An open model built Firefox file-theft exploits across six releases
Epoch AI says GLM 5.3 turned published-but-unshipped fixes into working file-theft pages for six Firefox versions. The key sandbox escape is patched in Firefox 159, and the study did not show arbitrary code execution or a current-version compromise.
The short version
- What happened
- Epoch AI reports that GLM 5.3 autonomously built webpages that stole a local file from each of six Firefox releases issued between 17 September and 26 October, using only information available when each version shipped.
- Who it affects
- For Firefox users, the practical step is to install Firefox 159 or later. The report does not establish an active exploit against the current release.
- What remains unproven
- Institute-authored report, not peer-reviewed or independently replicated; no paper-level funding or competing-interest statement was located.
Keep in mind
Institute-authored report, not peer-reviewed or independently replicated; no paper-level funding or competing-interest statement was located.
Six Firefox releases were targeted in a controlled offline harness, but the report does not publish a complete repeated-attempt denominator for every version.
All successes used a second unpublished sandbox-escape vulnerability that Mozilla has since patched; current Firefox 159 success remains untested.
No arbitrary-code-execution success was reported on recent Firefox, and no equivalent Chrome compromise was achieved in the comparison effort.
Source analysis · 2 linked sources. Primary analysed source date: 29 October 2026. Earliest linked supporting source: 27 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 4 min The evidence, methods, implications and limitations
Public fixes became an attack map
A widely available open-weight model converted security changes that users had not yet received into working browser exploits, according to a new Epoch AI report. Researchers gave GLM 5.3 a Firefox version, an offline copy of public material available at that release date and basic development tools. The model selected relevant fixes, diagnosed crashes and built a webpage that read a local file and sent it to a test server without another click.
The result covered Firefox 156.0 through 158.0.1: six releases between 17 September and 26 October. Runs could continue for up to 48 hours; the fastest reported success took 12 hours. Epoch puts the marginal API cost at about $1,000 per successfully targeted version after spending more than $100,000 building the harness and conducting preliminary work. It does not publish a complete repeated-attempt denominator, so “reliable” should not be read as a measured population success rate.[1]
Update first; the present risk is narrower than the headline
Every successful chain also depended on a separate, previously unpublished sandbox escape that the model rediscovered. Epoch disclosed it to Mozilla, and Mozilla's Firefox 159 advisory of 27 October lists high-impact sandbox and privilege fixes. Epoch says it has not yet tested whether the same attack succeeds on 159. People using Firefox should install the current release, while software teams should reduce the interval between a visible fix and a general update.
The study demonstrates capability, not a known criminal campaign. The model ran without internet access, no third party was targeted, and recent-version attempts did not achieve arbitrary code execution. The team also failed to build an equivalent Chrome exploit despite roughly $100,000 of separate testing. Independent replication, transparent attempt counts and tests across other software would show how general the threat is—and whether faster release cycles materially shrink the window.[1][2]
The distinction that matters
What the experiment did—and did not establish
The six-version result is consequential, but the limits define the immediate advice.
Firefox 156–158
Six releases compromised
A test page could read and exfiltrate a local file
Firefox 159
Relevant fixes shipped 27 October
Epoch has not confirmed the chain still works
Chrome comparison
No equivalent success
About $100,000 spent; failure does not prove immunity
Continue the story
Read next
Continue exploring cybersecurity: compare the finding and its evidence limits.
An internal Claude model built five exploit chains; the disclosed flaws were patched before publication
Anthropic says its red team used an unreleased model to combine vulnerabilities across Chrome, Safari, Android, Windows and Linux. Vendor advisories confirm shipped fixes, but the programme was company-run and does not measure how often other models or attackers can repeat the work.
Read the next reportExplore the full source and evidence record
What this means for people
- For Firefox users, the practical step is to install Firefox 159 or later. The report does not establish an active exploit against the current release.
- For browser and software teams, a public fix can now become machine-readable attack guidance before a stable update reaches users, increasing the value of shorter release gaps and isolated security work.
Global context
Patch gaps affect open- and closed-source software worldwide. Open-weight models can help defenders inspect public code, but the same unrestricted capability can lower the expertise and cost needed to weaponise a visible fix. Release cadence, automatic updating and disclosure practice vary across browsers, operating systems, routers and regions.
What the evidence does not yet show
- Institute-authored report, not peer-reviewed or independently replicated; no paper-level funding or competing-interest statement was located.
- Six Firefox releases were targeted in a controlled offline harness, but the report does not publish a complete repeated-attempt denominator for every version.
- All successes used a second unpublished sandbox-escape vulnerability that Mozilla has since patched; current Firefox 159 success remains untested.
- No arbitrary-code-execution success was reported on recent Firefox, and no equivalent Chrome compromise was achieved in the comparison effort.
What to watch next
- Independent reproduction with prespecified attempt counts and success criteria
- Tests against Firefox 159 and later releases after coordinated disclosure
- Results across routers, phone operating systems and closed-source beta channels
- Whether weekly browser releases measurably reduce exploitable patch-gap time
- Provider safeguards and monitoring for long-horizon autonomous exploit development
Living evidence record
Impact record IAI-0P2984K
Evidence stage
Observed
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
31 October 2026
Source trail
2 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 2 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 31 October 2026
Research question, topics and regions
Whether a widely available open-weight model can weaponise public security fixes before they reach browser users
Topics: Cybersecurity · Open-weight models · Browser security · Patch management · AI agents · Vulnerability disclosure
Regions: Global · North America · United States · China
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.