not show complete control of a computer.
Epoch had not tested the same setup against Firefox 159 at the time of the source report. The researchers expected Mozilla’s fix to make similar attacks substantially more difficult, but the report does not confirm whether the attack chain still works, or how much additional work would be needed. The source also says the model’s attempts against Chrome failed after about $100,000 in spending; that result does not establish that Chrome or other browsers are immune to related techniques.
It is also unclear how quickly real attackers could reproduce the work, whether the model’s lack of refusals would persist under other prompts or safeguards, and how many users had installed the relevant Firefox updates. Epoch’s results concern six releases, while its suggestion that older versions may also be vulnerable was not based on systematic testing.
Mozilla Patches, Users Update
Mozilla has released Firefox 159 with a fix for the separate unpublished flaw reported by Epoch. Users should check that they are running Firefox 159 or later and restart the browser after updating. The source report does not provide a confirmed count of affected users or indicate that the demonstrated attack was used against the public.
The next key technical question is whether Epoch or other researchers test the same attack method against Firefox 159 and publish results. Further reporting would also need to establish whether comparable methods work against other browser versions and configurations, and whether AI providers change safeguards in response to the findings. Until those details are available, Epoch’s report is evidence of a lab capability and a patching risk—not proof of a live campaign.
Key Questions
What did GLM 5.3 do in the Firefox test?
Epoch AI said the model built webpages that could read a local file when opened in each of six tested Firefox releases, versions 156.0 through 158.0.1. The work took place in an isolated lab setup, not against real users.
How did public Firefox fixes help the model?
According to Epoch, the model analyzed security fixes visible in public code before those fixes had reached stable Firefox users. Those changes gave it clues about weaknesses in older releases, creating risk during the patch gap.
Did the demonstration expose a previously unknown flaw?
Epoch said each successful attack on recent versions also used a flaw that had not been publicly disclosed. The researchers reported it to Mozilla, which patched it in Firefox 159.
Were Firefox users attacked?
The source report describes a controlled test with no internet access and does not report attacks on real users. It does not establish whether anyone outside the experiment used the method.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, following the source report’s advice. Epoch had not yet tested whether the same attack worked against Firefox 159.
Source: ThorstenMeyerAI.com
