🔍 Read the full analysis: What Epoch AI’s Firefox Demo Says About Downloadable AI on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI reported that downloadable open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing public security fixes before users received the updates. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159; the work was a controlled lab test, not an attack on Firefox users.
Epoch AI reported October 29 that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes visible in public code before those fixes reached users. Mozilla says it patched an additional vulnerability used in the tests in Firefox 159, released October 27; the researchers describe a controlled lab experiment, not an attack on real users.
Epoch’s six researchers tested releases 156.0 through 158.0.1, dating from September 17 to October 26. Their task was to make a webpage that could read a local file when opened in a specified Firefox version. The researchers say the model received the version number, basic tools, and information that was public when the release appeared, but had no internet access and could not target a real person or website.
Epoch allowed up to 48 hours per attempt; its fastest successful run took 12 hours. After researchers built the initial setup, the report puts the marginal API cost at about $1,000 per Firefox version. Building and testing that setup cost Epoch more than $100,000. These figures describe the study’s particular process and costs, not a general price or time guarantee for other models or targets.
The report says the attacks combined information inferred from upcoming fixes with another flaw that had not been publicly disclosed. Epoch reported that flaw to Mozilla, which patched it in Firefox 159. The researchers say they encountered no model refusals or provider safeguards during the experiment. That observation applies to their test and does not establish how every model or safety system would respond to other prompts.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
When Security Fixes Reveal Weaknesses
The test focuses attention on the patch gap: the period after a fix becomes visible but before users install an update. In open-source software, code changes can show what was repaired. That information is useful to defenders and maintainers, but may also help someone identify weaknesses in versions still in use. Epoch’s result suggests that an open-weight model can help automate parts of that analysis and attack development in this specific setting.
For users, the practical implication is to install Firefox 159 or a later release and restart the browser, as the source report advises. For software teams, the finding reinforces the value of prompt patch deployment and attention to the time between a fix becoming public and users receiving it. The study does not show that every update can be turned into an exploit, or that the model can attack arbitrary machines.
Popular right now
Breville Barista Touch Impress Espresso Machine, Noir (BES881NRE)
Philips 3300 Series Fully Automatic Espresso Machine with Milk Frother, Grinder, Hot and Iced Coffee Presets, SilentBrew, 15-Bar Pressure (E
Shark Rotator Lift-Away Upright Vacuum with DuoClean PowerFins, Wine Purple, LA702
As an affiliate, we earn on qualifying purchases.
How the Patch Gap Worked
A security fix can expose clues about a bug before every user has installed the version containing the repair. Epoch says it instructed GLM 5.3 to examine fixes not yet in the stable release, then let the model choose bugs and work through its attempts without further human input. The researchers report that it adjusted after crashes and built a multi-stage chain.
In the reported attacks, reading a local file depended on getting past Firefox’s sandbox, which is designed to isolate browser content from files on the computer. The source material says the test ran on Ubuntu 26.04 with default settings and an official Firefox release. It also says the same setup failed against Chrome after about $100,000 in attempts. That result is limited to Epoch’s setup; it does not establish that Chrome is generally immune to this type of work.
Epoch’s claim is about capability demonstrated in a lab: widely available open-weight models can perform much of the work involved in turning public fixes into attacks. The reported results cover six Firefox releases, not all browsers, software, or versions. Epoch also says earlier Firefox versions are likely vulnerable, but it did not systematically test them.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Changes
Epoch had not tested Firefox 159 when the report was published, so it remains unknown whether the same attack chain works against that release or how much the patch changes the model’s ability to find alternatives. The researchers expect the fix to make similar attacks at least substantially more difficult, but that is an expectation, not a reported test result.
The experiment also does not establish how often this method will work outside the tested versions, how reliably other models can reproduce it, or whether equivalent attacks are feasible against other software. The source material says Epoch’s setup failed against Chrome, but gives no basis for treating that single result as a general comparison of browser security. No real-user compromise was reported.
Patch Deployment and Follow-Up Testing
Users who have not updated should move to Firefox 159 or later and restart the browser, following the source report’s advice. Mozilla’s release notes and security advisory are the appropriate places to check the fixes included in that version. Epoch’s next useful step would be testing the patched release and reporting whether the demonstrated chain still works; its report says that testing had not yet happened.
More broadly, the finding will be relevant to security teams tracking how quickly public fixes are followed by automated vulnerability research. The available report does not say whether Mozilla or other browser developers plan changes to their release practices, nor does it document any real-world exploitation connected to the experiment.
Key Questions
What did Epoch AI demonstrate?
Epoch says GLM 5.3 built file-reading attacks against six Firefox releases by analyzing public security fixes. The tests took place in a controlled lab, with no internet access to real targets.
Was this an attack on Firefox users?
No real-user attack was reported. Epoch tested the model in an isolated environment. The report describes a capability experiment, not evidence that users were targeted or compromised.
Which Firefox version includes Mozilla’s fix?
The source report says Mozilla fixed the additional vulnerability used in the tests in Firefox 159, released October 27, 2026. It advises users to install version 159 or later and restart the browser.
Does the test prove that downloadable AI can attack any software?
No. The results cover six specific Firefox releases and one model in Epoch’s testing setup. The researchers’ broader claims about open-weight models should not be read as proof that the method works on every browser or program.
Did Epoch test the attacks against Firefox 159?
Not at the time of publication. Epoch said it expected Mozilla’s fix to make similar attacks at least substantially more difficult, but had not yet confirmed the effect through testing.
Source: ThorstenMeyerAI.com
