Key takeaways
- Epoch AI says GLM 5.3 built working exploits for six Firefox releases, 156.0 to 158.0.1, from fixes that were public but not yet shipped.
- Each attack cost about $1,000 in compute once set up and took up to 48 hours; the fastest took 12.
- Attacks on Chrome did not succeed, and Mozilla fixed an unpublished bug used in the newest attacks in Firefox 159.0.
Epoch AI says the open-weight model GLM 5.3 turned Mozilla's published security fixes into working Firefox exploits for about $1,000 each, before those fixes reached users. In a report published October 29, the researchers say it worked on all six Firefox releases they tested, from 156.0 to 158.0.1.
The result matters because the model is freely downloadable. Anyone who can pay for compute could in principle repeat it, which shortens the time defenders have between publishing a fix and shipping it.
What Epoch did
Epoch gave GLM 5.3, which Z.ai released in August, a setup meant to mimic an unsophisticated attacker with limited resources. The model used only what was public at each Firefox version's release, including fixes already in Mozilla's code but not yet shipped. That gap is the "patch gap."
From those fixes, the model reverse-engineered the bugs and built a web page. When a Firefox user visited it, the page read a local file and sent it to the attacker with no further action from the user. Epoch notes that could expose saved passwords and login cookies.
The numbers
- All six releases tested were compromised: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. Epoch says any version released between September 17 and October 26 could be attacked this way.
- Each attempt had up to 48 hours. The fastest successful one took 12 hours.
- Each Firefox attack cost about $1,000 at API prices once the setup existed. Total research spending, including building the environment and testing, topped $100,000.
For the newest versions, the attacks chained a patch-gap bug with a separate, unpublished one. Epoch reported it to Mozilla, which fixed it in Firefox 159.0 on October 27 (advisory mfsa2026-118). Epoch had not yet confirmed whether attacks still work on 159.0.
Where it did not work
Similar attacks on Google Chrome did not succeed, despite about $100,000 in API costs. Epoch says that is weak evidence of safety. It could mean better prompting or a stronger model would get through, and it points to Kimi K3.1 Pro, whose weights it expects in early November.
What Epoch recommends
Keep security fixes out of public code until they are ready to ship. Move fixes from beta to release faster. Avoid patching several bugs at once when they can be chained. Epoch says weekly updates, the pace Firefox and Chrome already keep, may not be fast enough.
The authors also say no model provider refused the task or triggered safeguards, because it was framed as a security exercise. They make no claim about how open-weight models will change the balance between attackers and defenders overall.
If you run Firefox, update to 159.0 or later.
Epoch's own summary is on its Gradient Updates newsletter, and the full report is linked there.
Frequently asked questions
What is a patch gap?
It is the time between a security fix becoming visible in public code and that fix reaching users in a shipped update. Attackers can study the fix to find the bug it repairs during that time.
Did the GLM 5.3 attack work on Chrome?
No. Epoch says similar attacks on Chrome did not succeed despite about $100,000 in API costs, but it says this does not prove Chrome is safe from better models or prompts.
Which Firefox version fixes the bug?
Mozilla patched the unpublished vulnerability in Firefox 159.0, released October 27, 2026, in advisory mfsa2026-118.