The fix is the clue
Every security fix has to travel. It is written, reviewed, and merged into public code before it reaches the people running the browser. That interval is the patch gap, and it has always been readable in principle. Reading it fast enough to build a working exploit, before the patched release lands, used to take scarce human expertise.
Epoch AI tested whether an open-weight model could use publicly available security-fix information to develop working exploits against six selected Firefox versions. In its controlled environment, the researchers report success against all six. That demonstrates a repeatable exploitation capability under the study's conditions, not evidence that these attacks were deployed against Firefox users in the wild.
GLM 5.3 was given a target version, public information available at that version's release, and a basic instruction to look at fixes that had not yet shipped. Security-relevant changes can appear in public development history without being clearly labeled as vulnerability fixes. Epoch reports that GLM 5.3 identified promising changes, selected targets, diagnosed crashes and revised unsuccessful approaches without further human instructions after the initial task was set.
The end product, in each case, was a webpage that needed nothing but a visit: it read the target file and sent its contents to the attacker's server. This is Epoch AI's patch-gap experiment against real, shipped Firefox releases — a different study from Irregular's simulated cyberattack evaluations of the same model, which ALFW covered on October 29.
Read the $1,000 carefully
The number traveling with this story is $1,000. It is real, and it is not the price of the capability.
Epoch reports spending more than $100,000 on its Firefox research, including preliminary experimentation and development of the testing environment. Once that infrastructure was in place, the reported additional model-compute cost was approximately $1,000 per successfully targeted version. The six-version result suggests that parts of the process can be reused, but it does not establish that future releases will be equally vulnerable, or that another team could reproduce the capability for the same cost.
The successful attacks combined two vulnerabilities. The first, identified through the patch gap, enabled code execution inside Firefox's restricted web-content process. The second was a previously unpublished vulnerability that let the attack bypass sandbox protections and access a local file. Epoch reports no successful arbitrary code execution on the host system against recent Firefox releases. The demonstrated outcome was file exfiltration, which is serious without being equivalent to unrestricted control of the computer.
The second flaw was not in any published fix — the model rediscovered it on each run, which is in some ways the more unsettling half of the finding. Epoch disclosed the previously unpublished vulnerability to Mozilla, which patched it in Firefox 159.0 on October 27. The researchers expect that change to make similar attacks substantially harder, but had not established that Firefox 159.0 was immune to other exploit chains.
Epoch also attempted similar attacks against Google Chrome using the same harness and techniques. After approximately $100,000 in additional API spending, it had not produced an equivalent exploit. The researchers caution that this is not strong evidence Chrome is immune: different methods or more capable models might change the result. Their reference to Kimi K3.1 Pro is forward-looking; that model was not tested in this experiment.
Mozilla is changing the release process, not just the code
Mozilla's October 29 response describes changes intended to reduce the time between a security fix becoming visible and reaching users. The company says Firefox now ships new builds weekly. It has also resumed keeping certain regression tests confidential until the corresponding fixes are released, after observing that GLM 5.3 was less effective at exploiting the patch gap without those tests.
A further measure is planned rather than deployed: Mozilla intends to coordinate fixes across different layers of browser security so their patch gaps do not overlap. The idea is to make it harder for an attacker to combine a renderer vulnerability with a sandbox escape before both fixes reach users. Mozilla says implementing this approach will require engineering coordination and may take time.
Mozilla also says it is scanning all new commits that land in the Firefox codebase, to catch newly introduced bugs before they reach a release. And it credits early access to frontier models from Anthropic and OpenAI for a defensive head start: since February, Mozilla says, it has shipped more than seven times the number of security fixes compared with the same period in 2025.
Epoch's own recommendations point the same way: keep fixes private until they are ready to deploy, move faster from beta to release, avoid patching multiple vulnerabilities at once if they can be chained together, and assume that once a fix is visible in published code, attackers can use it against the current release. Weekly releases narrow the window. They do not close it — an exploit built in 12 hours fits comfortably inside a seven-day cycle.
For a Firefox user, the practical instruction is unglamorous: update to 159.0 or later, and stop treating browser updates as something to postpone. For everyone else, the wider exposure is the software that updates slowly or rarely — Epoch names router firmware and phone operating systems — where the same public-fix problem comes with a much longer gap.
Sources
- [1] Epoch AI, "Open-weight AI models can exploit the patch gap", October 29, 2026 (primary report — read first-hand: GLM 5.3 compromised all six Firefox releases from September 17 to October 26 using only information available at each release; total Firefox research spend exceeded $100,000 in API costs including the offline environment and preliminary testing; marginal cost about $1,000 per version; up to 48 hours allowed, fastest 12 hours; no refusals encountered; chains relied on an unpublished vulnerability the model rediscovered on each attempt, disclosed to Mozilla and patched in Firefox 159.0 on October 27, 2026, with Epoch not yet having confirmed whether similar attacks can succeed on 159.0; Chrome attempts with the same harness failed after about $100,000; Kimi K3.1 Pro was not tested)Read source
- [2] Epoch AI, "AI can turn public security fixes into working exploits before users receive an update", October 30, 2026 (summary of the report)Read source
- [3] Bobby Holley, "Defending the patch gap against automated attackers", The Mozilla Blog, October 29, 2026 (primary response — read first-hand: release cycle cut in half earlier this year so new builds ship weekly; regression tests again kept confidential until after fixes ship, after observing GLM 5.3 is much less effective at patch-gapping without them; new commits scanned for newly introduced bugs; planned grouping of fix classes so patch gaps across layers do not overlap, requiring engineering coordination that may take time; more than seven times the security fixes shipped since February versus the same period in 2025, with early access to frontier models from Anthropic and OpenAI)Read source
- [4] ALFW, "Open-Weight GLM-5.3 Completed 3 of 13 Cyberattack Simulations, Irregular Says", October 29, 2026 (a different study — Irregular's simulated cyberattack evaluations of the same model, not Epoch's patch-gap experiment)Read source