The trick: Lab Not Field
Epoch AI says an open-weight model broke six Firefox releases for about $1,000 each.
That is the cost per version after a build that, per AlphaSignal, ran past $100,000 in API fees.
Epoch AI says GLM 5.3 reliably compromised six recent Firefox releases for about $1,000 each.
Before you read on. Your call?
TRUE, BUT
$100,000
Free with your account
Sign in for this free check.
This edition’s selected free story opens after sign-in.
The twist
Every compromise also used an unpublished bug that Firefox 159.0 now patches, and there was no code execution.
There’s more to this story.
Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.
30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.
Review my 30-day free trial →- At sign-up: 30 days free. Payment card required. One introductory trial per customer.
- Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
- You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing hello@bskiller.com. This voluntary refund does not limit your rights under the Australian Consumer Law.
By starting your trial, you agree to the Terms.
Inferno Tech Pty Ltd t/a BS Killer, ABN 27 647 413 474
Get tomorrow’s check free by email.
Couldn't check your access. That's on us.
The trick has a name
We call it Lab Not Field: it works in the test conditions, not the deployed ones. You'll see it again. Learn to spot it →
Receipts
- Supports epoch.ai:
In our experiments, an open-weight model reliably exploited the "patch gap" to compromise six recent Firefox releases, costing about $1,000 each to carry out
- Supports epoch.ai:
Our marginal cost of compromising a new version of Firefox was about $1,000 at API pricing
- Context epoch.ai:
In all of our compromises of recent Firefox releases, GLM 5.3 also found and used an unpublished vulnerability in conjunction with those found via the patch gap.
- Context epoch.ai:
We do not have any code execution successes on recent Firefox releases as of writing.
- Context epoch.ai:
once we developed our harness and pointed GLM 5.3 in the right direction, exploiting the browser became cheap and reliable.
- Context epoch.ai:
We shared this vulnerability with Mozilla, and it is now patched as of the October 27 Firefox 159.0 release .
- Refutes alphasignal.ai:
Epoch spent more than $100,000 in API fees on the Firefox research, including preliminary tests and construction of a realistic offline environment.
- Context alphasignal.ai:
Same harness failed against Chrome, but stronger open models like Kimi K3.1 Pro could change that.
- Supports unite.ai:
GLM 5.3 successfully developed attacks against all six Firefox releases between September 17 and October 26, 2026
Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.
