Mozilla revamps security after AI successfully exploits 6 Firefox releases

A widely available open-weight AI model can turn unshipped Firefox security fixes into working exploits before most users receive the update.

This information was derived from research conducted by Epoch AI. The model, GLM 5.3, is from the Chinese lab Z.ai. It has successfully compromised 6 recent Firefox releases between mid-September and late October.

In each case, it produced a webpage that could read a file from the user’s computer and send it to an attacker with no further required interaction. All the user had to do was simply visit the webpage.

The technique exploits a “patch gap.” That’s the short period between a fix becoming visible in the source code and the moment that a majority of users install the latest update. This short time window is where exploits can occur.

Earlier, this specific window demanded a lot of expertise, and attackers didn’t really bother with it because it wasn’t worth the effort. However, experiments from Epoch show that the barrier isn’t as intense now.

Once the researchers built a suitable testing environment, each successful exploit cost them $1000 in API fees. The model was able to work autonomously while identifying upcoming fixes. It could construct multi-stage exploit chains, sometimes finishing in just 12 hours.

Mozilla was also informed of these findings. In a blog published the same week, Mozilla acknowledged that models like GLM 5.3 can already reverse-engineer some fixes that were originally discovered by more advanced systems. The company noted that it has shipped more security fixes than before in a comparable time frame as well.

To further minimize the risks, Firefox has also moved to weekly release cycles. The company is scanning every new commit for fresh bugs. The browser team also plans to separate the patch gaps required for a full compromise. Since Firefox relies on layered sandboxing, an attacker needs both a renderer exploit and a sandbox escape. By ensuring that only one of these two is exposed in the patch gap, Mozilla forces attackers to discover other vulnerabilities that the existing models haven’t found.

It’s not just open-source projects that are exposed to such risks. Epoch notes that frontier models have demonstrated similar attacks even for closed-source systems like Windows.

The Epoch.ai report is available here.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.