TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Epoch AI reported that GLM 5.3 built working attacks against six Firefox releases in an offline lab test, using public security fixes and an additional unpublished flaw. Mozilla patched that flaw in Firefox 159, released October 27. The researchers say the experiment did not target real users; Firefox users should update to version 159 or later.
Epoch AI reported October 29 that the open-weight model GLM 5.3 built working attacks against six Firefox releases in an offline lab test, using public security fixes to identify weaknesses before users had installed updates. Mozilla released Firefox 159 on October 27, patching a previously unpublished flaw used in the successful tests; the researchers say the experiment did not target real users.
Epoch researchers gave GLM 5.3 a specific task: create a webpage that could read a local file when opened in a specified Firefox release. They tested releases 156.0 through 158.0.1, dated September 17 to October 26, and say the model succeeded on all six. The researchers allowed up to 48 hours per attempt; the fastest successful run took 12 hours.
The model could inspect security fixes visible in public Firefox code before those fixes reached the stable release. Epoch said GLM identified the relevant changes and combined them with a second, unpublished flaw that bypassed Firefox’s sandbox. The test machine used Ubuntu 26.04 and an official Firefox release. It had no internet access, so the research setup could not contact real websites or users.
Epoch estimated that, after its testing setup was built, each additional Firefox version cost about $1,000 in API fees. Building and testing the setup cost the group more than $100,000. The researchers said they received no refusals or safeguards from the providers they tried, including GLM 5.3’s maker, Z.ai. Epoch reported the unpublished flaw to Mozilla, which patched it in Firefox 159. The test demonstrated local file reading, not full control of a computer.
Security Research · Firefox · October 2026
When AI Turns Firefox Fixes Into Attacks
TL;DR: Epoch AI reports that GLM 5.3 built working file-reading attacks against six Firefox releases in an offline lab. Mozilla patched an additional unpublished flaw in Firefox 159. The researchers say no real users were targeted. Firefox users should update to version 159 or later and restart.
“Widely available open-weight models can now do much, or even all, of this work on their own.”
Epoch AI · Research report
01 / What happened
From public fix to file read
The experiment studied how publicly visible security changes might help reveal weaknesses before stable users install an update.
Build a webpage attack
Epoch asked GLM 5.3 to create a webpage that could read a local file when opened in a specified Firefox release.
Study visible changes
The model analyzed public Firefox security fixes and combined relevant changes with a second, unpublished flaw that bypassed the sandbox.
Local file access
Epoch reported success on all six selected releases. The demonstrated outcome was reading a local file, not taking control of a computer.
No real users targeted
The test ran on Ubuntu 26.04 with an official Firefox release and no internet access. It could not contact real websites or users.
Mozilla patched the flaw
Mozilla released Firefox 159 on October 27, 2026, patching the unpublished flaw used in the successful tests.
02 / The patch gap
When a fix reveals a weakness
Public fixes can disclose details that help researchers—and potentially attackers—understand what changed.
The period between a security fix becoming available and users applying it. Epoch’s findings suggest models may help automate analysis during this window; they do not show that every public fix can become an attack.
03 / Releases in the test
Six versions, one reported pattern
Epoch said it used information that was public when each tested version appeared. Earlier releases were likely vulnerable, but were not systematically tested.
Slow, expensive work
Researchers allowed up to 48 hours per attempt; the fastest successful run took 12 hours. After the setup was built, Epoch estimated each additional Firefox version cost about $1,000 in API fees.
Chrome attempts failed
Epoch said the same setup failed against Chrome after about $100,000 in attempts. That result describes this experiment; it does not establish that Chrome is immune to other methods.
04 / What the evidence says
Capability is not evidence of deployment
Keep the reported lab result separate from claims about real-world attacks or broader browser security.
Limits of the lab results
The offline test did not target users. It demonstrated local file reading, not full computer control. The reported success rate covers six selected releases, and the researchers did not systematically test older versions. How often public fixes enable usable attacks remains unclear.
“Indistinguishable from those of a real attacker.”
Epoch AI · Characterization of the attacks
Provider safeguards
Epoch said it received no refusals or safeguards from the providers it tried, including GLM 5.3 maker Z.ai. The report does not establish how results would change with internet access or different systems.
05 / Next steps
Update, restart, verify
Epoch’s practical advice is straightforward for Firefox users and organizations managing devices.
Update Firefox
Install Firefox version 159 or later, then restart the browser so the update is active.
Check managed devices
Confirm devices received the update and are no longer running the affected tested releases.
Watch for follow-up
Look for future disclosures from Epoch, Mozilla, or independent security teams. The report specifies no scheduled follow-up test.
06 / Key questions
What to know
What did GLM 5.3 do?
Epoch said it built webpages that could read a local file in each of six tested Firefox releases, using public security changes and an additional unpublished flaw.
Were real users attacked?
The report describes an offline lab experiment. It does not report attacks against real users.
Which release patched the flaw?
Mozilla released Firefox 159 on October 27, 2026. Epoch said it patched the unpublished flaw used in the tests.
Did the test show computer takeover?
No. The demonstrated outcome was reading a local file. The report does not say the model took control of a computer.
When Security Fixes Reveal Weaknesses
The results highlight a race between publishing a fix and users installing it. A security update can expose details about the flaw it corrects. During the patch gap, attackers may study those public changes while some users remain on an older version. Epoch’s test suggests that an open-weight model can automate parts of that work under controlled conditions, potentially reducing the time and expertise needed to turn a fix into an exploit.
That finding does not show that attackers have used GLM 5.3 against Firefox users, or that every public fix can be turned into an attack. It does point to a practical response: users and organizations should apply browser updates promptly, while software makers may need to account for how quickly published changes can be analyzed. For individual Firefox users, Epoch recommends updating to version 159 or later and restarting the browser.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Anker SOLIX C1000 Gen 2 Portable Power Station
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
Firefox Releases in the Test
Firefox is an open-source browser, so its code changes are publicly visible. Epoch said it tested each release using information that was public when that version appeared. The researchers focused on fixes that had reached public code but had not yet reached users of the stable release. Security researchers call the exposure period between a fix becoming available and users applying it the patch gap.
The six tested versions were 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. Epoch said earlier releases were likely also vulnerable, but it did not systematically test them. The report describes a controlled research exercise, not evidence of an active campaign. In a separate effort, the same setup failed against Chrome after about $100,000 in attempts, according to Epoch; that result applies to this experiment and does not establish that Chrome is immune to other methods.
“widely available open-weight models can now do much, or even all, of this work on their own.”
— Epoch AI
Limits of the Lab Results
The report does not establish that GLM 5.3 or another model has used these techniques against real Firefox users. The test environment was offline, and the demonstrated outcome was reading a local file, not taking over a computer. Epoch’s reported success rate covers six selected releases; older versions were not systematically tested.
It also remains unclear how often public fixes will allow models to find usable vulnerabilities, how the results would change with internet access or different systems, and whether model providers will add safeguards. Epoch’s Chrome attempts failed, but the report does not settle the broader security of Chrome or other browsers.
Update Firefox and Monitor Research
Firefox users should install version 159 or later and restart the browser, following Epoch’s advice. Organizations can check that managed devices have received the update and are no longer running affected releases. Mozilla’s reported patch addresses the unpublished flaw used in the tests.
Epoch’s findings may prompt further scrutiny of how quickly AI systems can analyze public security changes. The report does not specify a scheduled follow-up test or additional action from Mozilla. Readers should look for future disclosures from the researchers, Mozilla, or other independent security teams to learn whether similar results hold across more software and environments.
Key Questions
What did GLM 5.3 do in the test?
Epoch AI said the model built webpages that could read a local file in each of six tested Firefox releases, using public security changes and an additional unpublished flaw.
Were real Firefox users attacked?
The report describes an offline lab experiment. It does not report attacks against real users.
Which Firefox version patched the flaw?
Mozilla released Firefox 159 on October 27, 2026. Epoch said that release patched the unpublished flaw used in the successful tests.
What should Firefox users do?
Update to Firefox version 159 or later and restart the browser, as Epoch recommends.
Did the test show that AI can take over a computer?
No. Epoch described the demonstrated outcome as reading a local file. The report does not say the model took control of a computer.
Source: Thorsten Meyer AI
