🔍 Read the full analysis: How Epoch AI Showed The Risks Of Downloadable AI Models on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Epoch AI reports that the downloadable, open-weight model GLM 5.3 built working attacks against six Firefox releases by analyzing publicly visible security fixes. The lab tests relied on an additional previously unpublished vulnerability, which Epoch reported to Mozilla and Mozilla patched in Firefox 159; the researchers have not yet tested whether the attacks work against that release.
Epoch AI reported that the open-weight model GLM 5.3 built a working webpage attack against six Firefox releases, using public information about security fixes and a separate, previously unpublished vulnerability. Mozilla fixed that additional flaw in Firefox 159, released October 27, before Epoch’s report appeared October 29; the research was conducted in a controlled lab, not against real users.
In its report, six Epoch AI researchers said they gave the model the task of making a webpage that could read a local file when opened in a specified Firefox version. The test covered releases from Firefox 156.0 through 158.0.1, issued between September 17 and October 26. Epoch said GLM 5.3 succeeded against all six. The fastest attempt took 12 hours; each run had a limit of 48 hours.
The model had access to information public when each release arrived, including changes in Firefox’s public code that pointed to security fixes not yet included in the stable version. Researchers call the time before users install a fix the patch gap. Epoch said the model selected relevant fixes and developed the attack chain without further human input. Once its test setup was built, the researchers estimated API charges at about $1,000 per version; the overall setup and testing cost more than $100,000, according to the report.
The reported attack also depended on a second flaw that had not been publicly disclosed. Epoch said GLM 5.3 rediscovered that vulnerability in each successful run and reported it to Mozilla. Mozilla’s Firefox 159.0 release on October 27 included the fix. Epoch’s described outcome was reading a file from the computer through a webpage, not taking control of the whole machine. The researchers said the lab environment had no internet access, preventing attacks on real websites or users.
Infographic 01 · The patch gap
A published fix is a map. GLM 5.3 read it.
How an open-weight model turned Firefox security fixes into a working attack before the update reached users, in Epoch AI’s offline lab test.
Where the attack happens
The life of a security fix, simplified
- 1 · Fix writtenDevelopers find and fix a security bug
- 2 · Fix visibleThe change shows up in public code and test builds, disguised as an ordinary change. The patch gap opens
- 3 · Update shipsThe fixed version is released to everyone
- 4 · You install and restartOnly now is your browser protected. The gap closes for you
GLM 5.3 worked in step 2: it picked out the security fixes and turned them into a working attack before step 3.
Compromised in Epoch’s test
Released 17 Sep to 26 Oct 2026 · only information public at release
Result: a web page that read a local file and sent it to the attacker’s server when visited. No further user action.
Firefox 159.0 · 27 Oct
Fixes the unpublished flaw every recent success relied on
Epoch expects the fix to make similar attacks “at least substantially more difficult”.
Sources: Epoch AI, 29 Oct 2026; Firefox 159.0 release notes. Lab test without internet access; no real users were attacked. No exploit details are shown here.
Powered by Thorsten Meyer AI
Patch Gaps Become Easier to Exploit
The report’s security concern is not that a model found a way to attack every browser or bypassed every safeguard. It is that a model could turn public clues in software updates into a working attack within hours in a controlled test. Those clues can be available before many users have installed the corresponding update, leaving a period when a vulnerability may be easier to identify and exploit.
Epoch’s findings suggest this capability may not be limited to restricted systems or highly resourced attackers: GLM 5.3 is an open-weight model, meaning its weights are downloadable. That could make similar capabilities more accessible. The report does not establish how often criminals will use such methods, or whether the same results would transfer directly to attacks outside the lab. For users, the immediate practical point is to update Firefox to version 159 or later and restart it, as the source advises. For software makers, the tests underline the value of reducing the time between releasing a security fix and users installing it.
Popular right now
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Dyson Car+Boat Cordless Handheld Vacuum
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
As an affiliate, we earn on qualifying purchases.
How Public Fixes Reveal Weaknesses
When developers publish a security fix, the code change can reveal what was wrong even if the release notes do not spell out the vulnerability. In open-source projects, code changes may be publicly inspectable. Users who have not yet installed the update can remain exposed during the interval Epoch calls the patch gap. The report argues that AI can help automate the work of examining those changes and building an exploit.
Epoch’s test was designed to examine that possibility. Researchers used an Ubuntu 26.04 machine with default settings and an official Firefox release. The model received the target version and basic tools, but no internet access. It was directed to examine fixes that had not reached the stable version and then was allowed to work without additional researcher guidance. According to Epoch, the same setup did not succeed against Chrome after about $100,000 in attempts. That result applies to this particular experiment; it does not establish that Chrome is generally safe from AI-assisted attacks.
Epoch said every successful recent-version attempt combined information from an upcoming fix with a separate flaw that could get the attack past Firefox’s sandbox, a protective boundary intended to limit what a compromised webpage can access. The report says Mozilla fixed that separate vulnerability in version 159. It also says Mozilla’s advisory for that release listed 167 security fixes, but cautions that the count is affected by a change in how Mozilla tallies fixes. The report’s headline characterization of completing an attack in under 48 hours refers to a lab time limit, while the fastest recorded attempt took 12 hours.
““widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Firefox 159 Has Not Been Tested
Epoch said it had not yet tested whether the attack chain works against Firefox 159. Its expectation that the patch will make similar attempts substantially more difficult is a forecast, not a confirmed test result. The report also does not show that GLM 5.3 attacked real users, or establish that attackers have used this method outside the research setting.
The reported results cover six Firefox versions on one stated test configuration. Epoch said earlier releases were likely vulnerable, but did not systematically test them. The failed Chrome work is likewise limited to the team’s particular setup and attempts. The available material does not establish how frequently open-weight models could reproduce the Firefox result under different conditions, or how quickly users and organizations will install the relevant update.
Updates and Follow-Up Testing
Firefox users should install version 159 or later and restart the browser, according to the source material. Epoch’s next relevant step is testing whether the attack still works against the patched release; the researchers had not reported that result as of the October 29 publication. Mozilla’s release addresses the undisclosed flaw Epoch reported, while the broader patch-gap issue remains a subject for security teams and software maintainers.
Further reporting would need to establish whether comparable tests succeed against updated browsers or other software, and whether similar techniques are being used outside controlled research. Until then, Epoch’s results show a demonstrated capability in its lab setup, not a measure of real-world attack rates.
Key Questions
What did Epoch AI report?
Epoch AI said the open-weight model GLM 5.3 built file-reading attacks against six Firefox releases by examining public information about security fixes and using a separate, previously unpublished vulnerability.
Was the attack used against real Firefox users?
No real-user attack is reported in the source material. Epoch said the test ran in a lab without internet access, so it could not target real websites or users.
Did Mozilla fix the vulnerability?
Epoch said it reported the separate, undisclosed flaw to Mozilla, which patched it in Firefox 159.0, released October 27, 2026. Epoch had not yet tested whether the attack works against that version.
What should Firefox users do?
Install Firefox 159 or later and restart the browser, following the advice in the source material.
Does the study show that AI can attack any browser?
No. The reported successes were against six Firefox releases in a specific lab setup. Epoch said its setup failed against Chrome after about $100,000 of attempts, but that does not prove Chrome is immune to AI-assisted attacks.
Source: ThorstenMeyerAI.com
