Security patches are meant to make software safer, but Epoch AI has shown they can also work as a to-do list for an attacker. The attacker in this case was an open AI model, GLM 5.3, and it needed between 12 and 48 hours per target. The nonprofit research organisation says the model could read an arbitrary local file from a machine whose owner did nothing more than open a web page.
The setup
Epoch AI researchers built an environment in which GLM 5.3 received two things. One was the exact version of the Firefox browser to attack. The other was access to public code changes that had appeared after that version shipped.
That second item is the interesting one. Fixes land in public repositories before they reach users, so anyone reading the changes can see which holes are being closed while the shipped browser still has them.
What the model did on its own
The source describes the work as autonomous, and the steps were not trivial:
- Spotting the fixes. The model identified which public changes were security patches.
- Choosing targets. It picked out the vulnerabilities worth pursuing.
- Building chains. It assembled multi-step exploit chains rather than relying on a single bug.
- Getting past defences. It bypassed several layers of protection, including the sandbox.
The end result was the ability to read any local file just by having a victim visit a page.
Six for six
The attack worked on all six Firefox releases issued between 17 September and 26 October 2026. Development took the model from 12 to 48 hours each time. In every case it rediscovered and exploited a previously unpublished vulnerability that let it escape the isolated rendering process.
That hole has since been closed. Mozilla was notified, and the fix arrived in Firefox 159.0 on 27 October.
Chrome held, for now
Epoch AI could not reproduce the same attack on Chrome, even after spending around $100,000 on the attempt. That sounds reassuring until you read the researchers' own caveat. A failed attempt does not prove Chrome is safe, and more capable models may get through where this one did not.
The patch gap
Epoch AI's central warning is that the problem is not specific to Firefox. Every browser, and for that matter every project with public code and a release schedule, has a gap between the moment a fix becomes visible and the moment it reaches end users. That might be a public repository or a beta build. Once the fix is visible, an attacker can turn it into a working exploit before the update lands on anyone's machine.
The researchers add a second problem. The model has open weights, which means anyone can strip out its safeguards and run it without restrictions. In their reading, the study shows that advanced cyber capabilities are no longer the property of closed labs.
What Epoch AI asks of developers
The recommendations are two, and both are about timing and packaging rather than new technology:
- Shrink the window. Cut the time between publishing a patch and delivering it to users.
- Avoid bundling. Do not close several vulnerabilities at once if they can be linked into a single chain.
The second point has an uncomfortable edge. A tidy release that fixes related bugs together is a perfectly normal engineering habit, and it is now one a model with a few days to spare can read as a map.
The patch was always going to be public eventually. The open question is how long it sits there, readable by anyone, before the update arrives.