TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Epoch AI reported that GLM 5.3 built working attacks against six Firefox releases by examining public security fixes before those fixes reached stable users. Mozilla patched a previously unpublished flaw used in the attacks in Firefox 159, released October 27; Epoch says its results came from an offline lab test, not attacks on users.
Research group Epoch AI reported October 29 that the open-weight model GLM 5.3 built working attacks against six Firefox releases, using public security fixes to identify vulnerabilities before they reached stable users. Mozilla has since patched a previously unpublished flaw used in the attacks in Firefox 159, released October 27; Epoch says the work was an offline lab test, not an attack on real users.
Epoch said it tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. In each test, the model was asked to create a webpage that could read a local file when opened in the specified Firefox version. The fastest successful run took 12 hours; each attempt had a limit of 48 hours. Epoch estimated API costs at about $1,000 per version after its testing setup was built, while developing and testing that setup cost more than $100,000.
The model could inspect public information available when each version appeared, including code changes associated with security fixes that had not yet reached stable users. Epoch said GLM 5.3 identified relevant fixes, selected bugs and built attack chains without further human input. Each successful chain also used a flaw that had not been publicly disclosed. Epoch reported that flaw to Mozilla, which patched it in Firefox 159. The researchers said the attacks could read files, but did not take over the computer.
Epoch described the test machine as running Ubuntu 26.04 with default settings and an official Firefox release. It blocked internet access, so the model could not target a real website or person. The researchers said they received no refusals or safeguards from providers during the experiment, including from Z.ai, the model’s maker. That is Epoch’s account of its testing; the report does not establish how the model would behave in other settings.
Security briefing · Firefox · October 2026
What To Do After An AI Turned Firefox Fixes Into Working Attacks
Epoch AI says GLM 5.3 used public security fixes to build file-reading attacks against six Firefox releases in an offline lab. Mozilla patched a previously unpublished flaw used in the tests in Firefox 159.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
Epoch AI · research reportAt a glance
Reported results from a controlled experiment. Epoch says no real users or websites were targeted.
How the patch gap became a clue
Public code changes tied to security fixes can reveal weaknesses before every user has installed the update.
A fix becomes visible
Epoch examined public code changes associated with upcoming Firefox security fixes.
The model investigates
GLM 5.3 selected bugs and explored attack chains using public information and basic tools.
Chains read local files
In each successful test, a webpage could read a file when opened in the targeted release.
Mozilla patches the flaw
Epoch reported a previously unpublished flaw; Mozilla fixed it in Firefox 159.
What the experiment found
The report describes a capable workflow, with clear limits on what the results establish.
Firefox 156 to 158
Epoch reported successful attacks against versions 156.0 through 158.0.1, released from September 17 to October 26.
File reading, not takeover
The attacks could read files in the test setup. Epoch said they did not take over the computer.
Costly setup
Epoch estimated about $1,000 in API costs per version after building its setup, whose development and testing cost more than $100,000.
Why the patch gap matters
A public fix can offer clues while some devices remain unpatched. The interval between disclosure and deployment can therefore become a security concern, especially for organizations managing many devices. Epoch’s result suggests AI may automate parts of vulnerability research; it does not show that every fix can be turned into an exploit.
“Indistinguishable from those of a real attacker”
Epoch AI · describing the attack chainsWhat the lab test cannot show
Keep the findings in context when assessing risk and planning updates.
No reported real-world exploitation
Epoch described an offline Ubuntu 26.04 test machine with default settings and no internet access. The report does not say the attacks were used against people.
Results are experiment-specific
Epoch’s attempts against Chrome failed after about $100,000. That finding applies to its setup and budget; it does not establish that Chrome is immune.
Earlier Firefox versions were not checked systematically
Epoch said older releases were likely vulnerable, but did not systematically test them.
Broader behavior remains unknown
The report does not establish how often attackers will use similar methods, how other models would perform, or how quickly users installed Firefox 159.
Update, restart, verify
Close the gap on the devices you use and manage.
Move to Firefox 159 or later
Mozilla patched the reported flaw in Firefox 159, released October 27, 2026. Install the current update and restart the browser so it takes effect.
Key questions
What the report says—and what it leaves open.
Did GLM 5.3 attack Firefox users?
No real-user attack is reported. Epoch said it ran offline tests without internet access.
Which versions did Epoch test?
Versions 156.0 through 158.0.1. Earlier releases were described as likely vulnerable, but were not systematically tested.
What could the attacks do?
In the test, a webpage could read a file from the computer in a targeted Firefox version. Epoch said the attack did not take over the computer.
Has Mozilla fixed the reported flaw?
Epoch said Mozilla patched the previously unpublished flaw in Firefox 159, released October 27, 2026.
Source: Epoch AI report · as summarized by Thorsten Meyer AI
Why the Patch Gap Matters
Security fixes can reveal where software was vulnerable before all users have installed the update. This interval, often called the patch gap, gives attackers information they can use to look for systems that remain unpatched. Epoch’s findings suggest that an openly available model can help automate parts of that work: the group said GLM 5.3 turned publicly visible fixes into working attacks within hours in its tests.
That raises the stakes for timely updates, especially for organizations managing many devices. The report does not show that GLM 5.3 has attacked Firefox users in the wild, or that every published fix can be converted into an exploit. It does show why organizations should treat the time between a fix becoming public and its deployment as a security concern.
Popular right now
Dyson Car+Boat Cordless Handheld Vacuum
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
As an affiliate, we earn on qualifying purchases.
How Public Fixes Became Clues
Open-source projects can expose code changes before a fix is installed by every user. In Firefox’s case, Epoch said it examined changes associated with upcoming security fixes and used them as clues to the underlying weaknesses. Mozilla disguises security-related changes as ordinary code changes, according to the report, but Epoch’s model still identified useful ones.
The researchers gave the model a specific Firefox version, basic tools and public information, then let it work within a 48-hour limit. Epoch said its setup also failed against Chrome after about $100,000 in attempts. That result is specific to the group’s experiment and does not establish that Chrome is immune to similar methods. Epoch also said earlier Firefox releases were likely vulnerable, but it did not systematically test them.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI
What the Lab Test Cannot Show
Epoch’s results come from a controlled, offline test and do not confirm that the attacks were used against people. The report does not establish how often attackers will use similar methods, whether other models can reproduce the results, or how broadly the approach works across browsers and operating systems. Epoch’s Chrome attempts failed, but that finding is limited to its particular setup and budget.
The researchers did not systematically test Firefox versions before 156.0, describing them as likely vulnerable. The report also does not establish how quickly real users or organizations installed Firefox 159 after its release. Mozilla’s patch addresses the previously unpublished flaw Epoch reported; users should install the current update rather than assume that all versions or configurations have identical exposure.
Update Firefox and Restart
Firefox users should update to version 159 or later and restart the browser, as the source report advises. Organizations should check managed devices and confirm that updates have been applied, particularly where browser updates are centrally controlled or delayed.
Epoch’s report makes the patch gap a practical concern for software teams and users: publicly visible fixes can provide clues before every system is updated. The next useful evidence will be whether further research reproduces these results in other models or software, and whether security teams observe related attacks outside controlled tests. The source material does not report any real-world exploitation tied to this experiment.
Key Questions
Did GLM 5.3 attack Firefox users?
No real-user attack is reported. Epoch said it ran the tests in an offline lab environment without internet access.
Which Firefox versions did Epoch test?
Epoch reported successful attacks against versions 156.0 through 158.0.1. It said earlier releases were likely vulnerable but were not systematically tested.
What did the attacks do?
In the test, a webpage could read a file from the computer when opened in a targeted Firefox version. Epoch said the attack did not take over the computer.
Has Mozilla fixed the reported flaw?
Epoch said it reported a previously unpublished flaw used in the successful attacks, and Mozilla patched it in Firefox 159, released October 27, 2026.
What should Firefox users do?
Update to Firefox 159 or later and restart the browser. Organizations should check that managed devices have received and applied the update.
Source: Thorsten Meyer AI
