Morning digest: Firefox attacks, agents, and Reddit

Morning digest for Friday, Oct 30. Researchers at Epoch AI say GLM 5.3, a freely downloadable model, turned Firefox security fixes that hadn't reached users yet into working attacks, for about $1,000 per browser version. Also: CrowdStrike says a China-linked hacking group used AI agents to go after more than 200 organizations at once; Reddit says Google's AI search features are cutting its traffic and plans to make most of the site require logging in; Canada is putting up to C$1.6 billion into Cohere for an ownership stake; Factory released Droid 1.0, a coding agent that runs many tool steps as one small program; OpenAI rewrote the rulebook for how its models should behave; the Gemini app can now create and edit documents, PDFs, slides and spreadsheets right in the chat; Canva launched Brush, its own design-editing model; and Anthropic explained how Claude now runs a quick safety check on its own conversations.

1. An open model built working Firefox attacks from security fixes that hadn't shipped yet, Epoch AI says. Epoch AI, a research group that tracks AI progress, posted Thursday that GLM 5.3, an open-weight model from the Chinese company Zhipu AI (Z.ai), "can autonomously compromise recent versions of Mozilla Firefox." Open-weight means anyone can download the model and run it themselves. The trick is the "patch gap": Firefox's security fixes show up publicly in test builds before they reach the regular version most people use. After basic instructions to look at those not-yet-shipped fixes, Epoch says the model "reliably built successful exploits for six recent Firefox versions on its own," at about $1,000 per version. The attacks could steal saved passwords and login cookies, or read any file on your computer, after you open a single webpage. Epoch used a "deliberately basic setup" to mimic an attacker with limited resources, gave the model up to 48 hours per try, and its fastest success took 12 hours. To get all the way to reading files, the model also found and used a flaw nobody had published before. Mozilla patched that flaw in Firefox 159.0 on Oct. 27. Epoch hasn't yet confirmed whether the attack still works without it, but expects the fix "makes it substantially harder." Epoch's Jaime Sevilla summed it up as "~$1,000" per exploit. What this means for you: Update Firefox to version 159.0 or later and let browser updates install right away. The time between a fix going public and landing on your computer is now something cheap AI can exploit.

2. CrowdStrike says one China-linked hacking group used AI agents to target more than 200 organizations at once. In a report published Thursday, the security company says a group it calls VAPOR PANDA used ARTEX, a free, open-source framework for running teams of AI agents, starting Oct. 17. Over 11 days, a single control server pointed it at organizations in at least 14 countries, including foreign ministries, U.S. drug, chip, defense and nuclear companies, and phone carriers in the U.S., Belgium and the Philippines. The agents ran mainly on DeepSeek's model, plus a second paid AI service CrowdStrike couldn't identify. CrowdStrike confirmed the attackers got in and went further at nine organizations, where they installed a known backdoor (hidden remote-access software), and tried password-guessing attacks on at least 12 more. A human was still in charge: recovered logs show an operator giving instructions in Chinese at key moments, including an order to find computers without CrowdStrike's own security software installed. In one break-in, the planning agents read about 1.4 billion tokens (chunks of text). CrowdStrike calls it an escalation "from single intrusions to multiple simultaneous engagements directed by a human operator." What to watch: CrowdStrike expects China-linked groups to keep adopting tools like this over the next 12 months, letting small teams hit many targets at once. Its advice for companies starts with basics: change keys and passwords after any suspected leak, including old backups.

3. Reddit says Google's AI search is cutting its traffic, and it plans to make most of Reddit require logging in. Reddit's third-quarter results on Thursday were strong on money: revenue of $895 million, up 53% from a year earlier. But daily U.S. visitors fell 2% to 50.7 million, its first drop since going public in 2024, Reuters reports. On the earnings call, Reddit said visits from search engines fell by more than 1 million a week on average in October, and that if this continues, total daily visitors could drop by a low double-digit percentage this quarter. Reddit's main explanation is Google's AI Overviews and AI Mode, which answer questions right on the search page. "Google is crawling us as hard as ever," CEO Steve Huffman said. "The reality is, the AI mode does not drive traffic, not for us and not to anybody." Reddit's answer is to move to a logged-in-only site. Logged-in users bring in more than 80% of its ad money, Reuters reports. Shares fell 18% in after-hours trading, Reuters says. When you'll feel it: Not yet in the U.S. Reddit will start testing the logged-in-only version in some countries outside the U.S. this quarter before deciding on a wider rollout.

4. Canada is investing up to C$1.6 billion in Cohere for an ownership stake. Prime Minister Mark Carney announced Thursday that the government will make an equity investment, meaning it will own part of the company, of up to C$1.6 billion (Canadian dollars) in Cohere, the Toronto AI company that builds secure AI systems for businesses and governments. The money comes in stages. In return, Cohere will keep its headquarters and incorporation in Canada, create at least 1,000 technical jobs there by 2030, and spend at least C$1.7 billion on computing infrastructure in Canada by 2030. Canada is joining a funding round led by Germany's Schwarz Group, which owns the Lidl stores, that targets C$7 billion and would value Cohere at about C$36 billion, Reuters reports. Nvidia and Bell are also investing. What to weigh: Cohere has only completed an initial close of the round and hasn't said how much is committed. Governments owning pieces of AI labs is still rare, and this shows how much countries want AI they control at home.

5. Factory released Droid 1.0, a coding agent that writes small programs to run many steps at once. An agent "harness" is everything around the AI model: the instructions, the tools and the loop that runs them. Factory's Droid 1.0, released Thursday, makes "programmatic tool calling" the default. Instead of asking the model again after every file read or command, the model writes one short program that runs dozens or hundreds of those steps itself, so less text gets re-sent and the model sees only the results it needs. In one example from Factory's own work, moving and checking 151 project tickets took two model requests and about 61,000 tokens, compared with an estimated 36 requests and about 3.1 million tokens the usual way. Factory says that on the Terminal-Bench 4 coding test, Droid scored 3.5 points higher than OpenAI's Codex with GPT-6.1 Sol at 12% lower cost, and 3.0 to 7.6 points higher than Cursor, Claude Code and others with Claude Opus 5.5. These are Factory's own tests. It's available now as a desktop app for Mac and Windows, a terminal app and a developer kit. Try it: If long agent sessions keep hitting your usage limits, this is the approach to watch, since fewer, smaller requests mean less of your allowance used per task.

6. OpenAI rewrote its rulebook for how its models should behave. The Model Spec is OpenAI's public description of how it wants ChatGPT and its other models to act. Thursday's update reorganizes it around five values: faithfulness to what people actually intend, minimizing harm, honesty and transparency, supporting people's own choices, and care. It adds a section on considering context carefully, including past conversations and memories, plus new defaults on supporting people's own choices and following social norms, and more guidance on avoiding unwanted side effects. It also retires most of the detailed rules on writing style, and it now calls the model "GPT" instead of "the assistant." OpenAI admits "our models do not yet fully reflect it." What to watch: Whether ChatGPT's behavior actually shifts toward these values over the coming model updates, since the Spec describes a goal rather than how today's models act.

7. The Gemini app can now create and edit documents, PDFs, slides and spreadsheets right in the chat. Google said Thursday you can now generate a file in Gemini, open it full screen, type your own edits, highlight a section to ask about it, or have Gemini rewrite it. Google's example: turning photos of handwritten lecture notes into a PDF study guide you can then fix up. PDF editing works on the web and on phones. Google Docs, Google Sheets, slide decks, Markdown, plain text files and code work on the web only. Try it: It's available now to all Gemini users, in every language the app supports.

8. Canva launched Brush, its own AI model for editing designs. Canva Brush is a vision-language model, meaning it can look at your design and understand how it's put together, then make the change you ask for. Canva Research built it by starting from a leading open-weight model and training it further with reinforcement learning (learning by trial and reward). It works in a loop, writing and running code to make each edit. Canva says it's up to 69% faster and 46% cheaper per edit than its previous design agent, based on Canva's own testing. Support for Brand Kits and attached files is coming. It arrives a week after Canva's first image model, Craft. Try it: If you're on Canva Pro, open a design, go to Canva AI and pick "Brush" from the dropdown. Wider availability is "coming soon."

9. Anthropic explained how Claude quietly checks each conversation for misuse after it answers. Anthropic shared a technique it calls self-assessment: after each reply, Claude adds a short safety check of the conversation it just had. You don't see it. It catches 78% of what a much more expensive checker flags, and 94% of the highest-priority cases, while wrongly flagging only 1% of conversations. Anthropic says it adds less than 2% to its computing costs and has run across a large share of Claude traffic since June. It has turned up real abuse: in August it raised more than 100,000 child-exploitation flags from a single developer customer using its API (the connection apps use to build on Claude), which Anthropic reported to the National Center for Missing & Exploited Children, and it exposed a romance-scam operation run with Claude Code. Anthropic is upfront that it's weak as a blocker: in its own tests, using it as a filter cut attack success only from 79% to 54%, versus 25% for the more expensive checker, so it's used alongside other safeguards. It doesn't run on traffic covered by zero-data-retention agreements. What this means for you: Nothing changes in how you use Claude. Together with the model monitoring OpenAI described this week, it shows the big labs now treat watching how their models get used as a core part of the product.