News · 2026-10-30

Epoch says GLM 5.3 chained public Firefox fixes into local-file access

Epoch AI reports that GLM 5.3 autonomously built exploit chains against six Firefox releases by combining public security-fix clues with a separate unpublished sandbox flaw. In the contained experiment, visiting a test webpage let the attacker read and exfiltrate a local file. Mozilla says Firefox 159 fixed the disclosed flaw, but Epoch had not retested the complete chain against that release.

Key facts

• Epoch published its report on October 29, covering six releases from Firefox 156.0 through 158.0.1.
• Its fastest successful attempt took 12 hours; runs could last up to 48 hours.
• Mozilla shipped Firefox 159 on October 27 with a fix for the unpublished flaw.
• Primary sources: Epoch’s report, Mozilla’s response, and the release advisory.

The research turns a familiar defensive practice into an attacker’s information source. Software fixes often become visible in public development code before the repaired version reaches everyone. A capable model can inspect the difference, infer the vulnerability, and try to exploit a still-unrepaired stable build. Epoch’s headline states the concern directly: “AI can turn security fixes into working exploits before users receive an update.”

This window is called the patch gap. A useful analogy is a building manager publishing a diagram of a repaired lock before replacement locks have reached every door. The diagram helps maintenance teams understand the repair, but it can also tell an intruder what to try on doors still waiting for it. Open development remains valuable; the security problem is how long an actionable clue and a vulnerable installation coexist.

Epoch did more than ask the model to explain a patch. Researchers supplied the target version, tools, historical public information, and an initial direction to inspect fixes. The model then selected vulnerabilities and iterated without further user input. It had no internet access during the experiment. The environment used Ubuntu defaults and official Firefox builds, according to the report. Human preparation and the attack objective were part of the setup, so autonomous does not mean an unsolicited attack that invented its own target.

The exploit crossed two boundaries. Public-but-not-yet-shipped fixes helped the model gain a foothold in the process rendering web content. It then rediscovered an unpublished vulnerability to cross the browser sandbox, which normally restricts access to local files. The demonstration achieved file reading and exfiltration. Epoch says its attempts to obtain arbitrary code execution on recent Firefox did not succeed.

The distinction between the two flaws matters. The patch-gap vulnerabilities already had public fixes; they were not undisclosed zero-days at that point. The separate sandbox flaw was unpublished when found and was disclosed to Mozilla. Describing the entire chain as an unpatched zero-day in current Firefox would erase both the mechanism and the subsequent repair.

Costs also need context. Once the harness existed, Epoch estimated about $1,000 in API charges per successfully compromised version. Its broader Firefox work exceeded $100,000, including environment construction and preliminary experiments. Neither figure is a universal exploit price. A separate Chrome effort using the same approach had not achieved an equivalent result after about $100,000 in API costs, an important limit on broad claims about universal browser compromise.

Mozilla security engineer Bobby Holley supplies the strongest technical counterpoint in Mozilla’s response. Mozilla says its defender-access frontier models are substantially ahead of GLM 5.3 and that extensive earlier reviews have removed much discoverable vulnerability depth. It also describes withholding regression tests until patches ship and coordinating release windows so renderer and sandbox-escape fixes are not simultaneously exploitable. That is a structural defense, although the unpublished second flaw in Epoch’s chain shows why timing alone cannot provide certainty.

GLM 5.3’s weights and license are public, but Epoch used commercial APIs. The dossier provides no verified weight-download size or local graphics-memory requirement, so neither is inferred here; the running requirement is unstated in the reviewed evidence. The experiment therefore raises questions about API safeguards as well as downloadable-model policy. It does not demonstrate that a consumer computer can run the attack model.

The Reddit discussion was small and supplied attention rather than independent replication. The practical response is to keep Firefox updated, while recognizing the remaining verification boundary: a patched component is confirmed, but the complete chain was not independently shown to fail against Firefox 159. More broadly, sandboxing and patch-release coordination become part of the AI security story, alongside the model’s ability to write an exploit.

Primary source, verified: read the paper →

Ground Truth. (2026, October 30). Epoch says GLM 5.3 chained public Firefox fixes into local-file access. Ground Truth. https://groundtruth.day/news/epoch-glm-firefox-patch-gap.html

@misc{groundtruth:epoch-glm-firefox-patch-gap,
  title  = {Epoch says GLM 5.3 chained public Firefox fixes into local-file access},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/epoch-glm-firefox-patch-gap.html}
}

Topics: cybersecurity · ai-security · vulnerabilities · autonomous-agents · patch-management