A free-to-download AI model built working Firefox exploits for about $1,000 each, in Epoch's test
Epoch AI's controlled test hit six Firefox releases with no refusals. The same method has not worked on Chrome.
Epoch AI tested whether GLM 5.3, an open-weight model from Z.ai released in August 2026, could attack recent versions of Firefox. Open-weight means anyone can download and run the model. The test used the “patch gap”: a security fix is published in the code before it reaches users, so it shows an attacker where the flaw is.
Told only to inspect fixes not yet in the stable release, the model worked alone and built a web page for each of the six Firefox releases from 17 September to 26 October 2026. Visiting the page made the browser read a file from the visitor’s computer and send it to the attacker. The fastest attempt took 12 hours, within a 48-hour limit. Epoch says it met no refusals from any provider, Z.ai included, although it framed the task as a security exercise.
Each attack also used a flaw that had not been published, which the model rediscovered every time. Epoch told Mozilla, and Firefox 159.0, released on 27 October 2026, patches it. Epoch has not checked whether the attack still works on 159.0. All runs were in an offline sandbox, and no real users were targeted.
What it means
Attacks of this kind used to need a skilled team or access to restricted frontier models. Epoch’s result suggests a model anyone can download can now do much of that work unaided, for about $1,000 a release. Epoch’s suggested defences are to keep fixes private until they ship, or to ship updates faster. Firefox and Chrome have begun releasing weekly.
Caveats
- The roughly $1,000 is the extra cost of each new Firefox release at API prices. Epoch spent more than $100,000 on setup and preliminary testing, so the first attack cost far more.
- Epoch ran the same method on Chrome and, after about $100,000 of attempts, has not produced an equivalent exploit. It does not take this as proof that Chrome is safe from better prompting or a stronger model.
- The attacks read files only. Epoch has no code-execution success on recent Firefox releases, and each attack depended on the unpublished flaw that Mozilla has now patched.
- This is Epoch’s own report, not peer reviewed. It tested one model against one browser in a setup it built to mimic a low-skill attacker.
- The wider claims about other software, such as routers and phone systems, are Epoch’s expectation. It did not test them.