Update Firefox: An Open-Weight AI Model Turned Security Fixes Into Working Exploits

Quick Take

• First, update Firefox. Version 159.0, released October 27, patches a flaw used in these attacks, per Epoch AI.
• Epoch says the open-weight model GLM 5.3 built working attacks on all six Firefox releases from September 17 to October 26.
• Each attack cost about $1,000 in API fees once the setup was built, and the model never refused.
• The same approach did not work against Chrome, Epoch reports.

Open Firefox, go to the menu, choose Help, then About Firefox. It will check for updates and install them. Then keep reading.

What Epoch found

Researchers at Epoch AI tested whether a free, widely available AI model could exploit the “patch gap.” That is the window between a security fix showing up in public code and that fix reaching your browser.

Their answer was yes. GLM 5.3, released by Z.ai in August, read upcoming Firefox fixes, worked out which ones were security related, and built an attack around them, Epoch reports. The result was a webpage that could read a file from a visitor’s computer and send it to the attacker. Visiting the page was enough.

Epoch says that kind of access could expose saved passwords and login cookies. Firefox has more than 200 million active users.

The numbers

• Cost: about $1,000 per Firefox version, after more than $100,000 spent building and testing the setup.
• Speed: the model had up to 48 hours. Its fastest success took 12.
• Refusals: none. Epoch framed the work as a security exercise and hit no safeguards from any provider.
• Chrome: about $100,000 of attempts, and no working exploit so far.

One caveat matters. In every attack on the newest versions, the model also found and used a separate bug that had never been published. That bug is the one Firefox 159.0 fixes. Epoch has not yet confirmed whether the method still works on 159.0, but expects it to be much harder.

Mozilla’s response

Mozilla’s own post agrees the threat is real and says it has already acted. Firefox now ships new builds every week. It has gone back to keeping regression tests private until a fix ships, because GLM 5.3 struggled more without them. It also scans every new code change for bugs.

The bigger change is timing. An attack on Firefox usually needs at least two flaws chained together, such as a renderer bug plus a sandbox escape. Mozilla plans to time its fixes so that both kinds are never sitting in the patch gap at once.

Mozilla also says early access to frontier models from Anthropic and OpenAI helped it ship more than seven times as many security fixes as in the same stretch of 2025.

Fact, claim, judgment

Fact: Firefox 159.0 patches a bug Epoch reported, and Mozilla confirms it is changing its release process.

Claim: that the attack is cheap and reliable for a low-skill attacker. That is Epoch’s assessment of its own setup, and Epoch kept the model offline in a sandbox.

Judgment: the scary part is not Firefox. It is everything that updates slowly. Epoch flags routers and phones, where users can run old software for months.

What you can do

Turn on automatic updates for your browser, phone and router. Restart your browser when it asks. The patch gap only helps attackers while you are still running the old version.

Bandwagon Check

Fairly hyped as a careful security result; not overhyped, and if anything underhyped as a warning about patch speed. This is a careful, specific result with a real fix behind it. Cheap open models can now do work that once took skilled specialists, and that changes how fast everyone needs to patch.

Sources

• Epoch AI: AI can turn security fixes into working exploits before users receive an update
• Mozilla: Defending the patch gap against automated attackers

By Willa Ravenwire · AI Bandwagon