🔍 Read the full analysis: Could AI Make Firefox Security Fixes A Map To Attacks? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI researchers report that the open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing publicly visible security fixes. Mozilla patched a separate, previously unpublished flaw used in the tests in Firefox 159; Epoch has not yet tested whether similar attacks work against that release.
Epoch AI researchers say the open-weight model GLM 5.3 built attacks against six Firefox releases by using security fixes visible in public code before those releases reached users. Mozilla has since patched a separate, previously unpublished vulnerability used in the tests, releasing Firefox 159 on October 27; the study raises concern that AI could shorten the time attackers need to exploit the gap between a fix becoming public and users installing it.
In a report published October 29, six Epoch AI researchers describe tests against Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave the model a task: create a webpage that could read a local file when opened in a specified Firefox version. The researchers say every tested release was compromised. The fastest successful run took 12 hours; each subsequent version cost about $1,000 in API fees once Epoch had built its testing setup.
The model examined public information, including security-related changes in Firefox’s code that had not yet reached the stable release. Researchers call the time before users receive or install a fix the patch gap. Epoch says GLM 5.3 selected fixes, developed attack approaches and adjusted when attempts failed without further human input. The team allowed up to 48 hours for each attempt. Its overall setup and testing cost more than $100,000, according to the report.
Epoch says the successful attacks against recent versions also used a previously unpublished vulnerability that the model rediscovered during each attempt. The researchers reported it to Mozilla, which addressed it in Firefox 159. Epoch says the attacks could read files, but did not amount to taking control of the whole computer. The tests ran in a lab without internet access, so they did not target real users or websites.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
AI Shortens the Patch Gap
The study matters because a security update can reveal clues about the weakness it repairs. In open-source software such as Firefox, code changes may be public before all users have installed the update. A person or tool able to interpret those changes could use them to look for systems that remain unpatched. Epoch’s results suggest that an open-weight model can help automate parts of that work, rather than requiring every step to be done manually by a specialist.
That does not establish that attacks of this kind are happening outside a lab, or that they will work on every browser or computer. But if similar techniques become reliable and cheap, the time available to users and organizations to apply updates could matter more. The researchers’ reported $1,000 per version is a cost after a substantial initial investment in setup and testing, not the full cost of developing the capability.
For Firefox users, the practical step is to update to version 159 or later and restart the browser. For organizations, the report points to patch deployment speed as a security concern: releasing a fix does not protect devices that have not received or installed it.
Popular right now
Shark HydroVac MessMaster Wet/Dry Vacuum & Mop Combo (AW261)
Dreame G10 Pro Wet and Dry Vacuum Mop
iRobot Roomba 105 Combo Robot Vacuum and Mop
As an affiliate, we earn on qualifying purchases.
How Public Fixes Became Clues
Software developers often publish fixes before every user has updated. In Firefox, researchers say, relevant changes could be found in public code, including versions used for testing. Such information is intended to document and repair problems, but it can also help a researcher—or an attacker—identify what earlier versions did wrong. The period between a fix becoming visible and a device being updated is known as the patch gap.
Epoch tested on a machine running Ubuntu 26.04 with default settings and an official Firefox release. The model received the browser version and basic tools, but no internet access. The researchers describe the work as a controlled security exercise and say the model was allowed to operate without input after the initial instruction. These limits matter: the report measures performance in a constrained test, not attacks observed against people using Firefox.
The report also says the same setup failed against Chrome after about $100,000 in attempts. Epoch did not systematically test Firefox versions earlier than 156.0, although it said they were likely vulnerable. Those results do not establish how the model would perform against other browsers, configurations or real-world defenses.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
Firefox 159 Still Needs Testing
Epoch says it has not yet tested Firefox 159 to determine whether similar attacks remain possible after Mozilla’s patch. Its expectation that the fix will make attacks substantially harder is a forecast, not a reported test result. The study also does not show that anyone used GLM 5.3 to attack real Firefox users.
The source report says Mozilla’s Firefox 159 advisory lists 167 security fixes—108 rated high, 52 moderate and seven low—but notes that Mozilla changed its counting method. The available material does not explain that counting change in full, so those figures should not be treated as a direct comparison with earlier advisories. It is also unclear how much the reported performance depends on the specific test environment, the model version or the researchers’ setup.
Update Firefox and Track Testing
Firefox users should install version 159 or later and restart the browser, according to the source report. Organizations should check whether managed devices have received the update, since publishing a fix alone does not close the patch gap on machines that remain on older versions.
The next key evidence would be independent or follow-up testing against Firefox 159 and later releases, along with further detail about the limits of the approach. Epoch’s findings are a report of controlled experiments; they do not by themselves establish how often comparable attacks will occur in the wild. Mozilla’s patch addresses the additional vulnerability disclosed by Epoch, while the broader question of how quickly models can analyze public fixes remains open.
Key Questions
What did GLM 5.3 do in the study?
Epoch AI says the model built webpages that could read local files when opened in six tested Firefox releases, using public information about security fixes. The tests took place in a lab, not against real users.
Does the report mean Firefox 159 is vulnerable?
The source report says Epoch has not yet tested Firefox 159. Mozilla released that version with a fix for the previously unpublished vulnerability used in the reported attacks, but the researchers’ expectation about how much that changes attack difficulty is not a test result.
What is the patch gap?
The patch gap is the period after information about a software fix becomes public but before users have installed the update. Researchers say public Firefox code changes gave the model clues about weaknesses in older releases.
Did the tests show attacks on real Firefox users?
No. Epoch describes a controlled lab test on a machine without internet access. The report does not establish that GLM 5.3 was used to attack people or websites.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, as advised in the source report. The study does not establish that every system running an older release was attacked.
Source: ThorstenMeyerAI.com
