An AI model that anyone can download has turned not-yet-released Firefox security fixes into working attacks on six versions in a row. Given the public information available when each version came out and a few basic tools, it worked out which code changes were security fixes, found the flaws behind them, and built a web page that read files off a visitor's computer as soon as the page loaded. That could be used to read saved passwords and the login cookies that keep people signed in to their email and bank. It was a test in a sealed environment, and Mozilla has since fixed the one unpublished flaw that the attacks leaned on.
The fix itself is the clue
Software makers write a security fix in public code first, so it can be tested, and ship it to users days or weeks later. They disguise the fix as routine cleanup so attackers will not notice it. The model saw through the disguise. In one attempt it spotted a memory flaw from an upcoming fix and learned to read and change the browser's memory, but Firefox's other protections still blocked the file it wanted. So it added several more stages until the page worked. The fastest attack took 12 hours, and the most time it was given was 48.
This goes further than what Anthropic showed in June with its restricted Mythos model, which turned Firefox fixes into working exploits in a lab. Those fixes had been public for at least 90 days. These were still waiting to ship, and the model was one that anyone can use. We reported in September that GLM-5.3 could already build working exploits. This is the same model, pointed at a browser used by over 200 million people, and it worked.
What the old margin was worth
For the Firefox fixes Anthropic studied in the spring, the typical wait between a fix going public and reaching users was 19 days. That was fast, and it was enough when building the attack took skilled people weeks. With a model that needs one or two days, an attacker who starts the day a fix appears has more than two weeks to use it. Once the setup was built, each new Firefox version cost about $1,000 to attack. That is cheap enough for a criminal group to run on every release, and once the setup exists, the person who starts it needs little skill.
The same effort on Chrome, about $100,000 of tries, produced no equivalent attack. Chrome is harder, but nobody has shown it is out of reach, and a stronger open model may already be better at this. Difficulty is a price, and the price keeps falling.
Where the margin is still real
Firefox is close to the best case. It downloads fixes in the background, and installing one takes a restart. The harder cases are the things nobody restarts or updates: a router's firmware, a phone that stopped receiving updates, a tablet running the till. The researchers tested Firefox only, but the patch gap they describe exists in all of these, and these are the devices where users stay exposed longest.
Picture a 15-person accounting firm. The staff's browsers update themselves, but people keep forty tabs open for weeks and never restart, so the fix waits on the disk. The router was installed in 2021 and nobody has logged in to it since. One saved password for the firm's email would be enough for an attacker to read client files.
Neither problem needs an expert. Someone at the firm can own a short list of every device that does not update itself, check it once a month, and tell everyone to restart their browser when it asks. That is about an hour a month, and it closes the part of the gap the firm controls. The vendors are moving too: Firefox and Chrome now ship updates every week. But as long as the fix is public before it ships, speed on the user's side is what is left.