TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Epoch AI reported that GLM 5.3 built working file-reading attacks against six Firefox releases in an offline lab test, using public information about security fixes. Mozilla patched a separate, previously unpublished flaw used in the successful attacks in Firefox 159, released October 27, 2026. The experiment did not target real users, and Epoch’s setup failed against Chrome.
Epoch AI reported October 29 that the open-weight model GLM 5.3 built file-reading attacks against six Firefox releases in an offline lab test, using security fixes visible in public code before those fixes reached stable users. Mozilla released Firefox 159 on October 27, patching a separate flaw used in the successful attacks; the test did not involve real users.
Epoch’s researchers tested Firefox releases 156.0 through 158.0.1, spanning September 17 to October 26, 2026. They gave the model up to 48 hours per attempt. The fastest successful run took 12 hours, and Epoch estimated API costs of about $1,000 per version once its testing setup was in place. The researchers said building and testing that setup cost them more than $100,000.
The goal was to make a webpage that could read a local file when opened in a specified Firefox version. According to Epoch, GLM 5.3 identified fixes in public code that had not yet reached stable releases, then developed an attack chain. Each successful attempt also relied on a second flaw that had not been publicly disclosed. Epoch reported that flaw to Mozilla, which patched it in Firefox 159.0.
The experiment ran on Ubuntu 26.04 with default settings and official Firefox releases. Epoch said the machine had no internet access, so the test could not reach real websites or people. The researchers reported no refusals or safeguards from the model providers during their runs. That finding describes this experiment; it does not establish how every model or provider would respond to other requests.
AI × Browser Security · Lab Findings
What Downloadable AI Can Do—and What Comes Next
Epoch AI reported that GLM 5.3 built file-reading attacks against six Firefox releases in an offline lab, using public information about security fixes. Mozilla patched a separate flaw used in successful attacks in Firefox 159.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI researchersThe finding, in context
Report · October 29, 2026Epoch tested official Firefox releases 156.0 through 158.0.1, spanning September 17 to October 26, 2026. Researchers gave GLM 5.3 a target version, basic tools, and public information available when that release appeared, then let it work without further input.
Study the public fixes
The model examined code changes that had not yet reached stable users and selected bugs to investigate.
Assemble an attack chain
Epoch says the model built multi-stage attacks, diagnosed crashes, and abandoned approaches that failed.
Read a local file
Successful runs relied on a second, previously unpublished flaw. The reported result was file access, not computer takeover.
How the patch gap can become an attack path
From disclosure to deploymentIn open-source software, a public fix can reveal what changed before every user has installed an update. Epoch calls the time between a fix becoming public and users applying it the “patch gap.”
A security fix becomes visible in public code or pre-release builds.
Stable installations may still be missing the repair.
GLM 5.3 studies the public changes and searches for vulnerable behavior.
The model develops and tests a chain, according to Epoch’s report.
Mozilla patches the separate flaw in Firefox 159, released October 27.
What the results do—and don’t—show
Evidence boundariesCapability in a controlled lab
Attacks against six specified Firefox releases, with the goal of reading a local file. Epoch ran the test on Ubuntu 26.04 with default settings and official releases.
Real-world use or broad portability
The test had no internet access and involved no real users. It does not establish how often attacks will occur, how easily the method transfers, or the risk to any particular organization.
Chrome resisted this setup
Epoch said the same setup failed against Chrome after about $100,000 in attempts. That result does not prove Chrome cannot be attacked or settle relative security.
One experiment’s observation
Researchers reported no refusals or provider safeguards during their runs. This does not describe every model, request, provider, or later safeguard change.
Bars distinguish reported figures and are not plotted to a shared scale.
What users and defenders can do now
Practical responseUpdate Firefox
Install Firefox 159 or later and restart the browser. Check that the update is applied rather than assuming release means installation.
Review deployment speed
Organizations can assess how quickly browser updates reach devices and how they identify machines that remain on older versions.
Track technical follow-up
Further clarity may come from technical details from Epoch and Mozilla, and from independent reproduction on other software.
Key questions
Quick answersNo. Epoch described an isolated machine without internet access. The report does not establish that users were targeted or data was stolen.
No takeover was reported. The experiment aimed to read a file, which could expose sensitive information, such as cookies or private documents.
According to the source material, Firefox 159.0, released October 27, 2026, patched the separate flaw used in successful attempts. Update to 159 or later and restart.
No. The findings concern one model, target, and lab setup. The Chrome result is limited to Epoch’s attempt and does not settle how the approach performs elsewhere.
Public Patches Can Aid Attackers
The report focuses attention on the interval between a security fix becoming public and users installing an update. In open-source software, code changes can reveal what was repaired before every user has received or applied the fix. Epoch calls this interval the patch gap.
Epoch argues that capable, downloadable models may make it easier to turn that public information into working attacks. If the reported results generalize, defenders could face pressure to distribute fixes and update systems quickly. The lab results do not show how often such attacks will occur in the wild, or how much effort would be needed to adapt the method to other software.
The demonstrated impact was limited to reading a file through Firefox. Epoch said the attack did not take over the computer. The researchers chose file access because it could expose sensitive material, such as browser cookies or private documents, but the report describes a controlled test rather than confirmed data theft.
Products Worth Considering
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
As an affiliate, we earn on qualifying purchases.
How Firefox’s Patch Gap Emerged
Security fixes can become visible before they reach a stable release. Firefox development includes public code, and fixes may also appear in pre-release builds. When details of a repair are available, an attacker can study what changed and look for systems that have not yet received the update. This timing issue predates the study; Epoch’s report examines whether an accessible AI model can help exploit it.
Epoch said it showed GLM 5.3 the target Firefox version and basic tools, along with public information available when that release came out. The researchers instructed it to examine fixes not yet included in the stable release, then let it work without further input. They report that it selected bugs, built a multi-stage chain, diagnosed crashes and abandoned approaches that failed.
The results covered six releases, from 156.0 to 158.0.1. Epoch said it did not systematically test earlier versions, though it assessed that they were likely also vulnerable. In a separate comparison described in the source material, the same setup failed against Chrome after about $100,000 in attempts. That result applies to Epoch’s test setup and should not be read as proof that Chrome cannot be attacked.
““Widely available open-weight models can now do much, or even all, of this work on their own.””
— Epoch AI researchers
Limits of the Lab Results
The report establishes what GLM 5.3 did in Epoch’s controlled environment, but it does not establish that real attackers have used the method against Firefox users. Epoch said the test machine had no internet access and that the attack read a file rather than taking control of the computer.
It is also unclear how quickly comparable attacks could be developed against other browsers or software. Epoch’s setup failed against Chrome after about $100,000 in attempts, but the source material does not provide enough detail to compare the tests or draw a broad conclusion about relative security. The researchers did not systematically test Firefox versions before 156.0.
Epoch reported that no provider safeguards or refusals stopped its attempts. That result is limited to the prompts, model version and conditions used in the study. The report does not show whether providers have since changed safeguards or how those safeguards would perform in different circumstances.
Update Firefox and Track Follow-Up
Firefox users should install version 159 or later and restart the browser, according to the source material. Mozilla’s release on October 27 included the fix for the undisclosed flaw Epoch reported. Users and organizations should check that updates have been applied rather than assuming that a released patch is already installed.
For defenders, the immediate issue raised by the report is the time between public fixes and deployment across devices. Organizations can review how promptly they distribute browser updates and how they track machines that remain on older releases. The experiment does not quantify the real-world risk for any particular organization.
Further clarity may come from technical details published by Epoch and Mozilla, and from whether researchers reproduce similar results on other software. The available source material does not specify a scheduled follow-up study or additional Mozilla announcement.
Key Questions
What did Epoch AI report?
Epoch AI said GLM 5.3 built file-reading attacks against six Firefox releases, from 156.0 to 158.0.1, in an offline lab test. The model used public information about fixes that had not yet reached stable releases.
Were Firefox users attacked in this experiment?
No. Epoch described an isolated test machine without internet access. The report does not establish that real users were targeted or that data was stolen.
Has Mozilla fixed the flaw?
According to the source material, Mozilla patched the separate, previously unpublished flaw used in successful attempts in Firefox 159.0, released October 27, 2026. Users should update to Firefox 159 or later and restart the browser.
Did the attack take over a computer?
No such takeover was reported. Epoch’s test aimed to read a local file. The researchers said this could expose sensitive information, but the demonstrated result described in the source was file access.
Does the report show that AI can attack any browser this way?
No. The findings concern a specific model, target and lab setup. Epoch said its setup failed against Chrome after about $100,000 in attempts, and the source does not establish how the approach would perform against other software.
Source: Thorsten Meyer AI
