🔍 Read the full analysis: Epoch AI’s AI Demo Raises Questions About Firefox Fixes on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that the open-weight model GLM 5.3 created working file-reading attacks against six Firefox releases by analyzing security fixes visible before updates reached users. Mozilla patched an additional, previously unpublished flaw used in the tests in Firefox 159, but Epoch has not tested whether comparable attacks work against that release.
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing security fixes that were publicly visible before users received the updates. Mozilla released Firefox 159 on October 27 with a patch for a separate vulnerability used in the tests; Epoch says it has not yet tested the model against that version.
In the lab experiment described in a report published October 29, Epoch gave GLM 5.3 a specific task: create a webpage that could read a local file when opened in a specified Firefox release. The researchers tested versions 156.0 through 158.0.1, released from September 17 to October 26, and say the model produced a working attack for each. The fastest successful run took 12 hours, within a limit of 48 hours for each attempt.
Epoch says the model used security changes already visible in Firefox’s public code before they reached the stable release. Researchers call the delay between a fix becoming public and users installing it the patch gap. According to the report, the model identified relevant fixes and combined them with a second flaw that had not been publicly disclosed. The resulting attack could read a file from the test machine; the report does not say that it took control of the computer.
Epoch estimates that, after its testing setup had been built, each additional Firefox version cost about $1,000 in API fees. The group says developing and testing that setup cost it more than $100,000. It also reports that the model did not refuse the task or trigger safeguards from the providers it tested. These are findings from a controlled experiment, not evidence that real Firefox users were attacked.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
The Risk in Public Security Fixes
The report draws attention to the short period when a software fix can reveal where a weakness was, while some users have not yet installed the update. A model that can analyze those changes and help construct an exploit could make that work accessible to more people, or reduce the time needed to attempt it. Epoch’s results suggest that public patch information can be useful to attackers as well as defenders.
That implication should be kept within the study’s limits. The researchers tested a particular model, target, operating system and attack goal in a lab. They did not demonstrate an attack against people browsing the web, and they did not establish how often this method would succeed outside their setup. Still, the reported speed and repeatability make update timing relevant to individual users and organizations managing many devices.
Epoch says it tried the same setup against Chrome and did not succeed after about $100,000 in attempts. That comparison is specific to the experiment; it does not show that Chrome, or other browsers, are immune to patch-gap attacks. The test also focused on reading files, a serious privacy risk, rather than full device takeover.
Popular right now
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Roborock F25 GT Set Cordless Wet Dry Vacuum Cleaner and Mop with 2 Brushes
As an affiliate, we earn on qualifying purchases.
How the Patch Gap Emerged
Software developers often publish security fixes in source code or release notes before all users have installed the updated version. Open-source projects such as Firefox can expose code changes publicly. Researchers and defenders use that information to understand and address vulnerabilities, but an attacker may also study it to identify what was fixed and look for systems that remain unpatched.
Epoch’s experiment used only information that was public when each tested Firefox version was released, according to the report. The researchers provided the model with the version and basic tools, but no internet access. They say it chose fixes, tried approaches, and adjusted after crashes without further human input. The test machine ran Ubuntu 26.04 with default settings and an official Firefox release.
The model’s reported attacks also depended on a second flaw that Epoch says had not been published. The group reported that issue to Mozilla, which patched it in Firefox 159.0 on October 27. Mozilla’s advisory for the release lists 167 security fixes: 108 rated high, 52 moderate and seven low. The source report cautions that Mozilla’s counting practices changed, so the total should not be read as a direct measure of a rise in vulnerabilities.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI report
What Firefox 159 Changes
Epoch says it has not yet tested whether similar attacks work against Firefox 159. It expects Mozilla’s fix to make them “at least substantially more difficult,” but that is an expectation rather than a reported test result. The available material does not establish whether the attack method can be adapted to other browsers, operating systems or configurations.
The report says versions before 156.0 are likely vulnerable but were not systematically tested. It also does not establish that anyone used the technique against real users. The study’s results depend on its chosen model, target and lab conditions, so the extent to which they generalize remains uncertain.
Update Firefox and Await Testing
Users should install Firefox 159 or later and restart the browser, as advised in the source report. Organizations can check whether managed devices have received the update and continue applying security releases promptly, since unpatched software may remain exposed after fixes become public.
The next useful evidence would be testing of Firefox 159 and further review of whether similar approaches work beyond the versions and setup in Epoch’s study. Mozilla’s release advisory documents the security fixes, while Epoch’s report describes the experiment. Until follow-up results are available, the study supports concern about patch timing but does not establish that current Firefox users are facing an active attack.
Key Questions
What did Epoch AI say GLM 5.3 accomplished?
Epoch reports that GLM 5.3 built a webpage-based file-reading attack for each of six Firefox releases, from 156.0 to 158.0.1, in a controlled lab test.
Were real Firefox users attacked in the experiment?
No. Epoch says the test ran without internet access and could not target real users or websites. The report describes a lab demonstration, not a confirmed real-world attack.
Why does the patch gap matter?
A security fix may become public before every user installs it. Epoch’s experiment suggests that publicly visible code changes can help a model identify weaknesses in versions that have not yet been updated.
Did Mozilla fix the vulnerability used in the tests?
Epoch says it reported a separate, previously unpublished flaw to Mozilla, which patched it in Firefox 159.0, released October 27. Epoch has not yet reported testing whether similar attacks work against that release.
What should Firefox users do now?
Install Firefox 159 or a later release and restart the browser. The source report does not establish that users were targeted, but keeping software updated reduces exposure to known security issues.
Source: ThorstenMeyerAI.com
