Epoch AI Says Open Weight GLM 5.3 Turned Unshipped Firefox Fixes Into Working Exploits

Epoch AI said in a report published on October 29, 2026 that GLM 5.3, an open weight model released by Z.ai in August, built working attacks on all six Firefox releases shipped between September 17 and October 26 by reverse engineering security fixes Mozilla had published but not yet shipped. Once the setup was in place, each successful attack cost about $1,000 in compute at API prices, the research group said.

Epoch calls that window the patch gap: the time between a fix appearing in public code, such as a beta or nightly branch, and its arrival on users' machines. The study adds to a run of AI security research showing that exploit building, until recently tied to restricted frontier models such as Anthropic's Claude Mythos Preview, is now within reach of models anyone can download.

What did GLM 5.3 do to Firefox?

GLM 5.3 built a webpage that, when opened in an affected Firefox, read a file from the visitor's computer and sent it to the attacker's server with no clicks, downloads or permission prompts, according to Epoch AI. It worked against Firefox 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, using only information public at each release.

Epoch says the model spotted which code changes were security fixes even though Mozilla disguises them as ordinary improvements. In one run it used an upcoming memory safety fix to read and modify browser memory, then added stages to get past Firefox's remaining protections, diagnosing crashes and dropping dead ends. Epoch gave each attempt up to 48 hours; the fastest success took 12 hours.

The attacks stopped short of full control: Epoch says its attempts at arbitrary code execution on recent releases had not succeeded as of writing. Still, Firefox has over 200 million active users, and a file read is enough to take saved passwords or authentication cookies, the report says.

How much human help did the model get?

Beyond a basic instruction to inspect bug fixes not yet in the stable release, GLM 5.3 ran with no human input, Epoch AI says, choosing vulnerabilities and building the exploit chain itself. The group says it designed the setup to approximate what an attacker with little technical experience could get out of the model.

The model had no internet access; Epoch supplied the public information it expected the model to need inside an isolated, monitored cloud instance. Total spend on the Firefox work exceeded $100,000 in API costs, including building the offline environment, so the $1,000 figure is the marginal cost per version.

Epoch used Z.ai's own API and third party APIs, framed the work as a security exercise, and hit no safeguards or refusals from any provider.

Why did every recent attack need a second, unknown flaw?

Each successful attack on recent Firefox versions chained a patch gap bug with a separate, unpublished vulnerability that the model rediscovered on every attempt, according to Epoch AI. The first bug gave code execution inside the browser's web content process; the second got around the sandbox that normally keeps even a compromised page away from the file system.

Epoch reported that flaw to Mozilla, and Firefox 159.0, released on October 27, 2026, patches it. Epoch expects the fix to make the attack at least substantially more difficult.

Mozilla's advisory for Firefox 159 lists 167 CVEs, 13 of them labeled sandbox escapes, and names neither Epoch AI nor any of the report's six authors as a reporter, so it is not public which entry is the flaw Epoch found. The same advisory credits 41 of the 167 to OpenAI's Codex Security tool or an OpenAI researcher.

How does this compare with earlier GLM 5.3 tests?

Epoch's result goes a step past Anthropic's analysis of the same model on September 30, 2026, in which humans guided GLM 5.3. Anthropic's Frontier Red Team said then that GLM 5.3 nearly matched Claude Mythos Preview at building exploits (The Decoder).

Test	Who ran it	Human role	Result	Reported cost or time
Unnamed browser's JavaScript engine	Anthropic	Paired with a human expert	Previously unknown bugs chained into a page that reads any file	Within a single day
Recently disclosed Chrome bug (GLM-5.3-Flash)	Anthropic	Little guidance, 20 minutes of attention	Reliable attack	$20.40, eight hours of model time
Six Firefox releases via the patch gap	Epoch AI	Basic instruction, then none	Six of six compromised (file read)	About $1,000 per version, fastest 12 hours
Google Chrome via the patch gap	Epoch AI	Same harness	No working exploit	About $100,000 in total

Epoch does not read the Chrome result as strong evidence that Chrome is safe, saying better prompting or a stronger open model could succeed. It names Moonshot AI's Kimi K3.1 Pro, with weights due in early November, as possibly stronger at offensive cyber tasks. Moonshot says it removed cyber related training data for the open weight release, which cut its in house exploit benchmark score from 90.5% to 81.0%.

Nathan Lambert, who writes the Interconnects blog, noted that an attacker still has to get victims onto a malicious site.

This is doable, and could have serious consequences, but just finding the exploit is only one step in a multi-stage process.

What does Epoch want software makers to change?

Epoch AI says vendors should shrink the patch gap by keeping security fixes private until they ship, moving fixes from beta to release faster, and not patching several chainable flaws at once. Firefox and Chrome now both ship updates every week, which Epoch says may not be fast enough when its exploits took under two days.

Closed source is no full defense either, the report argues: Anthropic has shown Mythos exploiting the patch gap on Windows by decompiling updates. Epoch has not tested open weight models on closed source software.

What we don't know yet

• Whether GLM 5.3, or a similar setup, can still compromise Firefox 159.0; Epoch has not confirmed it.
• Which of the 167 CVEs in Mozilla's Firefox 159 advisory is the sandbox flaw Epoch reported.
• Whether attackers have used patch gap exploits like these against Firefox users.