TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Epoch AI researchers report that the downloadable model GLM 5.3 produced working file-reading attacks against six Firefox releases in an offline lab test, using public security fixes as clues. Mozilla patched a key flaw in Firefox 159, released October 27; the test did not target real users, and the researchers say the attacks did not take over a computer.
Epoch AI researchers say the downloadable AI model GLM 5.3 built working attacks against six Firefox releases by analyzing publicly visible security fixes, in an offline lab test described in a report published October 29. Mozilla released Firefox 159 on October 27 with a patch for a key flaw used in the tests; Epoch says the experiment shows how quickly a fix can help an attacker find weaknesses before users update.
Epoch gave the model a specific task: create a webpage that could read a local file when opened in a specified Firefox version. The researchers say the model succeeded against versions 156.0 through 158.0.1, released between September 17 and October 26. The fastest successful attempt took 12 hours; Epoch allowed up to 48 hours for each attempt. The researchers report that, after they had built the testing setup, each new version cost about $1,000 in API fees. They say development and testing of the setup cost more than $100,000.
The test gave GLM 5.3 public information available when each Firefox version launched, including code changes related to security fixes, but no internet access. According to Epoch, the model identified relevant fixes and constructed an attack chain without further human input. Each successful attack also relied on a second flaw that had not been publicly disclosed, which allowed it to get past Firefox’s sandbox, the mechanism that limits what a compromised webpage can access. Epoch reported that flaw to Mozilla, which patched it in Firefox 159. The test demonstrated file reading; it did not demonstrate full computer takeover.
Epoch says the model did not refuse the task during the experiments, including when the task was framed as a security exercise. The researchers also tried their setup against Chrome, where it failed after about $100,000 in attempts. These are findings from a controlled research environment, not evidence that GLM 5.3 attacked Firefox users in the wild.
AI Security · Firefox · Lab Findings
An AI Anyone Can Download Turned Firefox Fixes Into Working Attacks
Epoch AI reports that downloadable model GLM 5.3 used public security fixes as clues to build file-reading attacks against six Firefox releases in an offline lab. The findings show a possible risk during the time between a public fix and an installed update.
01 / What happened
From public fix to working proof
Epoch published its report October 29, describing offline tests across six consecutive Firefox releases from 156.0 to 158.0.1.
The task
Read a local file
GLM 5.3 was asked to create a webpage that could read a file when opened in a specified Firefox version.
The result
Six releases tested
The model succeeded on versions 156.0 through 158.0.1. Epoch allowed up to 48 hours per attempt.
The boundary
File reading only
The demonstration did not take over a computer or access real users’ files. Tests ran on a controlled machine.
Public code changes
Security-related fixes offered clues about what had changed.
Model analysis
GLM 5.3 identified relevant fixes without internet access.
Attack chain
It built a webpage using an additional, unpublished flaw.
Mozilla patch
Epoch reported the flaw; Mozilla patched it in Firefox 159.
02 / The timing risk
The patch gap can be a short window
Once a fix is public, its code may help reveal the weakness it addresses. Exposure persists until users and organizations install the update.
Update availability is not update completion.
Epoch’s test suggests an AI model may turn public code changes into a working attack within hours under its lab conditions. The study does not measure real-world attack rates or establish how often others could reproduce the result.
03 / Evidence and limits
What the experiment does—and does not—show
The results came from a specific setup and a defined task. Keep the demonstrated capability separate from claims about attacks in the wild.
Demonstrated
Offline capability
The model used public information and basic tools on Ubuntu 26.04 with default settings, without internet access or human input during the attack construction.
Required condition
A second flaw
Each successful Firefox attack also relied on an unpublished flaw that helped bypass the browser sandbox. Mozilla patched it in Firefox 159.
Not established
Real-world reach
Epoch did not report attacks against Firefox users. Earlier Firefox releases were not systematically tested, and the Chrome attempt failed after about $100,000.
04 / What to do now
Close the gap on your devices
Firefox 159 was released October 27, 2026, with the reported patch. Install version 159 or later, then restart the browser.
For individuals
Update and restart
Check that Firefox is at version 159 or later, install available updates, and restart to apply them.
For organizations
Verify installation
Check browser versions across managed devices. A published update protects devices only after it is installed.
For security teams
Track patch timing
Review public security fixes promptly and account for the patch gap while updates are rolling out.
05 / Key questions
Quick answers
Were real Firefox users attacked?
No such attacks were reported. The study describes an offline lab experiment, not access to real users or their files.
Did GLM 5.3 take over a computer?
No. The demonstrated outcome was reading a local file; a full computer takeover was not shown.
Which version includes the patch?
Epoch says Mozilla patched the reported flaw in Firefox 159. Update to version 159 or later and restart.
Did the method work against Chrome?
Epoch’s attempt failed after about $100,000 in attempts. The Firefox result does not establish success against other browsers.
Traceability / The reported chain
A Shorter Window After Fixes
Software fixes can reveal where a vulnerability was, even before every user has installed the update. Epoch’s test suggests that an AI system may be able to use public code changes to turn that information into a working attack within hours. The exposure is greatest during the patch gap: the period after a fix becomes visible but before users and organizations have updated their software.
The results matter to browser users and security teams because the researchers say the model needed no access to secret information to identify the fixes. But the study does not establish how often attackers could reproduce the results outside Epoch’s setup, or how broadly the technique applies. Its Chrome test failed, and the Firefox result depended on an additional unpublished flaw. The report is evidence of a capability in a lab, not a measure of real-world attack rates.
For users, the practical step is to install Firefox 159 or later and restart the browser. For organizations, the report points to the value of applying browser updates promptly, especially when security fixes are public.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
How Public Fixes Reveal Weaknesses
Open-source projects such as Firefox publish code changes that can include security fixes. Those changes may become visible before the corresponding stable update reaches all users. A researcher or attacker who studies a fix can sometimes infer what the old software did incorrectly and look for systems that have not yet received the update. Security practitioners refer to this exposure period as the patch gap.
Epoch says its experiment focused on whether an open-weight model could do more than identify a likely bug: it asked the model to produce a webpage that could read a file on a particular Firefox version. The researchers used a machine running Ubuntu 26.04 with default settings and an official Firefox release. They say the model could use basic tools and information likely to be public, but it could not access the internet or interact with real people or websites.
Epoch says the same setup was tested across six consecutive releases, from Firefox 156.0 to 158.0.1. The researchers describe earlier releases as likely vulnerable but say they did not test them systematically. The Mozilla fix in Firefox 159 followed Epoch’s report of the additional flaw used in successful runs.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Limits of the Lab Results
The report does not show that GLM 5.3 or another actor used these attacks against real Firefox users. Epoch’s test ran offline, on a controlled machine, and measured whether the model could produce a file-reading webpage for specified versions. The findings do not establish how frequently the model would succeed under different systems or settings.
It is also unclear how broadly the result applies to other browsers, software projects, or models. Epoch reports that its attempt against Chrome failed after about $100,000 in attempts, and the tested Firefox attacks required an additional flaw that was not public at the time. The researchers did not systematically test Firefox versions earlier than 156.0. The report describes the flaw as patched in Firefox 159, but users should check that their installed version is 159 or later and restart after updating.
Firefox Updates and Follow-Up
Firefox users can update to version 159 or later and restart the browser to receive the patch described by Epoch. Organizations that manage browsers across many devices will need to check that updates have been installed, rather than relying only on their availability.
Epoch’s report makes the timing of publicly visible fixes a subject for further security research. The available material does not say whether Mozilla plans additional changes to how fixes are disclosed, or whether other researchers have reproduced the results. Further evidence would be needed to establish how often this approach works beyond the six Firefox releases and the specific lab conditions in the report.
Key Questions
What did GLM 5.3 do in the Firefox test?
Epoch AI says the model built webpages that could read a local file when opened in each of six specified Firefox releases, using public information about security fixes as clues.
Were real Firefox users attacked?
The report describes an offline lab experiment. It does not report attacks against real users or show that the model accessed real users’ files.
Which Firefox version includes the reported patch?
Epoch says Mozilla patched the key flaw in Firefox 159, released October 27, 2026. Users should update to version 159 or later and restart the browser.
Did the attacks take over a computer?
No such takeover was demonstrated in the report. The specified result was reading a local file; Epoch says the attacks did not take over the computer.
Did the same method work against Chrome?
Epoch says its setup failed against Chrome after about $100,000 in attempts. The Firefox findings do not establish that the approach works against other browsers.
Source: Thorsten Meyer AI
