Start free trial

TRUE, BUTLab Not Field

$1,000 each, after $100,000+ in fees

That is the cost per version after a build that, per AlphaSignal, ran past $100,000 in API fees.

“An open-weight model reliably exploited the patch gap to compromise six recent Firefox releases, costing about $1,000 each to carry out.”

Epoch AI, report on open-weight models and the patch gap (epoch.ai, 29 October 2026)

Recorded 30 October 2026. Our ruling means: literally true, materially misleading.

Read the story →

Receipts pack

The evidence file for this verdict

9 receipts: 3 support the claim, 1 contradict it, 5 add context. 4 figures on the record, 3 traced to a quoted receipt.

The receipts

Each source, the line we quote from it, its date and which way it cuts. Free to read and to cite.

  1. 1Supports the claimepoch.ai ↗

    In our experiments, an open-weight model reliably exploited the "patch gap" to compromise six recent Firefox releases, costing about $1,000 each to carry out

    Look up an archived copy ↗

  2. 2Supports the claimepoch.ai ↗

    Our marginal cost of compromising a new version of Firefox was about $1,000 at API pricing

    Look up an archived copy ↗

  3. 3Contextepoch.ai ↗

    In all of our compromises of recent Firefox releases, GLM 5.3 also found and used an unpublished vulnerability in conjunction with those found via the patch gap.

    Look up an archived copy ↗

  4. 4Contextepoch.ai ↗

    We do not have any code execution successes on recent Firefox releases as of writing.

    Look up an archived copy ↗

  5. 5Contextepoch.ai ↗

    once we developed our harness and pointed GLM 5.3 in the right direction, exploiting the browser became cheap and reliable.

    Look up an archived copy ↗

  6. 6Contextepoch.ai ↗

    We shared this vulnerability with Mozilla, and it is now patched as of the October 27 Firefox 159.0 release .

    Look up an archived copy ↗

  7. 7Contradicts the claimalphasignal.ai ↗

    Epoch spent more than $100,000 in API fees on the Firefox research, including preliminary tests and construction of a realistic offline environment.

    Look up an archived copy ↗

  8. 8Contextalphasignal.ai ↗

    Same harness failed against Chrome, but stronger open models like Kimi K3.1 Pro could change that.

    Look up an archived copy ↗

  9. 9Supports the claimunite.ai ↗

    GLM 5.3 successfully developed attacks against all six Firefox releases between September 17 and October 26, 2026

    Look up an archived copy ↗

Members' extras

What each receipt proves, and what would change our mind.

  • What each receipt above proves, in our words
  • The figures table, each number traced to the receipt that states it
  • The trick behind the claim, explained, with the guide to spotting it
  • What would change our verdict
  • Our call on the record, with its due date

The verdict, the opening and every receipt above stay free. Membership adds our analysis to the evidence file for every checked story.

See Membership →Already a member? Sign in →

First membership: 30 days free, then A$89 a year. One introductory trial per customer. Card required; renews annually until cancelled. Cancel before the trial ends to avoid the first charge.