🔍 Read the full analysis: Epoch AI On Downloadable AI: From Firefox Fixes To Attack Code on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Epoch AI reports that the downloadable, open-weight model GLM 5.3 built working file-reading attacks against six Firefox releases in a controlled test, using public security-fix information and a separate, unpublished flaw. Mozilla fixed that additional flaw in Firefox 159, but Epoch has not tested whether similar attacks work against that version. The experiment shows a potential risk in the time between publishing a fix and users installing it; it was not an attack on real users.
Epoch AI says the downloadable model GLM 5.3 built working attacks against six Firefox releases in a controlled test, using public information about security fixes and a separate, unpublished vulnerability. Mozilla patched that additional flaw in Firefox 159, released October 27; the findings matter because they suggest attackers could use AI to turn visible software fixes into attack paths before users update.
In the experiment described in a report published October 29, Epoch researchers gave GLM 5.3 a task: make a webpage that could read a local file when opened in a specified Firefox version. The model was provided with the browser version and basic tools, but had no internet access. The researchers say it analyzed information available publicly when each release appeared, selected relevant fixes and built an attack chain without further human input.
Epoch reports successful tests against six releases dated September 17 through October 26: Firefox versions 156.0 to 158.0.1. Researchers allowed up to 48 hours for each attempt; the fastest took 12 hours. They estimate API fees at about $1,000 per version after the test setup was built, while developing and testing that setup cost more than $100,000. These are figures reported by Epoch, not independent cost estimates.
The tested attack combined clues in public fixes with an additional flaw that had not been published. Epoch says the model rediscovered that flaw in each successful run and reported it to Mozilla. The researchers characterized the result as a file read, not a takeover of the computer. They say the setup failed against Chrome after about $100,000 in attempts. The study did not test real users or establish that attacks were carried out outside the lab.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
AI and the Firefox Patch Gap
The findings focus attention on the patch gap: the period after a security fix becomes visible but before users install the update. Public fixes help developers and users understand what has been repaired, but they may also give attackers clues about the weakness in older versions. Epoch argues that open-weight models can make analyzing those clues faster and more accessible.
That does not mean every public fix becomes an attack, or that the test proves widespread exploitation. The experiment used a specific browser, target and controlled environment. Still, the reported ability to repeat the process across several releases raises a practical concern for organizations that cannot update promptly: the time to assess and apply security updates may matter as AI tools become more capable.
For Firefox users, the immediate step is to update to version 159 or later and restart the browser, following the source report’s guidance. Mozilla’s release is the relevant response to the flaw Epoch disclosed; the report does not establish that every vulnerability involved in the tests was fixed by that update.
Popular right now
Ninja Foodi 10-Qt DualZone Smart XL Air Fryer, 6-in-1, DZ550
Shark PowerDetect Corded Stick Vacuum, Self-Cleaning (Eggplant, HZ4002)
Ninja Foodi DualZone 10-Qt Air Fryer, 6-in-1, Black (DZ302)
As an affiliate, we earn on qualifying purchases.
How Public Fixes Reveal Weaknesses
Open-source software makes code changes visible to the public. A security fix can therefore reveal information about a bug before all users have installed the corrected release. The interval between the fix becoming available and users updating is commonly called the patch gap. The underlying issue predates this experiment; Epoch’s claim is that a widely available model can now do much of the work needed to exploit it.
Epoch says its test supplied the model with public information and asked it to examine fixes not yet present in the stable release. The model had a limit of 48 hours per attempt and received no live internet access. The researchers report that it diagnosed crashes and changed approaches on its own. The test machine used Ubuntu 26.04, default settings and official Firefox releases, so the results describe that lab setup rather than every operating system or browser configuration.
Mozilla released Firefox 159 on October 27, two days before Epoch’s report. The source material says Mozilla’s advisory listed 167 security fixes, with severity ratings across high, moderate and low categories, while also cautioning that Mozilla had changed its counting approach. Those totals should not be read as a direct measure of the particular attack tested by Epoch.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchers
What Firefox 159 Has Not Settled
Epoch said it had not tested whether similar attacks still work against Firefox 159. The researchers expect Mozilla’s fix to make them substantially more difficult, but that expectation is not the same as a completed test showing that the attack path is closed. The source material also does not establish whether the tested vulnerabilities were exploited against real users.
The results cover six Firefox releases in one specified lab environment. Epoch says earlier versions are likely vulnerable, but they were not systematically tested. The reported failure against Chrome is limited to the researchers’ stated test and spending; it does not show that Chrome or other software is immune. The broader question of how often downloadable models can produce comparable attacks remains open.
The source report says no provider safeguards or refusals stopped the task, including those of model maker Z.ai. That is an account of this experiment and its setup; it does not establish how every provider would respond to different prompts or safeguards in other settings.
Update Firefox and Await Retesting
Firefox users should install version 159 or later and restart, according to the source report. Organizations should check that managed browsers receive the update, while recognizing that the report does not give a separate deployment deadline or describe Mozilla’s plans for further advisories.
The next evidence that would clarify the immediate risk is Epoch’s promised or expected testing of Firefox 159 and any further technical details from the researchers or Mozilla. Until then, the study supports a cautious conclusion: AI-assisted analysis may shorten the time needed to turn public fixes into attacks, but the reported lab result does not show that the same attack succeeds on the patched release or that real users were targeted.
Key Questions
What did Epoch AI report?
Epoch said the downloadable model GLM 5.3 built working file-reading attacks against six Firefox releases in a controlled test, using public information about security fixes and an additional unpublished flaw.
Was this an attack on Firefox users?
No real-user attack is established by the report. Epoch described a lab test with no internet access. It says the demonstrated result could read a local file; it did not take over the computer.
Has Mozilla patched the flaw?
Epoch says it reported the additional unpublished vulnerability to Mozilla, which fixed it in Firefox 159, released October 27, 2026. Epoch had not yet tested whether similar attacks work against that release.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, following the guidance in the source report. Organizations should check that managed installations have received the update.
Does the study show that AI can attack any browser?
No. The study tested specific Firefox releases in a particular lab setup. Epoch reported that its approach failed against Chrome after about $100,000 in attempts, but that result does not establish that other browsers are immune.
Source: ThorstenMeyerAI.com
