Six Browser Versions, One Thousand Dollars Each: What an Open Model Just Did to Browser Security

An Open Model Was Tested Against an Unreleased Firefox Patch. Now What?

“The most dangerous thing about an open model isn’t what it can do. It’s what it knows before you do.”

A good line for a keynote. On 29 October 2026 it stopped being a metaphor. Epoch AI published an experiment in which a downloadable model, GLM 5.3, took Firefox security fixes that were public but not yet shipped to users, and turned six of them into working attacks.

The experiment, stated plainly

The task was to build a webpage that, when a Firefox user visits it, reads a local file and sends it to the attacker. No click. No permission dialog. No second warning.

It worked against every Firefox release shipped between 17 September and 26 October 2026: 156.0, 156.0.1, 157.0, 157.0.1, 158.0, 158.0.1.

The setup is the part most summaries skip, and it is the part that makes the result alarming rather than cinematic. The model had no internet access. Epoch supplied only material that existed on the day each target shipped. The test machine ran Ubuntu 26.04 at default settings with an officially downloaded Firefox. The model got a version number, some basic tools, and up to 48 hours per attempt. Its fastest success took 12. It picked which forthcoming fix looked exploitable, built the chain, diagnosed its own crashes, abandoned dead ends, and kept iterating until a single page visit was enough.

The chain itself matters. Each success paired a flaw that the published patch had made visible with a separate, unpublished sandbox escape, which the model had to rediscover on every attempt. That is not a party trick with a known exploit. It is two pieces of original research, repeated under a deadline.

Then comes the line that belongs at the top of every procurement memo: no provider, including the model’s own developer, refused the work.

What the paper does not claim

Three corrections, because the commentary has already run ahead of the evidence.

This was an offline, sandboxed experiment. No real user was attacked. The researchers obtained file reads, not arbitrary code execution, and they say so plainly. And Mozilla’s fix, shipped in Firefox 159.0 on 27 October and rated high impact in advisory 2026-118, has not been confirmed to defeat the technique. Epoch expects it to raise the bar; expectation is not measurement.

Worth saying too: the model failed against Chrome after roughly $100,000 of attempts. Epoch warns explicitly against reading that as safety. A different harness, a different elicitation, or the next open model could change the answer. Kimi K3.1 Pro, whose weights are due in early November, looks like the next candidate on the limited benchmarks published so far.

The vulnerability is not the model. It is the timing.

Here is the mechanism, stripped of jargon. Three clocks run in every software project: when a fix is written, when that fix becomes visible in public code, and when it lands on a user’s machine. The gap between the second and the third is the patch gap. It is structural, not accidental. Open repositories, beta channels and nightly builds publish tomorrow’s fixes today.

A patch is a confession with coordinates. It says something here was wrong, and here is the shape of the error. Anyone who can read a diff can work backwards toward an exploit. What used to filter that work was time, expertise and the cost of failure. Epoch’s result says the filter is thinning.

The asymmetry compounds

A defender has to close every gap on every machine. An attacker needs one gap on one machine, on one afternoon. That arithmetic is old; what Epoch’s numbers change is who can afford to do the sum. A four-figure line item can be repeated by a contractor, a competitor, or a curious student with a credit card. The defender’s bill scales with the size of the estate. The attacker’s bill does not.

Security teams have seen this shape before

In August, a Chrome flaw now tracked as CVE-2026-85046 was reported, fixed upstream on 7 August, and exploited on 28 August, 27 days before the fix reached Chrome Stable on 3 September. Volexity and Proofpoint documented four espionage-motivated actors adopting the same exploit chain within days of each other.

Nobody blamed a model for that one. That is the point. The technique is old. The new variable is who can run it.

A thousand dollars is the number that changes budgets

Epoch’s total spend on the Firefox work passed $100,000, much of it on building an offline harness convincing enough to be useful. Once the harness existed, compromising a fresh Firefox version cost about $1,000 in API calls. Less on a subscription. Less still for anyone willing to hand an agent live internet access and skip the sandbox.

Now multiply by the thousands of products with the same release habits: phone operating systems, router firmware, the VPN client nobody remembers installing.

Guardrails are a request, not a control

You may be thinking that your provider has safety training. Epoch notes in passing that once weights are published, anyone can produce an abliterated variant that complies with almost anything and run it with no vendor filter in the loop. The model card will not mention this. It will mention benchmarks.

The case for staying calm

Open weights cut both ways, and Epoch is careful to say it makes no claim about the net balance between offense and defense. A model that can build an exploit for $1,000 can also audit a codebase for $1,000. Researchers without frontier access get a tool they could not otherwise afford. The Chrome result suggests real barriers remain.

All of that is true, and none of it is a reason to stay uninformed. Calm is a position you earn by asking questions, not by avoiding them.

Why this lands on marketing and governance desks

Because your stack is full of models you never bought as models. A recommendation engine, a copy assistant, a chat widget, a scoring model bolted onto the CRM. None of those line items came with an offensive-cyber evaluation, and the uptime SLA says nothing about this.

There is a reputational version too. If a tool in your stack is implicated in an incident, the headline will not distinguish between the model vendor and the brand whose page served the exploit. Governance teams are being asked to sign off on systems whose capability profile nobody has measured.

Regulators are still arguing about traffic

Two days after Epoch’s paper, Turkey’s Competition Authority opened an investigation into Google’s AI Overviews and AI Mode and, as reported, ordered interim measures meant to keep publishers from losing ordinary search visibility while the case runs. The theory of harm is familiar: summaries eat publisher traffic, and the terms of use were never negotiated between equals.

It is a serious case. It is also about distribution, not capability. The European Commission’s December 2025 investigation into Google’s use of publisher content for AI training sits in the same family: content, licensing, leverage.

So the capability question will not be settled by statute first. It will be settled by contracts, by buyers who ask and buyers who do not.

Three questions worth putting in writing

One, the red-team report. Not a summary. The harness, the elicitation method, the software versions tested, and the date. A cyber evaluation older than the last patch cycle is decoration.

Two, the disclosure policy. If the model finds a live vulnerability, who gets told, in what order, and within how many hours? Epoch’s model rediscovered an unpublished sandbox escape on every attempt. Assume yours will find something, then ask what happens next.

Three, your own update cadence. How many days sit between a public fix and a patched fleet? For browsers you can measure it. For the router in a warehouse, probably not. That number, not the benchmark, is your exposure.

What responsible open weights could look like by mid-2027

A prediction, offered with low confidence and high specificity.

Cyber evaluations published before release, with dates and methodology attached, the way nutrition labels carry serving sizes. A disclosure norm for capability and not only for bugs: a CVE-like channel where a lab can register what a model can do, against which class of software, without publishing the exploit. Tiered releases, with weights on day one for smaller models and weights delayed for anything that clears a capability threshold. Procurement clauses that treat an undated security evaluation the way auditors treat an unsigned balance sheet.

None of that needs a treaty. It needs buyers to stop accepting vibes.

What to do this week

Inventory the software you cannot patch quickly. That is your real attack surface.

Put patch latency into vendor reviews as a number with a target.

Ask every model vendor for a dated offensive-cyber evaluation. Then ask again.

Separate the pilot from the fleet. A model in a sandbox is a research project. A model wired into production is an asset with a threat model.

Brief the people who write the contracts, not just the people who write the code.

The uncomfortable symmetry

Epoch’s authors are careful, and their care is the most useful thing in the paper. They did not claim a catastrophe. They showed a cost curve bending, and they showed that the vendor side of the market did not intervene.

That is what open means now. Capability and risk arrive in the same file. The only question left is whether you learn what a model can do from a red-team report, or from an incident review.

FAQ

What did GLM 5.3 actually do in the Epoch AI study?
Epoch gave the open-weight model a Firefox version, basic tools and up to 48 hours. The model assembled a chain that read a local file and exfiltrated it when a user simply loaded a webpage, and it succeeded on all six Firefox releases shipped between 17 September and 26 October 2026.

Was this a real attack on Firefox users?
No. The runs were offline and sandboxed, with no internet access, and no real user was targeted. The model was given only information that existed on the day each version shipped.

What exactly is the patch gap?
The interval between a fix becoming public in open code and that fix reaching users through an update. During that window the vulnerability is documented but still live on unpatched machines.

Does Firefox 159.0 close the hole?
Mozilla shipped the sandbox-escape fix on 27 October 2026 in advisory 2026-118, after Epoch disclosed the flaw. Epoch has not confirmed whether the technique still works against 159.0, so treat the fix as a mitigation, not a proof.

What should an enterprise ask before deploying an open-weight model?
Three things: a red-team report with a date, a harness and tested versions; a written policy for disclosing vulnerabilities the model discovers; and your own measured patch latency, because that number defines your exposure.

Is this a reason to avoid open-weight models?
Not on its own. Open weights also give defenders a cheap auditing tool, and Epoch makes no claim about the net balance. The practical answer is dated evidence and fast patching, not abstinence.