$1,000, twelve hours, and a downloadable open-weight model broke Firefox with no human in the loop. Those are the two headline numbers in a report published October 29 by research institute Epoch AI — and they change the cost structure of the classic security problem known as the patch gap.
The experiment
The subject is GLM 5.3, an open-weight model released by Z.ai in August (API on August 14; weights published at the end of August after security review, though the Epoch report only says "August"). Researchers gave the model an offline sandbox, a one-sentence task description, and access to security fixes already merged into Firefox's public repositories but not yet pushed to users. Each version got a 48-hour time limit; the model ran autonomously.
Results: all six Firefox versions released between September 17 and October 26 — 156.0, 156.0.1, 157.0, 157.0.1, 158.0, 158.0.1 — were exploited. The fastest took 12 hours; the marginal cost was roughly $1,000 in API fees per version. The impact was concrete: a user opening one web page let the attacker read local files, including passwords and credentials stored in the browser, with no further clicks.
The patch gap: answers posted, exam still open
When a fix is merged into a public repository, the "answer" is visible to anyone — what changed, why, and how to trigger it — while users don't receive the update until compile, test, and push complete. For decades this window was survivable because turning a diff into a reliable exploit took elite researchers days or weeks. Epoch deliberately framed the experiment as what a resource-constrained, low-skill attacker could do: only information public at each release, commodity API access, no privileged access. All six versions fell.
The attack chain grew itself
In every successful attack across all six versions, GLM 5.3 additionally found and exploited a previously undisclosed vulnerability to escape the sandbox and reach the user's filesystem. The model rediscovered it independently on every attempt while reverse-engineering the patches. Epoch reported it to Mozilla, which fixed it in Firefox 159.0 on October 27.
Mozilla's response: release cadence halved to weekly; regression tests kept confidential until fixes ship (Epoch found the model performed notably worse without them); scanning of every new commit; and an approach still being applied — staggering chained fixes so no full attack chain sits exposed in a window at once.
Three boundaries that keep the panic in scope
- Sandbox self-report, not independent reproduction. Epoch ran everything offline and published its own results; no third party has replicated the full chain. The same method against Chrome cost about $100,000 and produced no equivalent exploit. The report does not confirm the technique still works on 159.0, and its footnotes state no code execution succeeded on recent Firefox versions — only file reads.
- Zero refusals, read carefully. Epoch noted no provider safety system triggered; the behavior was indistinguishable from a real attacker. With open weights, refusal training is trivially strippable — guardrails are politeness, not control.
- The process is affected, not one vendor. Patch gaps exist in browsers, mobile OSes, router firmware; open-source projects are most exposed, but any fix visible before release is in range. Epoch's advice to vendors: keep fixes confidential until release, shrink beta-to-stable time, don't ship chainable fixes together. To users: update promptly.
- Epoch AI: Open-weight models and the patch gap, 2026-10-29
- Mozilla Firefox 159.0 security advisory and Bobby Holley's response, 2026-10-27
- iSec News / AI Insiders / AI & Tech News secondary coverage, 2026-10-30
Mozilla's Bobby Holley acknowledged both sides: patch-gap attacks are a decades-old threat whose barrier of speed and skill models have now removed — but models available to attackers lag the frontier by generations, and the exploitable holes in Firefox have largely already been mined. Both statements are true; reality sits between them.
Fact-check notes on secondhand coverage
This post verified the report line by line. Corrections worth noting: the official title is *AI can turn security fixes into working exploits before users receive an update* ("Open-weight models and the patch gap" is the URL slug); the authors are Aiden Ament, Yafah Edelman, Alexander Barry, Timothée Chauvin, Lee Bousfield, and Jaeho Lee. The $1,000 figure is marginal cost after the toolchain worked — the overall Firefox research exceeded $100,000 including offline setup and pilots. The model was not given internet access; researchers fed it information that was public at each version's release, and the model then ran unassisted. The sandbox-escape bug was re-derived by the model on each attempt, not reproduced by a third party.
Verdict: the report's real conclusion is not "Firefox is insecure" — it is that every day between a fix going public and reaching users must now be calculated as if the attacker is already present. Patch-management SLAs should move from week-level to day-level.
---
Sources: