Epoch AI: open-weight GLM 5.3 turned unshipped Firefox fixes into working exploits

Epoch AI published a report on 29 October showing that GLM 5.3, the open-weight model Z.ai released in August, can exploit the “patch gap” in Firefox. That is the window between a security fix appearing in public code and the fixed version reaching users.

What Epoch did

Epoch asked GLM 5.3 to build a webpage that, when a Firefox user visits it, reads a file from the visitor’s computer and sends it to the attacker. It gave the model the target Firefox version, basic tools and only the public information that existed when that version was released. The model had no internet access, and beyond being told to look at fixes not yet in the stable release, it ran without human input.

Epoch says GLM 5.3:

• Built a working zero-click file-reading exploit for all six Firefox releases between 17 September and 26 October.
• Worked out which recent code changes were security fixes, even though Mozilla disguises them as ordinary improvements.
• Also rediscovered and used an unpublished vulnerability in every one of those attacks. Epoch reported it to Mozilla, and it was fixed in Firefox 159.0 on 27 October.
• Needed up to 48 hours per attempt, with the fastest success in 12 hours.
• Cost about $1,000 per Firefox version at API prices once the harness was built. Epoch’s total spend on the Firefox work was over $100,000.
• Triggered no safeguards or refusals from any provider, including Z.ai’s own API, although the task was framed only as a security exercise.

Epoch tried the same setup against Google Chrome and, after about $100,000 of API costs, has not produced an equivalent exploit. It says that is not strong evidence Chrome is safe from a stronger model or better prompting. It has not yet tested whether the attack still works on Firefox 159.0, but expects the fix to make it “at least substantially more difficult”.

Where this fits

This is the third independent look at GLM 5.3’s cyber skills this month. Anthropic said in early October that it nears Mythos on exploit benchmarks, and Irregular found it completed 3 of 13 simulated cyberattacks. Epoch’s test is narrower but more concrete: real browser releases, a real attack goal, and a dollar figure per version.

Epoch’s recommendation for software makers is to keep security fixes private until they ship, or to ship them from beta to release faster, and to avoid publishing several fixes at once when they can be chained. Firefox and Chrome have both moved to weekly updates.

Why this matters

For anyone running browsers or shipping software, the practical lesson is that “fixed upstream” is no longer safe for long. If a model anyone can download can turn a public patch into an exploit in about 12 to 48 hours for around $1,000, then auto-update and short rollout windows matter more than ever, for browsers on your team’s machines and for the open-source dependencies you ship. Epoch also notes that rarely updated software such as router firmware and phone systems is the bigger worry, because the gap there lasts much longer.