🔍 Read the full analysis: A Closer Look At Epoch AI’s AI-Powered Firefox Attack Demo on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Epoch AI says the open-weight model GLM 5.3 built a webpage-based file-reading attack against six Firefox releases, using public security-fix information and an unpublished flaw. Mozilla patched that flaw in Firefox 159, but Epoch has not tested whether the attack still works against that release.
Epoch AI says its researchers used the open-weight model GLM 5.3 to build webpage-based attacks that could read a local file on computers running six Firefox releases. The lab tests relied on public information about security fixes, as well as an unpublished vulnerability that Epoch reported to Mozilla; Mozilla patched that flaw in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers said they tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. For each version, the model was given the browser release and basic tools, then asked to build a webpage that could read a local file when opened in that version of Firefox. Epoch said it gave each attempt up to 48 hours; the fastest successful run took 12 hours.
The researchers said the model identified fixes already visible in public Firefox code but not yet included in the stable release. That interval between a fix becoming public and users installing it is known as the patch gap. According to Epoch, GLM 5.3 combined information from those fixes with a separate, unpublished flaw to get past Firefox’s sandbox, which is designed to isolate web content from files on a user’s device.
Epoch reported the unpublished flaw to Mozilla, which fixed it in Firefox 159. The group estimated that, after its initial setup, each tested Firefox version cost about $1,000 in API fees. The researchers said building and testing the setup cost more than $100,000. Epoch also said it encountered no model-provider safeguards or refusals during the work, though the task was framed as a security exercise.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Why Public Fixes Can Aid Attackers
The study highlights a risk in the timing of software updates: a security fix can reveal where a weakness was, while users may still be running the vulnerable version. Epoch’s results suggest that an AI model could help automate parts of the work needed to turn that information into an exploit, potentially shortening the time available for users and organizations to update.
The finding is a lab demonstration, not evidence of attacks on real Firefox users. Epoch said its test environment had no internet access, so the model could not target actual people or websites. The demonstrated impact was reading a local file; the report does not describe the attack as taking over a computer. Still, file access could expose sensitive material, depending on the file and the system.
For users, the practical step is to install Firefox 159 or later and restart the browser, according to the source report. For software maintainers and security teams, the issue is whether public fixes and update delays can be exploited faster as capable models become more accessible. The study does not establish how often that will happen outside controlled tests.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
How the Firefox Tests Worked
Epoch selected a file-reading target because it said that capability could have serious consequences, including exposure of saved passwords, login cookies or private documents. The test machine ran Ubuntu 26.04 with default settings and an official Firefox release. The model was given information that was public when each version appeared, and the researchers instructed it to examine fixes that had not yet reached the stable release.
Epoch said GLM 5.3 selected bugs, built a multi-stage attack chain and adjusted after crashes without researchers guiding each step. The reported successes covered all six releases in the test range. The group said older Firefox versions might also be vulnerable, but it did not systematically test them.
The comparison with Chrome was more limited: Epoch reported that the same setup failed against Chrome after about $100,000 in attempts. That result applies to the particular test and setup described; it does not establish that Chrome is generally immune to similar methods.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What Firefox 159 Has Not Settled
Epoch said it had not tested whether similar attacks work against Firefox 159. Its expectation that the patch makes them substantially more difficult is not the same as a demonstrated result. The study also does not establish whether anyone outside the lab used the method, whether other browsers or operating systems face comparable risks, or how reliably the approach would work under different conditions.
The supplied report says Mozilla’s Firefox 159 advisory listed 167 security fixes, but its discussion of how those fixes were counted is cut off. That figure should not be treated as a direct measure of the number or severity of vulnerabilities relevant to this demonstration. Epoch’s cost estimates also reflect its own setup and API use, not a universal cost for reproducing the work.
Updates and Follow-Up Testing
Mozilla has released Firefox 159 with a fix for the unpublished flaw Epoch reported. Users should update to version 159 or later and restart Firefox, as advised in the source report. Organizations should check that managed browsers have received the update rather than assuming that its release means every device is protected.
The main research milestone to watch for is testing against Firefox 159 and later versions. Epoch has not reported that follow-up result in the supplied material. Further evidence would be needed to determine whether the patch blocks the demonstrated chain, how much work a comparable attack would require after the fix, and whether the lab findings translate into real-world exploitation.
Key Questions
What did Epoch AI demonstrate?
Epoch said GLM 5.3 built webpage-based attacks that could read a local file on six tested Firefox releases. The work took place in a controlled lab, not in attacks on real users.
How did public Firefox fixes help the model?
According to Epoch, the fixes were visible in public code before they reached users on stable releases. The model used that information to identify weaknesses during what security researchers call the patch gap.
Did Mozilla fix the flaw?
Epoch said it reported an additional, unpublished flaw to Mozilla, which patched it in Firefox 159, released October 27, 2026. Epoch had not tested whether similar attacks still work against that version.
Could the demonstrated attack take over a computer?
The source report describes the demonstrated impact as reading a local file, not taking over the computer. The possible consequences depend on what information is in an accessible file.
What should Firefox users do?
Install Firefox 159 or later and restart the browser. The supplied report does not establish that the attack was used against real users.
Source: ThorstenMeyerAI.com
