TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Epoch AI says its offline test used the open-weight model GLM 5.3 to build working file-reading attacks against six Firefox releases, using information available when each version shipped. Mozilla patched a separate, unpublished flaw used in the attacks in Firefox 159, released October 27. The experiment did not target real users, and the researchers say their setup failed against Chrome.
Epoch AI reported on October 29 that the open-weight model GLM 5.3 built working attacks against six successive Firefox releases by analyzing publicly visible security fixes. Mozilla had already patched a separate, unpublished flaw used in the attacks in Firefox 159, released October 27; the research was conducted in an offline lab and did not involve attacks on real users.
Epoch says it tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26, and succeeded against all six versions in that range. The researchers instructed the model to build a webpage that could read a local file when opened in a specified Firefox version. The fastest successful run took 12 hours; Epoch allowed up to 48 hours per attempt. It estimates API costs at about $1,000 for each version after the initial setup, which cost more than $100,000 to build and test.
The model could use public information available at each release, including security changes in Firefox’s public code that had not yet reached stable-version users. Epoch says GLM 5.3 identified relevant fixes, selected bugs, and developed an attack chain without further human input. Each successful attack also relied on a second flaw that had not been publicly disclosed. Epoch reported that flaw to Mozilla, which patched it in Firefox 159. The researchers say the attack read a file; it did not take control of the computer.
Epoch’s report says the test environment ran Ubuntu 26.04 with default settings and an official Firefox release. The model had no internet access, and the setup was designed so it could not reach a real website or person. The researchers also report that the same setup failed against Chrome after about $100,000 in attempts. Epoch says earlier Firefox versions may also be vulnerable, but it did not test them systematically.
Firefox Fixes, Working Attacks, And Downloadable AI: What We Know
Epoch AI says an open-weight model turned public Firefox security fixes into working file-reading attacks in an offline lab. Mozilla patched a separate flaw used in the tests in Firefox 159.
From public fixes to a working chain
In its October 29 report, Epoch AI says GLM 5.3 examined public security changes available when each release shipped, selected relevant bugs, and built a webpage that could read a local file in a specified Firefox version. Researchers say the model completed the work without further human input.
Visible code changes
Public fixes can reveal where a vulnerability was found, even while some users are still running versions that lack the fix.
Build a file-reading page
The model received a Firefox version and basic tools, then worked toward a webpage that could read a local file.
Unpublished vulnerability
Each successful attack also used a second flaw. Epoch reported it to Mozilla, which patched it in Firefox 159.
Public security changes are available for analysis.
GLM 5.3 identifies relevant bugs and selects an attack path.
A webpage is built to read a local file in the target version.
The additional flaw is fixed in Firefox 159.
The patch gap: a race against updates
The patch gap is the time between a fix becoming visible or available and users installing an update. In open-source software, a public code change can offer clues about the bug it addresses. Epoch’s experiment explored how those clues might be used during that interval.
“widely available open-weight models can now do much, or even all, of this work on their own.”— Epoch AI researchers
A controlled result, with clear limits
The report describes a specific model, task, set of versions, and lab environment. It does not establish real-world use or a general ability to exploit other software.
Epoch says it succeeded against six Firefox releases. The environment used Ubuntu 26.04 and an official Firefox release; the model had no internet access and could not reach real sites or people.
The report does not show that GLM 5.3 was used against Firefox users in the wild, or that the method works reliably on other software.
Epoch describes the demonstrated capability as reading a local file. It does not report that the attack took control of the computer.
Epoch says its setup failed against Chrome after about $100,000 in attempts. Roughly $1,000 per Firefox version was its estimate after more than $100,000 in setup work.
“indistinguishable from those of a real attacker”— Epoch AI researchers, describing the model’s actions in the task
Update Firefox and restart
Mozilla’s Firefox 159 release includes the patch for the additional flaw Epoch reported. The researchers say earlier releases may also be vulnerable, but they did not test those versions systematically.
For Firefox users: install version 159 or later, then restart the browser so the update takes effect. Organizations can check that managed devices have completed both steps.
159+ · RestartWhat the report says
What did GLM 5.3 do?
Epoch says it built webpages that could read a local file in six tested Firefox releases, in an offline lab.
Which version has Mozilla’s patch?
Firefox 159, released October 27, 2026. Update to version 159 or later and restart.
Were Firefox users attacked?
The report describes a controlled test and does not say real users were attacked. The environment could not reach real websites or people.
Did the attack take over a computer?
No takeover is reported. The demonstrated task was reading a local file.
Did it work against Chrome?
Epoch says its setup failed after about $100,000 in attempts. That finding is limited to the researchers’ test.
How broad is the conclusion?
The findings concern the tested model, Firefox versions, environment, and task. Broader reliability remains unestablished.
The Risk in Public Fixes
The report highlights how quickly a security fix can become useful to attackers before all users install it. In open-source projects, code changes can reveal where a vulnerability was found. That creates a patch gap: the period after a fix becomes visible but before users receive or install an update. Epoch’s result suggests that an AI model may help turn such clues into a working attack within hours in a controlled test.
The finding does not establish that real attackers have used GLM 5.3 this way, or that the model can reliably exploit other software. It does show why organizations need to apply security updates promptly and why maintainers face pressure to reduce the time between preparing a fix and delivering it. Firefox users should update to version 159 or later and restart the browser.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
How the Patch Gap Works
A browser update may contain a fix for a security bug before every user has installed it. In some projects, the relevant code change is visible publicly; test versions may also include fixes before a stable release. Someone examining those changes may infer what was vulnerable. The interval between a fix becoming available and users applying it is commonly called the patch gap.
Epoch’s test focused on this window. According to the researchers, the model was given the Firefox version and basic tools, along with the public information available when that release appeared. Its task was to find a way for a webpage to read a local file. The researchers describe the work as a lab exercise, while acknowledging that the model’s actions were indistinguishable from those of a real attacker in the task they set.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What the Test Cannot Show
The report describes a controlled experiment, not evidence that users were attacked or that GLM 5.3 has been used against Firefox in the wild. It does not establish how often the method would work outside the researchers’ environment, or whether it would succeed against other browsers and software. Epoch says its Chrome attempts failed and that its earlier-version assessment is not based on systematic testing.
The researchers also do not establish whether the model’s results can be replicated at the same speed and cost by others. Their estimate of roughly $1,000 per Firefox version applies after Epoch’s setup work, which exceeded $100,000. The report’s findings concern the tested model, versions, environment, and task.
Update Firefox and Watch for Follow-Up
Mozilla’s Firefox 159 release on October 27 includes the patch for the additional flaw Epoch reported. Users should install version 159 or later and restart Firefox so the update takes effect. Organizations can check that managed devices have completed both steps.
Further reporting or technical analysis may clarify how the findings apply to other software and whether similar tests can be reproduced. Epoch’s published account does not report attacks against real users. The immediate known development is that Mozilla issued the relevant fix before Epoch’s report appeared.
Key Questions
What did GLM 5.3 do in the test?
Epoch AI says the model built webpages that could read a local file in six tested Firefox releases. The work took place in an offline lab, not against real users.
Which Firefox version contains Mozilla’s patch?
Mozilla patched the additional unpublished flaw in Firefox 159, released October 27, 2026. Users should update to version 159 or later and restart the browser.
Were Firefox users attacked?
The report describes a controlled test and does not say that real Firefox users were attacked. Epoch’s test environment had no internet access and could not reach real websites or people.
Did the attack take over the computer?
No. Epoch describes the demonstrated capability as reading a local file. The report does not say the attack took control of the computer.
Did the same method work against Chrome?
Epoch says its setup failed against Chrome after about $100,000 in attempts. That result applies to the researchers’ test and does not establish how other methods or future models would perform.
Source: Thorsten Meyer AI
