Open-Weight GLM 5.3 Built Firefox Exploits Without Human Help, at About $1,000 per Working Attack

Researchers at Epoch AI have shown that GLM 5.3, a freely available Chinese model, can attack Firefox users without human involvement while security fixes have not yet reached them. The issue is the so-called "patch gap": a fix is already visible in public code, but the updated browser has not yet been installed. On six Firefox versions released between September 17 and October 26, the model built working exploits. Each successful attack cost roughly $1,000 in API calls.

How the model reached other people's files

The final exploit is a web page that, the moment it loads in Firefox, reads local files from the visitor's computer and sends them to the attacker's server. The browser has more than 200 million active users. In theory, this opened access to saved passwords, authentication cookies and personal documents.

The researchers deliberately set the experiment's conditions close to the capabilities of a low-skilled attacker on a limited budget. The model was given a Firefox version number, basic tools and public information in an offline environment, plus a general instruction to study the patch gap. From there GLM 5.3 worked on its own: it searched for upcoming fixes, picked vulnerabilities and built multi-stage chains.

According to the report, Mozilla disguises security fixes as ordinary improvements to slow attackers down. That did not stop GLM 5.3: it worked out which code changes were security-related. In one case the model spotted a memory-handling bug from an upcoming patch and devised a way to read and modify the browser's memory. When Firefox's defensive layers blocked access to the target file, it added several more stages and got around the remaining barriers.

The fastest successful attack took 12 hours; the maximum per attempt was 48. In all successful attacks on current versions, the model relied on a previously unknown vulnerability that allowed it to escape the sandbox and read files directly. It rediscovered this vulnerability in every attempt. The team reported it to Mozilla, and the hole was closed in Firefox 159.0 on October 27, 2026. The researchers did not test whether such attacks would work against the new version, but they believe the patch makes them "at least noticeably harder."

No safeguards intervened. Neither Z.ai nor other API providers enabled restrictions or refused the request, even though the authors framed the task as a security exercise. The researchers themselves say their actions were indistinguishable from those of a person targeting real users. Anthropic previously reported that GLM 5.3 writes exploits at roughly the level of Mythos.

Chrome held out for now, but that is no guarantee

The same methods did not produce a comparable result against Google Chrome, even though about $100,000 went to API costs. The authors warn that this does not prove Chrome is immune. A more skilled framing of the task or a stronger model could succeed. They mention limited benchmark data suggesting that the recently announced Kimi K3.1 Pro may outperform GLM 5.3 on offensive cyber tasks, but they did not test it themselves.

The problem is bigger than one browser

The patch gap exists in browsers, mobile operating systems and router firmware. Open-source projects are more vulnerable because all of their code is public. Closed software is at risk too: Anthropic has already shown that Mythos exploits the patch gap in Windows without access to source code, and models are getting better at decompiling programs and finding security fixes themselves.

According to the report, the patch gap was used in attacks on Chrome in September 2026. That same month, one vendor published fixed PHP builds more than six hours before the coordinated release of patches for two critical vulnerabilities. Citing outside publications, the authors write that this may have led to thousands of exploitation attempts before the official release, and millions right after it. Router firmware and mobile operating systems, which users update rarely, are at particular risk.

The researchers advise keeping fixes private until the release is ready and moving them faster from beta to the stable version. Firefox and Chrome have already switched to weekly updates. Another recommendation is not to ship patches at the same time for vulnerabilities that can be chained together. Giving defenders access to strong closed models does not solve the structural problem: a fix that appears in public code itself points to the vulnerability.

Claude Mythos Preview sharply raised the bar for AI cyber capabilities in April 2026. Labs responded with restricted access and programs such as Glasswing and Daybreak that give defenders early access. But as open models grow stronger, offensive skills are slipping out of the control of any single "gatekeeper." The authors say many other programs are probably already vulnerable to similar attacks, and the number of such cases will grow as stronger open models are released.