TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Epoch AI reported that open-weight model GLM 5.3 built file-reading attacks against six Firefox releases by analyzing publicly visible fixes before users received the updates. Mozilla fixed a second, previously unpublished flaw used in the attacks in Firefox 159; the work took place in an offline lab, and the researchers did not attack real users.
Six Epoch AI researchers tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave GLM 5.3 the browser version, basic tools and public information available at the time, then allowed it to work without further researcher input. Epoch said the model succeeded against all six releases, with up to 48 hours allowed per attempt and the fastest success taking 12 hours.
The researchers said the model identified fixes in Firefox’s public code that had not yet reached the stable release, then used those clues to find vulnerabilities. Each successful attack also relied on a separate flaw that was not publicly known; Epoch reported that flaw to Mozilla, which patched it in Firefox 159.0. The test asked the model to make a web page read a local file when opened in the targeted browser. Epoch said the setup ran offline on Ubuntu 26.04 with Firefox’s default settings, so it could not target real websites or users.
Epoch estimated API costs at about $1,000 per Firefox version after the testing setup was built. The report says building and testing that setup cost more than $100,000. Those figures describe the researchers’ experiment, not a general estimate for the cost of attacks. Epoch said it encountered no provider refusals or safeguards during the work and described the actions as “indistinguishable from those of a real attacker.”
Security research · October 2026
What Epoch AI Revealed About AI, Firefox Fixes, and Security
An offline test found that open-weight model GLM 5.3 could turn public patch clues into file-reading attacks across six Firefox releases. Mozilla fixed a second, previously unpublished flaw in Firefox 159.
“Indistinguishable from those of a real attacker.”
Epoch AI researchersFirefox 156.0 through 158.0.1
Maximum time allowed per release
Per Firefox version, after setup
Build and test infrastructure
01 / The development
A patch gap became a test target
Epoch AI reported on October 29 that GLM 5.3 built working attacks against six Firefox releases. The model was given a browser version, basic tools, and information publicly visible at the time, then worked without further researcher input.
Fixes surfaced early
Public code and preview fixes revealed details of bugs before corrected versions reached all stable users.
Two flaws combined
Each successful attempt used a bug inferred from an upcoming fix plus a separate, unpublished flaw that bypassed Firefox’s sandbox.
Read a local file
The test asked a web page to read a file on the computer. Local files can contain cookies, passwords, or personal documents.
02 / How the patch gap worked
From visible fix to file read
The “patch gap” is the time between details of a fix becoming visible and users installing the update. Epoch tested that interval in an offline lab on Ubuntu 26.04 with Firefox’s default settings.
Supply the target
Researchers provided a Firefox version and basic tools.
Analyze public fixes
GLM 5.3 studied clues in public code not yet in the stable target.
Build an attack
The model linked an inferred bug with a second unpublished flaw.
Read a local file
The lab page demonstrated file access in all six tested releases.
03 / What the result says
Capability—and its boundaries
Epoch said each of the six releases was successfully attacked. The researchers allowed up to 48 hours per attempt; the fastest success took 12 hours.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
Epoch AI researchers
One browser result does not establish a general attack capability.
Scope of the report
04 / Limits of the lab evidence
What the study did not show
The researchers described a controlled experiment. The published account does not establish real-world exploitation or how often the method might work elsewhere.
- The offline setup could not target real websites or users.
- The study did not demonstrate full computer takeover.
- Chrome resisted the tested setup after about $100,000 in attempts.
- Earlier Firefox versions were described as likely vulnerable, but were not systematically tested.
- The report does not quantify how many users remained on affected versions.
- Epoch reported no provider refusals or safeguards during its experiment.
05 / User action
Update to Firefox 159 or later
Epoch reported the unpublished flaw to Mozilla, which fixed it in Firefox 159.0, released October 27, 2026.
Install the update and restart
Users should install Firefox 159 or later and restart the browser. Organizations should confirm that managed devices have received the release.
06 / Key questions
What to know
What did GLM 5.3 do?
It built web-based attacks that could read a local file in Firefox 156.0 through 158.0.1 during an offline test.
How did it find vulnerabilities?
According to Epoch, the model used public information about fixes not yet in the stable release, alongside a separate unpublished flaw.
Has Mozilla fixed the reported issue?
Yes. Mozilla fixed the unpublished flaw in Firefox 159.0. Update to version 159 or later and restart.
Were real users attacked?
No. Epoch described an offline lab test that could not target real websites or users. The report gives no evidence of real-world attacks.
Public Fixes Can Expose Patch Gaps
The report highlights how security updates can reveal useful clues before every user installs them. When a fix appears in public code or preview releases, attackers may have time to study what changed and target systems that still run the older version. Epoch’s result suggests an openly available model can help carry out that analysis and testing, though this experiment does not show that the same process is being used against people in the wild.
For Firefox users, the direct practical step is to update to version 159 or later and restart the browser. For software makers and organizations, the test underscores the value of shortening the time between publishing a fix and getting it installed across their systems. It also raises questions about whether existing safeguards can detect or limit AI-assisted vulnerability research when a task is framed as legitimate security testing.
Products Worth Considering
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
Logitech MX Keys S Wireless Keyboard, Graphite
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
As an affiliate, we earn on qualifying purchases.
How the Firefox Patch Gap Worked
In software security, the “patch gap” is the period after a fix or its details become visible but before all users have installed the update. Firefox is open source, so code changes can reveal information about corrected bugs. Epoch’s test focused on that interval: it supplied information that was public when each browser version was released, including clues from fixes not yet included in the stable version being tested.
Epoch chose a file-reading objective because, as the researchers explained, local files can contain sensitive material such as saved passwords, login cookies or personal documents. The report says each successful chain combined a vulnerability inferred from an upcoming fix with another flaw that bypassed Firefox’s sandbox. The study did not demonstrate full computer takeover. Epoch also said the same setup failed against Chrome after about $100,000 in attempts, showing that its result was specific to the Firefox targets and method it tested.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Limits of the Lab Evidence
The findings come from a controlled, offline experiment, not evidence that GLM 5.3 attacked real Firefox users or that an attacker has used the same method outside the lab. Epoch said it tested six releases systematically; its claim that earlier versions were “likely also vulnerable” was not based on systematic tests of those versions. The report also does not establish how often this capability will work against other browsers, software, or security setups.
Epoch reported that it received no refusals or safeguards from providers during its experiment, but the report does not establish how model behavior or provider controls might differ in other settings. The published account does not quantify how many users remained on affected versions after Firefox 159 became available. Whether the approach will become common in real attacks remains unknown.
Update to Firefox 159 or Later
Firefox users should install version 159 or later and restart the browser to apply the update. Organizations should check that managed devices have received the release, particularly where browser updates are centrally controlled.
Further developments to watch include whether researchers test the method against additional browsers and whether software providers change how fixes are disclosed or deployed. Epoch’s report describes a successful lab demonstration; it does not say that the researchers found evidence of attacks on users.
Key Questions
What did GLM 5.3 do in Epoch AI’s test?
Epoch said the model built web-based attacks that could read a local file in six Firefox releases, versions 156.0 through 158.0.1. The experiment was conducted offline.
How did the model find the Firefox vulnerabilities?
According to Epoch, GLM 5.3 used information in publicly visible fixes that had not yet reached the stable Firefox release to identify vulnerabilities. Each successful attack also used a separate flaw that had not been published.
Has Mozilla fixed the reported issue?
Epoch said it reported the unpublished flaw to Mozilla, which fixed it in Firefox 159.0, released October 27, 2026. Users should update to version 159 or later and restart the browser.
Did the test show that real users were attacked?
No. Epoch described a controlled offline lab test and said its setup could not target real websites or users. The report does not establish that the method has been used in real-world attacks.
Source: Thorsten Meyer AI
