A thousand dollars took six Firefox releases
An open-weight model read Mozilla's published security fixes and built working exploits for six consecutive Firefox releases, at about a thousand dollars each. Cloudflare put its application services in front of private origins.
How we Build
Agent backends get a private address and the firewall keeps its shape
Cloudflare made services for private origins generally available on 30 October. Point a proxied DNS record at a private address and the traffic reaches the origin over a Cloudflare One connection you already run. The origin keeps that address. It needs no inbound firewall exception, while the firewall, caching, bot management, rate limiting and Workers behave as they do for a public origin. Cloudflare names what it built this for: internal APIs, AI agent backends, MCP servers and operational tools. None of those were meant to face the internet. All of them now take requests over it, from partners, customers or agents. In the API the whole thing is one attribute. For the three private address ranges it switches on by itself and refuses to switch off.
We tell clients that what an agent can get to should be a figure somebody chose and can show you.
An agent’s reach is a number somebody designed, not a paragraph somebody wrote.
Here it is a flag and three ranges. A request either carries the private routing attribute or it does not. For RFC 1918, RFC 6598 and RFC 4193 addresses the API returns an error if you try to turn it off, so the reach is something the vendor holds rather than something a policy asserts. Argo Smart Routing and dedicated egress addresses are not supported. Health checks need the load balancer. The feature also needs an entitlement and connectivity you already operate, which makes this narrower than private origins everywhere.
How we Assure
Six consecutive Firefox releases fell to fixes Mozilla had published
Epoch AI reported on 30 October that GLM 5.3 reverse-engineered Mozilla’s published security fixes into working exploits. Z.ai released that model, open-weight, in August. It worked on all six Firefox versions shipped between 17 September and 26 October, using only what was public at each release. The result was a page that read a file off the visitor’s computer and sent it onward. The page needed no download and showed no prompt. The offline environment cost Epoch more than $100,000 to build, and each version then needed about $1,000 of compute. The model was given up to 48 hours. Its fastest run took 12. No provider’s safeguards refused any of it, Z.ai’s included.
We hold that a firm should ship compliant and change on purpose.
Ship compliant and change deliberately.
The second half of that is now partly somebody else’s to set. Firefox and Chrome each ships weekly. That is the fast end of deliberate, and Epoch built exploits inside two days. So a firm may choose a cadence, defend it, meet it, and still leave a window that someone reading its upstream’s commits can walk through. Epoch bounds this itself. Chrome did not fall at the same spend, the task was framed as a security exercise, and the authors decline to claim anything about the wider balance between attack and defence. The newest attacks also needed an unpublished flaw beside the published one, which Mozilla patched in Firefox 159.0 on 27 October. If you think the cadence still carries the decision, write to transform@dromologue.ai.