TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
In an offline lab test, Epoch AI researchers used the downloadable open-weight model GLM 5.3 to build working attacks against six Firefox releases by analyzing publicly visible security fixes. The attacks also relied on a second, unpublished flaw that Mozilla patched in Firefox 159; the experiment did not target real users.
Epoch AI researchers say the downloadable open-weight model GLM 5.3 built working attacks against six Firefox releases in an offline test, using public security-fix information and a second, unpublished flaw. The attacks could make the browser read a local file when a user opened a webpage; Mozilla patched the key flaw in Firefox 159, released October 27.
In a report published October 29, six Epoch AI researchers said they tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. GLM 5.3 succeeded against all six. Epoch allowed up to 48 hours for each attempt; the fastest successful run took 12 hours. The researchers estimated marginal API costs of about $1,000 per version after building the test setup, which they said cost more than $100,000.
The model was asked to create a webpage that could read a local file when opened in a specified Firefox version. It had access to public information available when each release appeared, including code changes that revealed security fixes, but had no internet access. Epoch said the chain in each successful test also used an unpublished flaw to get past Firefox’s sandbox, which is designed to isolate browser activity from files on the computer. The model was not tested against people or live systems.
Epoch said it observed no safety refusals from the providers it used, including GLM 5.3’s maker, Z.ai. The researchers described the activity as “indistinguishable from those of a real attacker.” Their test was framed as security research, but that wording describes the model’s actions within the experiment; it does not establish that the model was used against real users.
AI Security · Controlled Lab Test
How An AI Anyone Can Download Turned Firefox Fixes Into Working Attacks
Epoch AI reported that the open-weight model GLM 5.3 built file-reading attacks against six Firefox releases by studying public security fixes and finding a second, unpublished flaw.
01 / What happened
A browser fix became a clue
Epoch asked GLM 5.3 to create a webpage that could read a local file when opened in a specified Firefox version. The model had public information available around each release, including code changes that exposed security fixes, but no internet access. It independently chose bugs and built an attack chain in each successful test.
Visible code changes
Firefox is open source. Public fixes can reveal where a weakness existed before all users install the update.
Two flaws in sequence
The tests used a known security fix plus an unpublished flaw to get past Firefox’s sandbox, which isolates browser activity from local files.
Read a local file
The reported behavior was file reading. Epoch did not report a full computer takeover or data theft from real users.
02 / The test sequence
From patch clues to a working proof
Inspect public fixes
Use information available when each Firefox release appeared.
Select vulnerabilities
Identify bugs that could support a file-reading webpage.
Build the chain
Combine a visible fix with an unpublished sandbox escape flaw.
Report and patch
Epoch reported the unpublished flaw; Mozilla patched it in Firefox 159.
03 / Scope and limits
What the lab results show
| Question | Reported finding | What remains unknown |
|---|---|---|
| Firefox results | Successful in all six tested releases | Earlier versions were not systematically tested. |
| Impact | A webpage could read a local file | No full takeover or real-world data theft was reported. |
| Environment | Offline, controlled lab | Reproducibility across operating systems and configurations is unclear. |
| Other browsers | The setup failed against Chrome after about $100,000 in attempts | This result does not predict performance against other targets. |
| Models | The report tested GLM 5.3 | It does not show that every open-weight model can do the same. |
04 / Timing and cost
The patch gap matters
Cost context: Epoch estimated about $1,000 in marginal API costs per version after building the test setup, which the researchers said cost more than $100,000. These figures describe their setup and are not a universal estimate.
The patch gap is the time between a fix becoming visible and users receiving or applying the update. The experiment suggests a model can help turn public fix information into an attack chain within hours in a controlled setting. It does not establish that Firefox users were attacked.
05 / Recommended response
Update, restart, verify
Install Firefox 159 or later
Restart the browser after updating, following Mozilla’s release guidance.
Check managed devices
Confirm devices received and applied the update across the fleet.
Track follow-up research
Watch for evidence about reproducibility on other software and configurations.
06 / Key questions
What to take away
Were people attacked?
No real users or live systems were reported as targets. The test was offline and controlled.
Did Mozilla fix the flaw?
Epoch said Mozilla patched the unpublished flaw in Firefox 159, released October 27, 2026.
What could the attack do?
Make a webpage read a local file in the specified browser version. The study did not demonstrate a complete computer takeover.
Does this apply to every model?
No. The reported results are specific to GLM 5.3 and Epoch’s test setup; broader performance remains unconfirmed.
The Shorter Window Between Fix and Attack
The results point to a practical risk for software users and maintainers: public fixes can reveal where a weakness existed before every user has installed the update. Security teams call the period between a fix becoming visible and users receiving or applying it the patch gap. Epoch’s experiment suggests an open-weight model can help turn that public information into an attack chain within hours in a controlled setting.
That does not show that attacks on Firefox users occurred. It does show why prompt updates and restarts matter, especially for organizations that manage many devices. The tested attack read a file; Epoch did not report a full takeover of the computer. The possibility that files might include saved passwords, cookies or private documents describes potential exposure, not evidence that such data was taken in this experiment.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
How Firefox Fixes Became Clues
Firefox is an open-source browser, so code changes can be publicly visible. A security fix may appear in a development build or in public code before it reaches the stable release used by most people. That creates a window in which an observer can study what changed and infer the weakness the change addresses. Epoch says GLM 5.3 was instructed to look at fixes not yet present in the stable version and then select bugs and build an attack without further human input.
Epoch said the model rediscovered an unpublished flaw during each successful attempt. It reported that flaw to Mozilla, which patched it in Firefox 159. The researchers also tried their setup against Chrome, where they said it failed after about $100,000 in attempts. That result is specific to their test and does not establish how the model would perform against other browsers, configurations or targets.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
What the Lab Test Cannot Establish
The experiment was conducted in a controlled, offline environment, and Epoch did not report an attack on real users. It remains unclear how often attackers could reproduce the results outside the lab, or how the technique would perform on different operating systems, browser configurations or later Firefox releases. Epoch said earlier Firefox versions were likely vulnerable, but it did not systematically test them.
The reported time and cost are also tied to Epoch’s setup and use of model APIs. The researchers said the setup itself cost more than $100,000, while roughly $1,000 per version was the marginal cost once it existed. The report does not establish that every attacker would face the same costs or achieve the same results.
Update Firefox and Track Follow-Up
Users should update to Firefox 159 or later and restart the browser, following Mozilla’s release guidance. Organizations can check that managed devices have received and applied the update. Mozilla’s patch addresses the key unpublished flaw identified in the report, though the test findings do not by themselves describe the security status of every browser version or system configuration.
Further reporting or research may clarify whether similar tests can be reproduced against other software and how quickly defenders can respond when fixes become public. Epoch’s published findings establish what happened in its Firefox lab test; real-world exploitation and the broader rate of such attacks remain unconfirmed.
Key Questions
What did GLM 5.3 do in the test?
Epoch AI says the model built webpages that could make specified Firefox releases read a local file when opened. The tests took place in an offline lab, not against real users.
Which Firefox versions were tested?
Epoch reported successful attacks against versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1.
Has Mozilla fixed the flaw?
Epoch said Mozilla patched the unpublished flaw used in the attacks in Firefox 159, released October 27, 2026. Users should update and restart Firefox.
Were real users or computers attacked?
The report describes an offline lab test. Epoch did not report attacks on real users. The demonstrated behavior was reading a local file, not taking over the computer.
Does the study show that all open-weight AI models can do this?
No. It reports results for GLM 5.3 in Epoch’s specific setup. The researchers’ broader claim concerns what widely available open-weight models may be able to do; the test does not establish that every model or configuration will produce the same result.
Source: Thorsten Meyer AI
