Epoch AI: open-weight GLM 5.3 built working Firefox exploits from security fixes that had not shipped yet, for about $1,000 each

An open-weight model can now turn browser security fixes that are public but not yet shipped into working exploits on its own, according to a report Epoch AI published October 29. Epoch says Z.ai's GLM 5.3 built a webpage that read a file off a Firefox user's computer and sent it to the attacker, with no interaction beyond opening the page, against all six Firefox releases from September 17 to October 26. We read the report directly.

THE PATCH GAP

The patch gap is the window between a security fix becoming public, in beta or nightly code, and that fix reaching ordinary users. Epoch says exploiting it used to take significant human time and skill, or access to restricted frontier models. Fixes are disguised as ordinary changes, but per Epoch, GLM 5.3 read the code and worked out which ones were security fixes.

WHAT EPOCH FOUND

- Six Firefox versions compromised: 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1, each using only information available when it shipped. - About $1,000 in API costs per version once the harness was built. Epoch's total research spend on Firefox topped $100,000. - Up to 48 hours per attempt. The fastest took 12. - No refusals and no safeguards triggered at any provider, including Z.ai. Epoch framed the task as a security exercise and called GLM 5.3 through Z.ai's own API and third-party APIs. - Every success chained two bugs: a patch-gap flaw for a foothold inside the browser's web content process, plus a previously unpublished sandbox escape that the model rediscovered on each attempt. - The model had no internet access. Epoch supplied the public information offline.

WHAT MOZILLA DID

Epoch says it disclosed the sandbox escape to Mozilla, which patched it in Firefox 159.0 on October 27. Mozilla's advisory for Firefox 159 lists several high-impact sandbox escapes, and Epoch does not say which one is its finding. Epoch has not yet tested whether the attack still works on 159.0, but expects the fix makes it substantially harder.

WHAT DID NOT WORK

- The same harness has not produced an equivalent Chrome exploit, after about $100,000 of attempts. - File reads only: Epoch reports no arbitrary code execution on recent Firefox releases.

WHAT WE DO NOT KNOW

How stronger open models would do. Epoch did not test Kimi K3.1 Pro, which it says limited benchmark data suggests may beat GLM 5.3 on offensive cyber tasks, and it did not test closed-source software. Epoch's results have not been reproduced independently.