An open model built Firefox file-theft exploits across six releases
Epoch AI says GLM 5.3 turned published-but-unshipped fixes into working file-theft pages for six Firefox versions. The key sandbox escape is patched in Firefox 159, and the study did not show arbitrary code execution or a current-version compromise.
The short version
- What happened
- Epoch AI reports that GLM 5.3 autonomously built webpages that stole a local file from each of six Firefox releases issued between 17 September and 26 October, using only information available when each version shipped.
- Who it affects
- For Firefox users, the practical step is to install Firefox 159 or later. The report does not establish an active exploit against the current release.
- What remains unproven
- Institute-authored report, not peer-reviewed or independently replicated; no paper-level funding or competing-interest statement was located.
Keep in mind
Institute-authored report, not peer-reviewed or independently replicated; no paper-level funding or competing-interest statement was located.
Six Firefox releases were targeted in a controlled offline harness, but the report does not publish a complete repeated-attempt denominator for every version.
All successes used a second unpublished sandbox-escape vulnerability that Mozilla has since patched; current Firefox 159 success remains untested.
No arbitrary-code-execution success was reported on recent Firefox, and no equivalent Chrome compromise was achieved in the comparison effort.
Source analysis · 2 linked sources. Primary analysed source date: 29 October 2026. Earliest linked supporting source: 27 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
Public fixes became an attack map
A widely available open-weight model converted security changes that users had not yet received into working browser exploits, according to a new Epoch AI report. Researchers gave GLM 5.3 a Firefox version, an offline copy of public material available at that release date and basic development tools. The model selected relevant fixes, diagnosed crashes and built a webpage that read a local file and sent it to a test server without another click.
The result covered Firefox 156.0 through 158.0.1: six releases between 17 September and 26 October. Runs could continue for up to 48 hours; the fastest reported success took 12 hours. Epoch puts the marginal API cost at about $1,000 per successfully targeted version after spending more than $100,000 building the harness and conducting preliminary work. It does not publish a complete repeated-attempt denominator, so “reliable” should not be read as a measured population success rate.[1]
Update first; the present risk is narrower than the headline
Every successful chain also depended on a separate, previously unpublished sandbox escape that the model rediscovered. Epoch disclosed it to Mozilla, and Mozilla's Firefox 159 advisory of 27 October lists high-impact sandbox and privilege fixes. Epoch says it has not yet tested whether the same attack succeeds on 159. People using Firefox should install the current release, while software teams should reduce the interval between a visible fix and a general update.
The study demonstrates capability, not a known criminal campaign. The model ran without internet access, no third party was targeted, and recent-version attempts did not achieve arbitrary code execution. The team also failed to build an equivalent Chrome exploit despite roughly $100,000 of separate testing. Independent replication, transparent attempt counts and tests across other software would show how general the threat is—and whether faster release cycles materially shrink the window.[1][2]
The distinction that matters
What the experiment did—and did not establish
The six-version result is consequential, but the limits define the immediate advice.
Firefox 156–158
Six releases compromised
A test page could read and exfiltrate a local file
Firefox 159
Relevant fixes shipped 27 October
Epoch has not confirmed the chain still works
Chrome comparison
No equivalent success
About $100,000 spent; failure does not prove immunity