An open AI model turned Firefox patches into working attacks

Researchers at Epoch AI report that GLM 5.3, an open-weight model from Z.ai, can turn a public security fix into a working attack before most people have updated. The gap between a fix going public and reaching users is called the “patch gap.”

They tested six Firefox releases from versions 156.0 to 158.0.1. Given up to 48 hours per try, the model found the relevant fixes and chained bugs together. The result was a web page that, once visited, read a local file and sent it to the attacker. The fastest success took 12 hours. Epoch puts the marginal cost at about $1,000 per Firefox version at API prices.

Every attack on current versions relied on a bug nobody had reported. Epoch told Mozilla, and Firefox 159.0, released October 27, fixes it. The same setup produced no comparable Chrome exploit after about $100,000 in API costs, though the authors say that does not make Chrome safe.

The catch: The attacks only read files, and the work ran in a controlled test, not against real users. Epoch has not checked whether similar attacks still work on 159.0, though it expects them to be much harder.

What to do now

• Update Firefox to 159.0 or newer, then restart it.
• Turn on automatic browser updates so you are not relying on memory.
• Update your phone and router firmware too. Epoch says slow-updating devices may face the same risk.
• Don’t postpone security updates with “remind me later”.