TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Epoch AI reported that GLM 5.3, an open-weight model, built a working webpage attack against six Firefox releases in offline lab tests, using security fixes that were already public. Mozilla released Firefox 159 on October 27, patching a previously unpublished flaw used in the successful attacks; the tests did not target real users.
Epoch AI reported October 29 that the open-weight model GLM 5.3 built working webpage attacks against six Firefox releases in offline lab tests, using publicly visible security fixes to help find exploitable weaknesses. Mozilla released Firefox 159 on October 27, patching a separate, previously unpublished flaw the attacks also used; Epoch said the tests did not involve real users.
Epoch’s researchers tested Firefox versions 156.0 through 158.0.1, released between September 17 and October 26. They gave GLM 5.3 a defined task: create a webpage that could read a local file when opened in a specified Firefox version. According to the report, the model succeeded against all six releases. Epoch allowed up to 48 hours for each attempt; the fastest successful run took 12 hours.
The researchers say the model examined security fixes already visible in public Firefox code but not yet included in the stable version used for each test. Such a delay between a fix becoming public and users receiving or installing the update is often called the patch gap. Epoch reported that each successful attack also relied on a second flaw that had not been publicly disclosed. Mozilla patched that flaw in Firefox 159.0, released October 27.
The test ran on Ubuntu 26.04 with default settings and an official Firefox release. Epoch said the model had no internet access, preventing it from contacting real people or websites. The report describes an attack that could read a file, rather than take control of the computer. Epoch’s setup and testing cost more than $100,000; after it was built, the researchers estimated API costs at about $1,000 per Firefox version.
Security research · Firefox · October 2026
Can Downloadable AI Exploit Firefox Fixes?
Epoch AI reports that open-weight model GLM 5.3 built working webpage attacks against six Firefox releases in offline lab tests—using clues in security fixes already visible in public code.
Public fixes can reveal where to look
Epoch’s report describes a risk in the time between a fix becoming public and users receiving or installing the update.
Test window
Firefox 156.0 to 158.0.1
The six tested releases were published between September 17 and October 26, 2026.
Public clues
Fixes in public code
The model examined security changes visible in Firefox code before those fixes were included in the stable version under test.
Separate flaw
An unpublished weakness
Epoch said every successful attack also relied on a second flaw that had not been publicly disclosed at the time.
A defined task, then room for the model to investigate
Researchers supplied a browser version and basic tools. Epoch says GLM 5.3 chose targets and adapted its approach without ongoing human input.
Set the target
Create a webpage that could read a local file in a specified Firefox release.
Inspect likely fixes
Analyze publicly visible code changes for clues about weaknesses.
Build and revise
Try a multi-stage attack, diagnose crashes, and change approaches.
Report the result
Epoch reported success against all six tested Firefox releases.
The patch gap matters
When technical details become public before an update is installed, systems can remain exposed during the interval.
September 17 – October 26
Six releases enter the test range
Epoch tested Firefox versions 156.0 through 158.0.1 in an Ubuntu 26.04 lab using default settings and official releases.
October 27
Firefox 159.0 is released
Mozilla patched the previously unpublished flaw that Epoch said had also been used in the successful attacks.
October 29
Epoch publishes its report
The research group described six successful Firefox tests and said the model had no internet access.
For users and organizations
Install, then restart
Use Firefox 159 or later and restart the browser. Organizations should confirm managed devices have completed the update.
Strong result in a controlled setting; clear limits
These findings describe Epoch’s experiment. They do not establish how often the approach would work in real-world conditions.
Demonstrated
- GLM 5.3 succeeded against six specified Firefox releases in Epoch’s lab.
- The test target was a webpage able to read a local file.
- The model had no internet access, according to Epoch.
- Firefox 159.0 patched the additional flaw cited in the report.
Not established
- That real Firefox users were attacked.
- That the method works against updated Firefox or every configuration.
- How often other attackers or models could reproduce the result.
- That the attack could take over a computer.
“Indistinguishable from those of a real attacker.”
Epoch AI researchers, describing the tested model’s work
One experiment, with a meaningful comparison
Results depend on the model, target versions, tools, and lab conditions used in this specific test.
Chrome comparison
No successful attack reported
Epoch said its setup spent about $100,000 on Chrome attempts without success. That result applies to the described setup and attempts.
Older releases
Not systematically tested
Epoch said older Firefox versions were likely vulnerable, but did not test them systematically. The six successes refer to the releases tested.
Watch next
Advisories and technical detail
Follow Mozilla security advisories and any further technical detail from Epoch. The source material names no scheduled follow-up test.
Quick answers
Were real users attacked?
Epoch described offline lab tests and said the model had no internet access. The source material reports no attacks on real users.
What could the webpage do?
Read a local file in a tested browser version. The report describes file reading, not full computer takeover.
Which version patched the flaw?
Mozilla released Firefox 159.0 on October 27, 2026. Install version 159 or later and restart the browser.
Does this apply to every browser?
No. Epoch reported unsuccessful Chrome attempts after about $100,000. Its results apply to the tested model, releases, and lab conditions.
Public Fixes Can Guide Attacks
The report highlights a practical risk in the period after a software fix becomes public but before users have installed it. Security updates can reveal where a weakness was, even when maintainers disguise a fix as an ordinary code change. Epoch’s finding is that a widely available model could analyze those clues and build a working exploit chain within the time allowed by the test.
That does not establish how often attackers will use this approach or how reliably it would work outside the lab. It does show why the time between a security release and an update matters: users and organizations that delay updates may remain exposed after information about a fix is already available. For individuals, the practical step is to install Firefox 159 or later and restart the browser.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Waterproof, Dustproof, USB‑C, Up to 12 hr Battery, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Amazon Kindle Scribe (32GB) with Premium Pen, Tungsten
As an affiliate, we earn on qualifying purchases.
How the Firefox Tests Worked
Epoch framed its work as a security exercise and set a specific target: a webpage that could read a local file in the tested browser. The researchers supplied the Firefox version and basic tools, then let the model choose which fixes and bugs to investigate. Epoch says GLM 5.3 selected targets, built a multi-stage attack, diagnosed crashes and changed approaches without ongoing human input.
In the report, Epoch said it observed no refusals or safeguards from the providers involved, including model maker Z.ai. That is the research group’s account of its experiment, not evidence that every model or provider would behave the same way under other conditions. Epoch also tried its setup against Chrome, where it reported spending about $100,000 without a successful attack.
Epoch said older Firefox releases were likely vulnerable too, but it did not systematically test them. The report’s six successes therefore refer to the tested releases, not every Firefox version or every user configuration.
“widely available open-weight models can now do much, or even all, of this work on their own”
— Epoch AI researchers
Limits of the Lab Evidence
The test demonstrates what GLM 5.3 did in Epoch’s controlled environment; it does not show that real users were attacked or that the same method would work against current Firefox after the update. Epoch reported six successful Firefox tests, but did not systematically test older releases. The report also does not establish how frequently attackers could reproduce the results, or whether other models would perform similarly.
Epoch’s Chrome attempts did not succeed after about $100,000 in effort, but that result is limited to the setup and attempts described in the report. The researchers’ account of provider safeguards and model behavior likewise reflects this experiment. The source material does not specify whether Mozilla has published further details about the newly patched flaw or confirmed the researchers’ full account.
Update Firefox and Watch Disclosures
Firefox users should install version 159 or later and restart the browser, according to the source material. Organizations should check that managed devices have received the update, since a downloaded update may not take effect until the browser restarts.
The next developments to watch are Mozilla’s security advisories and any further technical details from Epoch about the report and its limits. The source material does not identify a scheduled follow-up test or a further Mozilla announcement.
Key Questions
What did Epoch AI report?
Epoch said GLM 5.3 built working webpage attacks against six Firefox releases in offline tests by analyzing security fixes that were already public.
Were real Firefox users attacked?
The reported work was a lab test. Epoch said the model had no internet access, and the source material does not report attacks on real users.
What did the attack do?
It created a webpage that could read a local file when opened in a tested Firefox version. The report describes file reading, not full computer takeover.
Which Firefox version fixed the flaw?
Mozilla released Firefox 159.0 on October 27, 2026, patching the unpublished flaw Epoch said was used in the successful tests. Users should install version 159 or later and restart the browser.
Does the report show that AI can exploit every browser?
No. Epoch reported that its setup failed against Chrome after about $100,000 in attempts. The results apply to the tested models, versions and lab conditions.
Source: Thorsten Meyer AI
