TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Epoch AI reports that downloadable model GLM 5.3 built working attacks against six Firefox releases in a controlled, offline test, using public security fixes as clues. Mozilla fixed the additional, previously unpublished flaw used in the attacks in Firefox 159, released October 27; the researchers did not test attacks on real users.
Epoch AI reported on October 29 that the downloadable model GLM 5.3 built working attacks against six Firefox releases in an offline lab test, using public security fixes to help identify weaknesses before updates reached users. Mozilla released Firefox 159 on October 27 with a fix for an additional flaw used in the attacks; the study did not involve real-world victims.
Epoch researchers set the model a specific task: create a webpage that could read a local file when opened in a specified Firefox release. They say the model compromised versions 156.0 through 158.0.1, released between September 17 and October 26. The fastest successful run took 12 hours; Epoch allowed up to 48 hours for each attempt. After researchers built the test setup, they estimated API fees at about $1,000 per Firefox version. Building and testing that setup cost more than $100,000, according to the report.
The test used an Ubuntu 26.04 machine with default settings and an official Firefox release. The model had no internet access, and researchers limited it to information public when each version appeared. It selected fixes visible in Firefox’s public code but not yet included in the stable release, then developed an attack. Epoch says each successful attack also relied on a second flaw that had not been publicly disclosed. Mozilla patched that flaw in Firefox 159.0, released October 27.
The demonstrated result was a file read through a webpage, not a takeover of the computer. Epoch says such access could expose browser passwords, login cookies or private documents, but the report describes a controlled lab exercise, not evidence that anyone used this technique against Firefox users. The researchers also say the same setup failed against Chrome after about $100,000 of attempts.
Security briefing · October 29, 2026
A Downloadable AI Turned Firefox Fixes Into Working Attacks. Now What?
Epoch AI reports that GLM 5.3 built file-reading attacks against six Firefox releases in a controlled, offline lab—using public security fixes as clues. Mozilla patched an additional flaw used in the tests in Firefox 159.
Fixes became a roadmap
Epoch says the model examined changes visible in Firefox’s public code but not yet included in stable releases, then developed attacks that also relied on a second, previously unpublished flaw.
Read a local file
Researchers asked for a webpage that could read a local file when opened in a specified Firefox version.
Offline lab setup
Ubuntu 26.04, default settings, and official Firefox releases. The model had no internet access and only contemporaneous public information.
File access, not takeover
The demonstrated outcome was reading a local file through a webpage. The report describes no real-world victims or user attacks.
The patch gap is a race against updates
A public fix can reveal what was broken before every user has installed it. That interval—the patch gap—can give attackers clues while vulnerable devices remain exposed.
From public patch to lab attack
Epoch says the model selected relevant changes, built a multi-stage attack, and adjusted after crashes without step-by-step researcher guidance.
Spot a fix
Inspect public code changes absent from stable Firefox.
Choose a weakness
Use the change as a clue to the underlying issue.
Build and adapt
Develop the attack and adjust after failures.
Read a file
Demonstrate local file access in the controlled test.
What the report establishes—and what it does not
| Question | Reported evidence | Limit |
|---|---|---|
| Firefox results | Six releases tested successfully | Earlier versions were not tested systematically |
| Real-world use | Controlled, offline lab exercise | No evidence users were attacked |
| Other browsers | Same setup failed against Chrome | Does not predict other methods or conditions |
| Broader impact | Local file read demonstrated | Does not establish computer takeover or prevalence |
“Indistinguishable from those of a real attacker”
That is Epoch AI researchers’ characterization of the model’s behavior in this experiment. The report does not establish how often attackers could reproduce the result or whether related flaws remain in untested releases.
Update, restart, verify
Use Firefox 159 or later
Install the update and restart the browser so the fix takes effect.
Check managed devices
Confirm devices received the release and review browser update deployment times.
Track new disclosures
Further research is needed on other software, model safeguards, and untested releases.
Quick answers
Were Firefox users attacked?
The report describes a controlled lab test and provides no evidence of real users being attacked.
Has Mozilla fixed the flaw?
Epoch says Firefox 159.0, released October 27, 2026, patched the additional flaw used in the successful tests.
Does this apply to every browser?
No. The findings concern six Firefox releases under this setup. The reported Chrome attempts failed.
What should users do now?
Update Firefox to version 159 or later, then restart the browser.
The Risk Between Fix and Update
The report highlights a longstanding security exposure called the patch gap: developers may publish a fix before all users receive or install the corresponding update. In open-source software, the change can reveal details about the weakness. Epoch’s test suggests that a widely available model could help turn those clues into a working attack on a short timeline, at least for the Firefox versions and lab conditions it examined.
That matters to users and organizations because installing security updates promptly can shorten the period when a known weakness remains present on devices. For software makers, the findings raise questions about how quickly fixes become usable as clues and how to coordinate disclosures and releases. The study does not establish how often attackers will use AI this way, whether the same results would occur against other software, or whether real-world exploitation has taken place.
Products Worth Considering
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
How Public Fixes Became Clues
Security researchers have long warned that a published patch can help attackers understand what was broken. That risk exists when a fix becomes public before users have updated, including through test builds or visible changes in an open-source project. The period between disclosure and installation is often called the patch gap.
Epoch describes its work as a test of whether an open-weight model could automate parts of that process. It says the model identified relevant changes, selected bugs, built a multi-stage attack and adjusted after crashes without researchers guiding each step. The researchers gave it a basic instruction to examine fixes that had not yet reached stable Firefox. They say the model did not refuse the task or trigger safeguards from the providers they tried, including its maker, Z.ai. That is Epoch’s account of its experiment, not a general finding about every model or deployment.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What the Lab Test Cannot Show
The report does not show that GLM 5.3 or another model attacked real Firefox users, nor does it establish that the technique has been used outside the lab. Epoch tested six releases systematically; it says earlier versions were likely vulnerable but did not test them systematically. The study also does not show whether the result generalizes to other browsers, operating systems or attack goals. Its Chrome attempts failed under the reported setup, but that does not establish how Chrome would fare under other methods or conditions.
Epoch’s reported timings and costs apply to its experiment, including a test setup that took more than $100,000 to build and evaluate. The researchers have not established how commonly attackers could reproduce those results or what defenses would change the outcome. The report says Mozilla fixed the additional flaw in Firefox 159; it does not establish whether any older, untested Firefox releases remain exposed to related issues.
Update Firefox and Track Follow-Up
Mozilla’s Firefox 159.0 release on October 27 includes the patch for the additional flaw described by Epoch. Users should update to Firefox 159 or later and restart the browser to apply the update. Organizations can check that managed devices have received the release and review how quickly they deploy browser security updates.
Further assessment will depend on research and disclosures beyond this lab report: whether similar methods work against other software, how models and safeguards respond to comparable requests, and whether any related flaws are found in untested releases. Epoch’s published results do not answer those questions.
Key Questions
What did GLM 5.3 do in the test?
Epoch AI says the model built webpages that could read a local file when opened in six tested Firefox releases, using public security fixes as clues. The researchers ran the exercise offline in a lab.
Were Firefox users attacked?
The report describes a controlled test and does not provide evidence that real users were attacked. Epoch’s setup had no internet access, so it could not target real websites or people.
Has Mozilla fixed the flaw?
Epoch says Mozilla patched the additional, previously unpublished flaw used in the successful tests in Firefox 159.0, released October 27, 2026.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser so the update takes effect.
Does the report show that AI can attack every browser?
No. Epoch tested six Firefox releases and says the same setup failed against Chrome after about $100,000 of attempts. The findings do not establish how the method would perform against other browsers or under different conditions.
Source: Thorsten Meyer AI
