Open-weight model exploited Firefox patch gap to read local files
READ THE ORIGINAL SOURCEOpen original sourceepoch.ai · Opens in a new tabEpoch AI reports that GLM 5.3, a widely available open-weight model released by Z.ai in August, used published but unshipped Firefox security fixes to build a webpage that, when visited, read a local file and sent it to an attacker without further user interaction. The researchers say any Firefox release from September 17 to October 26 could be compromised this way, at roughly $1,000 per version after setup. They say they used a setup meant to emulate a relatively unsophisticated attacker, and that Mozilla shipped Firefox 159.0 on October 27 addressing an undisclosed vulnerability the model also used.
One primary source; other links are context, not independent corroboration.
- Primary sourceX discovery · automated brief
- Discovery linkX
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
Open full article view →- Linked article+30
- Fetched source page+30
- No editor link review+0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
Epoch AI reports that GLM 5.3, a widely available open-weight model released by Z.ai in August, used published but unshipped Firefox security fixes to build a webpage that, when visited, read a local file and sent it to an attacker without further user interaction. The researchers say any Firefox release from September 17 to October 26 could be compromised this way, at roughly $1,000 per version after setup. They say they used a setup meant to emulate a relatively unsophisticated attacker, and that Mozilla shipped Firefox 159.0 on October 27 addressing an undisclosed vulnerability the model also used.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: epoch.ai. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
Source claims not independently checked; the experiments were run by the authors in a constructed environment without internet access, and results on Chrome or other models are not established.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- GLM 5.3 built a page that read a local file and exfiltrated it when visited in affected Firefox versions, with no further user interaction.
- All six Firefox releases from September 17 to October 26 were reported as compromisable using only information available at each release.
- Each successful Firefox attack cost about $1,000 after setup, according to the researchers.
- The model used an unpublished vulnerability alongside patch-gap flaws, and Mozilla's 159.0 release reportedly patches that undisclosed vulnerability.
Source claims not independently checked; the experiments were run by the authors in a constructed environment without internet access, and results on Chrome or other models are not established.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
Epoch AI says GLM 5.3, an open-weight model, used a deliberately basic setup to exploit the Firefox patch gap, compromising six recent releases at about $1,000 each using fixes published but not yet shipped. Epoch says it disclosed the findings to Mozilla.
Source claims not independently checked; the experiments were run by the authors in a constructed environment without internet access, and results on Chrome or other models are not established.
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The findings suggest openly available models can lower the expertise and cost needed to exploit the window between a security fix being public and users updating, affecting open-source and possibly closed-source software.
Limits and open questions
Source claims not independently checked; the experiments were run by the authors in a constructed environment without internet access, and results on Chrome or other models are not established.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.