AI model exploits Firefox patch gaps in Epoch AI tests

AI · First reported 29 Oct, 21:40 · Updated 23:25

Image: Wikimedia Commons · NASA Johnson Space Center · Public domain

Epoch AI reports that GLM 5.3 produced file-reading exploits against six recent Firefox releases by using publicly available patch information. Mozilla patched a disclosed vulnerability in Firefox 159.0; Epoch did not confirm whether the update prevents similar attacks.

Epoch said GLM 5.3 exploited six Firefox releases from September 17 through October 26, 2026, using information available when each version shipped.
In the tests, visiting a webpage was enough for the exploit to read a local file and send it to an attacker; Epoch said each additional version cost about $1,000 to target after its testing setup was built.
Epoch disclosed an unpublished vulnerability to Mozilla, which released Firefox 159.0 on October 27, 2026. Epoch said it had not confirmed whether that release prevents similar attacks.

Summary written by Lux AI from 2 articlesUnverified

Key facts

Model: GLM 5.3, released by Z.ai in August 2026
Tested releases: Firefox versions 156.0, 156.0.1, 157.0, 157.0.1, 158.0, and 158.0.1
Reported repeat cost: About $1,000 per Firefox version after the testing harness was built
Fastest successful attempt: 12 hours
Mozilla update: Firefox 159.0, released October 27, 2026
Chrome tests: Epoch reported no equivalent exploit after about $100,000 in API costs