Researchers Show an Open Model Can Turn Public Firefox Fixes Into Working Attacks

Epoch AI, a research group that tracks AI progress, ran a worrying experiment. It gave the open-weight model GLM 5.3 from Z.ai a simple job: build a web page that, when someone visits it in Firefox, reads a file from their computer. The model worked on its own, offline, using only what was public on each Firefox version’s release date. It succeeded for six releases, from 156.0 to 158.0.1, shipped between September 17 and October 26.

The trick is the “patch gap”: the window between a security fix becoming visible in public code and that fix reaching everyone’s browser. A fix is also a hint about where the bug was. The model spotted upcoming fixes, picked bugs, and chained several steps together to get around Firefox’s defences. Visiting the page was enough to read a file and send it to an attacker. The fastest success took about 12 hours, with a 48 hour limit per attempt. Once the setup existed, each Firefox version cost about $1,000 in API fees, though total research spending passed $100,000.

There is good news and a list of caveats. The team reported the key unpublished flaw to Mozilla, which fixed it in Firefox 159.0 on October 27, and the researchers have not yet checked whether the attacks still work. They achieved file reading but not full control of the machine. Similar tries against Chrome had not succeeded, but that does not prove Chrome is safe, since better prompts or stronger models might do it. And no provider’s safety filters stepped in, even though the work was framed as security research.

What’s behind it: Defenders have always raced to patch before attackers reverse engineer fixes. What changes is the cost. Work that once took a skilled specialist can now be bought by the hour from a model, and the fix itself becomes the clue. Epoch’s suggestions are practical: keep fixes private until they are ready to ship, move them from test builds to release faster, avoid bundling bugs that could be chained, and update more often. Firefox and Chrome have already started weekly updates. The risk is highest for software people rarely update, like router firmware and phone operating systems.

What this means for you: The best response is boring and effective. Keep your browser, phone and router on automatic updates, and restart when asked, because a pending update is exactly the gap this research is about. You do not need to panic or switch browsers over one study. If you run a small business or look after family devices, treat “update soon” as a real deadline, not a suggestion.

Sources

• Epoch AI: Open-weight models and the patch gap
• The Decoder: Open-weight model GLM 5.3 built full Firefox exploit chains