Epoch AI 的研究人员表明，一个免费提供的 AI 模型可以利用安全补丁发布与交付之间的时间差来攻击 Firefox 用户。每次利用漏洞的成本约为 1,000 美元。
“补丁间隙”是指安全修复代码可见但尚未到达用户手中的窗口期。Epoch AI 的研究人员发现，中国 开源权重模型 GLM 5.3 在 9 月 17 日至 10 月 26 日期间发布的 6 个 Firefox 版本中利用了这一间隙，每次成功攻击的 API 费用约为 1,000 美元。Anthropic 此前曾报道 GLM 5.3 编写漏洞利用程序的能力大致与 Mythos 相当。
在测试期间，该模型构建了一个网页，一旦 Firefox 用户加载该页面，它就能读取访问者计算机上的本地文件并将其发送到攻击者的服务器。鉴于 Firefox 拥有超过 2 亿活跃用户，攻击者可能获得对已保存密码、身份验证 Cookie 和私人文档的访问权限。
当研究人员使用 GLM 5.3 进行漏洞利用开发时，Z.ai 或其他 API 提供商均未触发任何安全护栏或拒绝响应。尽管研究人员将任务描述为安全演练，但他们称自己的行为“与试图针对真实用户的攻击者无法区分”。
模型在无人工干预的情况下构建了完整的漏洞利用链
研究人员表示，他们故意设计了自己的设置，以模拟低技能、资源有限的攻击者所能达到的效果。他们在离线环境中提供了目标 Firefox 版本、基本工具和公开可用的信息。在收到关于调查补丁间隙的基本指令后，模型自主工作，识别即将推出的安全修复程序，选择漏洞，并构建多阶段 漏洞利用链。
根据报告，Firefox 的安全修复被伪装成常规改进，以减缓攻击者的速度。GLM 5.3 识破了这一策略，并确定了哪些代码更改与安全相关。
在其中一种情况下，模型通过一项即将推出的修复程序发现了一个 内存安全错误，并开发了一种读取和修改浏览器内存的方法。当 Firefox 的安全层阻止访问目标文件时，模型将初始漏洞利用与几个额外阶段链接起来，以绕过剩余的防御措施。最快的成功攻击耗时 12 小时，而研究人员给予模型的最大时间为 48 小时。
在所有针对当前 Firefox 版本的 successful 攻击中，GLM 5.3 依赖一个以前未知的漏洞，该漏洞是模型在每次尝试中独立重新发现的，从而使其能够绕过浏览器的沙箱保护并直接从计算机读取文件。
团队向 Mozilla 披露了这些发现，Mozilla 在 2026 年 10 月 27 日发布的 Firefox 159.0 中修补了该漏洞。研究人员尚未确认类似攻击是否对新版本有效，但他们怀疑该补丁使攻击“至少变得困难得多”。
使用相同的设置和技术针对 Google Chrome，团队花费了约 100,000 美元的 API 费用，但未产生等效的漏洞利用程序。研究人员警告说，这并不能证明 Chrome 具有免疫力：更好的提示方法或更强大的模型仍可能成功。他们指出，有限的基准数据表明，最近宣布的 Kimi K3.1 Pro 在进攻性网络任务中可能优于 GLM 5.3，尽管他们自己并未对其进行测试。
每个软件供应商都面临同样的风险
补丁间隙不仅仅是 Firefox 独有的问题。根据 Epoch AI 研究人员的说法，它存在于整个软件行业，包括浏览器、移动操作系统和路由器固件中。开源项目尤其容易受到攻击，因为它们的所有代码都是公开的，但闭源软件也容易受到攻击。Anthropic 已经展示其 Mythos 模型可以在没有源代码访问权限的情况下利用 Windows 中的补丁间隙，而且 AI 模型在反编译编译后的软件以自行识别安全修复方面正变得越来越好。
根据报告，2026 年 9 月出现了针对 Chrome 的补丁间隙漏洞利用。同一个月，一家供应商在协调发布两个关键漏洞的补丁之前六个小时就发布了修补后的 PHP 构建版本。研究人员引用外部报道称，这种提前发布可能导致在官方发布之前就有数千次漏洞利用尝试，而在发布后立即增加到数百万次。
团队特别担心用户更新频率较低的软件，如路由器固件和移动操作系统，因为大多数用户会暴露更长时间。
更快的更新有助于缓解风险，但无法消除结构性差距
为了降低风险，研究人员建议将安全修复保密直到准备发布，并更快地将其从测试版推向全面发布。他们指出，Firefox 和 Google Chrome 已经开始每周推送更新。他们还建议开发人员避免同时修补多个可以链接在一起的漏洞。
研究人员认为，仅让防御者获得更强大的闭源模型的访问权限并不能解决结构性问题。一旦修复程序出现在公共代码中，它就会引导攻击者指向底层漏洞。Anthropic 的 Claude Mythos Preview 标志着 AI 网络能力的飞跃，于 2026 年 4 月推出，前沿实验室随即做出了反应，采取了限制访问措施以及像 Glasswing 和 Daybreak 这样的计划，让防御者提前获得访问权限。
随着免费提供的开源权重模型变得更加强大，进攻能力正在扩散到任何单一守门人的控制之外。正如研究人员所写：“我们将这些结果视为高级网络能力扩散的证据；许多其他软件可能已经容易受到类似的补丁间隙攻击，我们预计随着更多强大的开源权重模型的发布，这种情况的数量将会增加。”
无炒作的人工智能新闻 – 由人类策划
订阅 THE DECODER，享受无广告阅读、每周 AI 通讯、每年六次的独家“AI Radar”前沿报告、完整档案访问权限以及评论区的访问权限。
立即订阅
查看原文
Researchers at Epoch AI show that a freely available AI model can exploit the time gap between publication and delivery of security patches to attack Firefox users. The cost per exploit is about $1,000.
The "patch gap" is the window in which a security fix is visible in the code but has not yet reached users. Researchers at Epoch AI found that the Chinese open-weight model GLM 5.3 exploited this gap across 6 Firefox versions released between September 17 and October 26, at a cost of roughly $1,000 in API fees per successful attack. Anthropic had previously reported that GLM 5.3 can write exploits at roughly the same level as Mythos.
During testing, the model built a webpage that could read local files from a visitor's computer and send them to an attacker's server the moment a Firefox user loaded the page. With over 200 million active Firefox users, attackers could have gained access to saved passwords, authentication cookies, and private documents.
Neither Z.ai nor other API providers triggered any safety guardrails or refusals when the researchers used GLM 5.3 for exploit development. Although the researchers framed the task as a security exercise, they describe their actions as "indistinguishable from those of someone attempting to target real users."
The model built full exploit chains with no human input
The researchers say they deliberately designed their setup to approximate what a low-skill attacker with limited resources could achieve. They supplied the target Firefox version, basic tools, and publicly available information in an offline environment. After receiving basic instructions to investigate the patch gap, the model worked autonomously, identifying upcoming security fixes, selecting vulnerabilities, and building multi-stage exploit chains.
According to the report, Firefox security fixes are disguised as routine improvements to slow down attackers. GLM 5.3 saw through the tactic and identified which code changes were security-related anyway.
In one case the model spotted a memory safety bug through an upcoming fix and developed a method to read and alter browser memory. When Firefox's security layers blocked access to the target file, the model chained the initial exploit with several additional stages to bypass the remaining defenses. The fastest successful attack took 12 hours, while the researchers gave the model a maximum of 48 hours.
Across all successful attacks on current Firefox versions, GLM 5.3 relied on a previously unknown vulnerability that the model independently rediscovered in every attempt, allowing it to bypass the browser's sandbox protections and read files directly from the computer.
The team disclosed its findings to Mozilla, which patched that vulnerability in Firefox 159.0, released on October 27, 2026. The researchers have not confirmed whether similar attacks work against the new version, but they suspect the patch makes them "at least substantially more difficult."
Using the same setup and techniques against Google Chrome, the team spent about $100,000 in API fees without producing an equivalent exploit. The researchers caution that this does not establish Chrome's immunity: better elicitation methods or more capable models might still succeed. They point to limited benchmark data suggesting that the recently announced Kimi K3.1 Pro could outperform GLM 5.3 on offensive cyber tasks, although they did not test it themselves.
Every software vendor faces the same risk
The patch gap isn't a Firefox-only problem. According to the Epoch AI researchers, it exists across the software industry, in browsers, mobile operating systems, and router firmware. Open-source projects are especially exposed because all of their code is public, but closed-source software is vulnerable too. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code, and AI models are getting steadily better at decompiling compiled software to identify security fixes on their own.
According to the report, patch-gap exploits targeted Chrome in September 2026. That same month, a vendor released patched PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities. Citing external reporting, the researchers note that this early release could have contributed to thousands of exploit attempts before the official release, with the number rising into the millions immediately afterward.
The team is particularly concerned about software that users update infrequently, such as router firmware and mobile operating systems, because most users remain exposed for much longer.
Faster updates help but cannot close the structural gap
To reduce the risk, the researchers recommend keeping security fixes private until they are ready to ship and moving them from beta to general release more quickly. They note that Firefox and Google Chrome have already begun shipping weekly updates. They also advise developers to avoid patching multiple vulnerabilities simultaneously when those vulnerabilities can be chained together.
Giving defenders access to stronger closed models does not, by itself, solve the structural problem, the researchers argue. Once a fix appears in public code, it points attackers toward the underlying vulnerability. Anthropic's Claude Mythos Preview marked a leap in AI cyber capabilities in April 2026, and frontier labs responded with restricted access and programs like Glasswing and Daybreak that give defenders early access.
As freely available open-weight models grow more capable, offensive abilities are spreading beyond any single gatekeeper's control. As the researchers write, "We see these results as evidence of the diffusion of advanced cyber capabilities; many other pieces of software are likely already vulnerable to similar patch-gap attacks, and we expect the number to increase as more capable open-weight models are released."
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
原文版权归 The Decoder 及原作者所有，本站转载仅供阅读。如需删除，请联系 support@aisa.one。
Studio