Epoch AI: open-weight GLM 5.3 exploited the patch gap to compromise six Firefox releases on its own
In a report published on 29 October 2026, Epoch AI says GLM 5.3, an open-weight model released by Z.ai in August, autonomously used the “patch gap” between published fixes and shipped updates to compromise all six Firefox releases from 17 September to 26 October, at about $1,000 per version and without triggering any provider’s safeguards. Mozilla fixed a key previously undisclosed bug in Firefox 159.0 on 27 October.
Epoch AI researchers tasked GLM 5.3 with building, for a given Firefox version, a webpage that reads a file from a visitor’s computer and sends it to the attacker with no further interaction. Every one of the six Firefox releases shipped between 17 September and 26 October was compromised, using only information available when each version was released. Epoch says such an exploit could be used to read passwords stored in the browser or steal authentication cookies.
The setup deliberately emulated a low-skill attacker with limited resources: researchers supplied the target version, basic tools and the public information it would need, with no internet access. Once set up, the model identified which code changes were security fixes disguised as ordinary improvements, selected vulnerabilities and chained multiple stages into a full exploit. Each attempt had up to 48 hours; the fastest took 12, and each version cost about $1,000 to attack once set up. Epoch says it framed the work as a security exercise and triggered no safeguards or refusals from any provider, including Z.ai.
An important caveat: in its compromises of the latest releases, GLM 5.3 also found and used an unpublished vulnerability. Epoch disclosed it to Mozilla, which patched it in Firefox 159.0 on 27 October; Epoch expects this to make such patch-gap attacks harder but does not say it has verified that 159.0 blocks them entirely. Similar attacks on Chrome had not succeeded at the time of writing, which Epoch says is not strong evidence that better elicitation or more capable open-weight models would fail.