Epoch AI report: Open-weight model GLM 5.3 built full Firefox exploit chains with zero human input in under 48 hours

What happened

Researchers at Epoch AI have published a report showing that the open-weight model GLM 5.3, with no human intervention, built full exploit chains against Firefox by exploiting the time gap between a security fix's publication and its delivery to users (the "patch gap"). The testing covered 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack.

Key details

• The researchers deliberately simulated what a low-skill attacker with limited resources could achieve: they supplied only the target Firefox version, basic tools, and publicly available information in an offline environment. After basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains.
• During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents.
• Firefox disguises security fixes as routine improvements to slow attackers, but GLM 5.3 identified which code changes were security-related anyway. When Firefox's security layers blocked access to a target file, the model chained the initial exploit with additional stages to bypass remaining defenses. The fastest successful attack took 12 hours, against a maximum of 48 hours granted by the researchers.
• Every successful attack on current Firefox versions relied on a previously unknown vulnerability that the model independently rediscovered in each attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer. The team disclosed its findings to Mozilla, which patched the vulnerability in Firefox 159.0, released October 27, 2026. The researchers did not confirm whether the new version is immune, but suspect the patch makes such attacks "at least substantially more difficult."
• Neither Z.ai nor other API providers triggered any safety guardrails or refusals. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users."

Why it matters

The experiment demonstrates that freely available open-weight models can now carry out end-to-end vulnerability exploitation without human assistance, at a cost of roughly $1,000 per successful attack. Once a fix appears in public code, it points attackers toward the underlying vulnerability, which is why giving defenders access to stronger closed models does not, by itself, solve the structural problem.

Using the same setup and techniques against Google Chrome, the team spent about $100,000 in API fees without producing an equivalent exploit, but the researchers caution this does not establish Chrome's immunity: better elicitation methods or more capable models might still succeed. They also cite limited benchmark data suggesting the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, though they did not test it themselves.

As the report states: "We see these results as evidence of the diffusion of advanced cyber capabilities; many other pieces of software are likely already vulnerable to similar patch-gap attacks, and we expect the number to increase as more capable open-weight models are released."

Who it affects

The patch gap is not a Firefox-only problem. According to the researchers, it exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all their code is public, but closed-source software is vulnerable too: Anthropic has already shown its Mythos model can exploit the patch gap in Windows without access to source code, and AI models are getting steadily better at decompiling compiled software to identify security fixes on their own.

The report also notes that in September 2026, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities; citing external reporting, the researchers note this early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward. Software that users update infrequently, such as router firmware and mobile operating systems, is a particular concern because most users remain exposed for much longer.

The researchers recommend keeping security fixes private until they are ready to ship, moving them from beta to general release more quickly, and avoiding patching multiple vulnerabilities simultaneously when they can be chained together. Firefox and Chrome have already begun shipping weekly updates, and frontier labs have responded with restricted access and programs like Glasswing and Daybreak that give defenders early access.

Researchers at Epoch AI show that a freely available AI model can exploit the time gap between publication and delivery of security patches to attack Firefox users. The cost per exploit is about $1,000.

The "patch gap" is the window in which a security fix is visible in the code but has not yet reached users. Researchers at Epoch AI found that the Chinese open-weight model GLM 5.3 exploited this gap across 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos.

During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents.

Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users."

The model built full exploit chains with no human input

The researchers say they deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve. They supplied the target Firefox version, basic tools, and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains.

According to the report, Firefox security fixes are disguised as routine improvements to slow down attackers. GLM 5.3 saw through the tactic and identified which code changes were security-related anyway.

In one case the model spotted a memory safety bug through an upcoming fix and developed a method to read and alter browser memory. When Firefox's security layers blocked access to the target file, the model chained the initial exploit with several additional stages to bypass the remaining defenses. The fastest successful attack took 12 hours, while the researchers gave the model a maximum of 48 hours.

Across all successful attacks on current Firefox versions, GLM 5.3 relied on a previously unknown vulnerability that the model independently rediscovered in every attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer.

The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them "at least substantially more difficult."

Using the same setup and techniques against Google Chrome, the team spent about $100,000 in API fees without producing an equivalent exploit. The researchers caution that this does not establish Chrome's immunity: better elicitation methods or more capable models might still succeed. They point to limited benchmark data suggesting that the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, although they did not test it themselves.

Every software vendor faces the same risk

The patch gap isn't a Firefox-only problem. According to the Epoch AI researchers, it exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public, but closed-source software is vulnerable too. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code, and AI models are getting steadily better at decompiling compiled software to identify security fixes on their own.

According to the report, patch-gap exploits targeted Chrome in September 2026. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities. Citing external reporting, the researchers note that this early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward.

The team is particularly concerned about software that users update infrequently, such as router firmware and mobile operating systems, because most users remain exposed for much longer.

Faster updates help but cannot close the structural gap

To reduce the risk, the researchers recommend keeping security fixes private until they are ready to ship and moving them from beta to general release more quickly. They note that Firefox and Google Chrome have already begun shipping weekly updates. They also advise developers to avoid patching multiple vulnerabilities simultaneously when those vulnerabilities can be chained together.

Giving defenders access to stronger closed models does not, by itself, solve the structural problem, the researchers argue. Once a fix appears in public code, it points attackers toward the underlying vulnerability. Anthropic's Claude Mythos Preview marked a leap in AI cyber capabilities in April 2026, and frontier labs responded with restricted access and programs like Glasswing and Daybreak that give defenders early access.

As freely available open-weight models grow more capable, offensive abilities are spreading beyond any single gatekeeper's control. As the researchers write, "We see these results as evidence of the diffusion of advanced cyber capabilities; many other pieces of software are likely already vulnerable to similar patch-gap attacks, and we expect the number to increase as more capable open-weight models are released."

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

The original belongs to The Decoder and its authors and is reproduced here for reading. To have it removed, write to support@aisa.one.