Open GLM 5.3 model builds Firefox exploits on its own, at $1000 per version

Researchers at Epoch AI, which measures AI capabilities, have shown that the Chinese open-weights model GLM 5.3 (developed by Z.ai) can build a full attack chain against Firefox on its own, without human help. It takes 12 to 48 hours, and one successful attack costs about $1000 in API usage. The model targets the "patch gap": the window when a vulnerability fix has already been published in open source code, but the update hasn't yet reached users. The final attack works like this: a person visits a specially crafted page, which reads files on their computer and sends them to the attacker's server.

How the model found holes by reading other people's fixes

The experiment's conditions were deliberately modest. The researchers wanted to estimate what a low-skilled attacker with a limited budget could do. The model was given:

• the target Firefox version; • basic tools; • public information; • an isolated environment with no internet access; • a short instruction to study the patch gap.

After that, the model worked alone. It searched the code for upcoming security fixes, picked vulnerabilities, and built multi-stage attacks.

The first obstacle is that Firefox disguises such changes as ordinary improvements to make life harder for attackers. GLM 5.3 saw through this and still worked out which changes were security-related. In one case, it spotted a memory-handling bug from an upcoming fix and figured out how to read and modify the browser's memory.

The model then ran into Firefox's built-in layers of protection and initially failed to reach the target file. So it added several more stages to the first exploit and got past the remaining barriers. In all successful attacks on current versions, it relied on the same previously unknown vulnerability, which it rediscovered in every attempt. That hole let it escape the "sandbox", the browser's isolated environment, and read files directly from the computer.

The numbers:

• 6 Firefox versions, released between September 17 and October 26; • about $1000 in API costs per successful attack; • 12 hours for the fastest attack, with a maximum of 48; • more than 200 million active Firefox users potentially at risk, including saved passwords, authentication cookies, and personal documents.

The authors separately note that neither Z.ai nor other API providers enabled protective filters or refused the request. The task was framed as a security exercise, but in its behavior it was indistinguishable from an attempt to attack real people.

On responsible disclosure: the team reported the vulnerability to Mozilla, which fixed it in Firefox 159.0 on October 27, 2026. The authors did not test whether the same method works against the new version. They believe attacking it has become "at least noticeably harder".

Chrome held up for now, but that's no guarantee

The researchers tried the same approach on Google Chrome. They spent about $100 000 in API costs and did not get a working equivalent. The authors stress that this does not prove Chrome is invulnerable. Better ways of framing the task, or stronger models, may succeed. They point to limited test data suggesting that the recently announced Kimi K3.1 Pro may outperform GLM 5.3 on offensive tasks. They did not test it themselves.

Another warning: the problem goes beyond browsers. The patch gap exists in mobile operating systems and router firmware. Open source projects are more exposed because all their code is public, but closed-source software gets no protection from that. Anthropic has already shown that its Mythos model can exploit the patch gap in Windows without access to source code, and models are getting better at decompiling programs and finding security fixes in them on their own.

There are real-world examples too. According to the report, the patch gap was used in attacks on Chrome in September 2026. That same month, one vendor published patched PHP builds more than six hours before the coordinated patch release for two critical flaws. According to external reports, this may have led to thousands of exploitation attempts before the official release and millions right after it. The danger is greatest where users update rarely: routers and mobile systems stay vulnerable much longer.

Faster updates aren't enough: what the authors recommend

The researchers' recommendations:

• keep security fixes private until they are ready for release; • move them faster from the beta version to the stable release; • don't ship vulnerabilities that can be chained together in a single patch bundle.

Firefox and Chrome have already moved to weekly updates. But that doesn't remove the structural problem: once a fix lands in public code, it points the attacker straight at the hole. Giving defenders access to strong closed models doesn't solve it either.

After Anthropic released Claude Mythos Preview in April 2026, frontier labs restricted access to their models and launched early-access programs for defenders, including Glasswing and Daybreak. But as open models grow more powerful, offensive capabilities slip out of the control of any single "gatekeeper". The authors write that they see the results as a sign that advanced cyber capabilities are spreading. By their estimate, many other programs are probably already vulnerable to such attacks, and their number will grow as stronger open models are released.

The takeaway for engineers and vendors is simple: treat the window between publishing a fix and users updating as a period of active attack, and build patch release processes on the assumption that an AI reads every public commit.