Free AI model hacked six Firefox versions before users got fixes

A freely available AI model built working attacks on six versions of Firefox, using security fixes that were public before most people had installed them. Researchers at Epoch AI say the model, GLM 5.3, did the work on its own for about $1,000 in fees per successful attack. Mozilla has since fixed the flaw the model kept finding, in Firefox 159.0, released October 27, 2026.

What happened

Software makers often publish a fix in their public code before it reaches users. That window is called the patch gap. The researchers pointed GLM 5.3 at it. After basic instructions, the model found upcoming fixes, picked flaws to target and chained several steps together into a full attack. It worked on six Firefox versions released between September 17 and October 26.

The fastest attack took 12 hours. The researchers allowed the model up to 48. Firefox fixes are often described as routine improvements to avoid tipping off attackers, but the model worked out which changes were security related anyway.

Why it matters

Every successful attack on current Firefox versions used the same flaw, which no one had known about. The model found it again each time. It let the attack get past the sandbox, the wall that keeps a web page away from the rest of your computer, and read files directly from the machine.

The researchers also say neither Z.ai, the maker of the model, nor other providers they used triggered any safety block or refusal. They describe their actions as indistinguishable from someone targeting real users. The setup was meant to resemble what a low-skill attacker with limited money could do.

Who is affected

Firefox users are the first group. The researchers say the same gap exists across the software industry, including browsers, phone operating systems and router firmware. They worry most about things people rarely update, like routers and phones, because users stay exposed longer.

Chrome does not get a clean bill of health. The same approach cost about $100,000 in fees against Chrome and produced no equivalent attack. The researchers say that does not prove Chrome is safe, since better methods or stronger models might still work.

What to do

The alert box above lists the steps. The short version is to update Firefox to 159.0 or later and let your devices install updates automatically.

What is not known yet

The researchers have not confirmed whether similar attacks work on Firefox 159.0. They suspect the fix makes them at least substantially more difficult. They also did not test Kimi K3.1 Pro, a newer model that limited data suggests may do better than GLM 5.3 at offensive tasks.

The team urges software makers to keep fixes private until they are ready to ship and to move them to the public faster. Firefox and Chrome have already started shipping weekly updates. The researchers expect the problem to grow as more capable free models are released.