Open-weight GLM 5.3 turned unshipped Firefox fixes into working exploits, Epoch AI finds

Open-weight model weaponized the patch gap

Epoch AI has demonstrated that GLM 5.3, an open-weight model released by Z.ai in August 2026, can exploit a long-standing weakness in software release practices: the patch gap, the window between a security fix becoming public and that fix reaching users. In experiments designed to approximate a low-skill attacker, the model was able to compromise every recent Firefox release it was tested against.

According to Epoch AI, GLM 5.3 built a webpage that, when a Firefox user visited it, pulled a file off the visitor's machine and exfiltrated it to the attacker, with no interaction required beyond loading the page. Every Firefox version released between September 17 and October 26, 2026 fell to this approach using only information that was publicly available at the time each version shipped, and each successful compromise cost roughly $1,000 in model usage.

How the attack worked

Open-source projects expose upcoming changes in beta and nightly code branches before general release. Mozilla already obfuscates security fixes, landing them as seemingly routine improvements without describing the underlying flaw, a countermeasure meant to slow would-be attackers down. Epoch AI reports that GLM 5.3 read this public code and worked out which changes were actually security patches.

The model did not rely on the patch gap alone. In every compromise of a recent Firefox release, it also discovered a previously unpublished vulnerability and chained it together with the patch-gap flaws. The researchers supplied the model with the target version, basic tooling and relevant public material, but gave it no internet access and restricted the information to whatever existed when each version was released. They accessed GLM 5.3 through Z.ai's first-party API as well as third-party providers, framed the task as a security exercise, and say the workflow was otherwise indistinguishable from that of a real attacker.

Impact and safeguards

Firefox has more than 200 million active users, and Epoch AI notes that this class of exploit could be used to read passwords stored in the browser, steal authentication cookies or pull other private files from a victim's computer. Despite that severity, the researchers say they triggered no safeguards or refusals from any provider, including Z.ai.

Chrome resisted, for now

Parallel attempts against Google Chrome had not succeeded as of publication. Epoch AI does not treat that as strong evidence of safety, noting that more aggressive elicitation or a more capable open-weight model, possibly including the recently announced Kimi K3.1 Pro, could change the outcome.

Mozilla's response

Epoch AI disclosed the findings to Mozilla before publishing. Mozilla has since shipped Firefox 159.0, released on October 27, 2026, which patches the previously undisclosed vulnerability the model had been chaining. Epoch AI says that change should make this particular attack path harder to repeat.

Why it matters

The patch gap has been a known weakness across browsers, phone operating systems and router firmware for years, but exploiting it previously demanded serious time and expertise, or special access to tightly restricted frontier models, which kept the number of capable attackers small. Epoch AI situates this result in the aftermath of Anthropic's April 2026 Claude Mythos Preview announcement, which established frontier-level cyber capability and pushed labs to restrict access while giving defenders early capability through programs such as Glasswing and Daybreak. Open-weight models sit outside those controls entirely, and this research shows the relevant capability has arrived at a price point almost anyone can afford.

Open-source projects are the most exposed because their code is public, but Epoch AI argues that any project where a model can see the content of upcoming security changes before release is at risk, closed source included. The researchers expect the threat to grow as open-weight cyber capabilities improve, while cautioning that they make no claim about the overall offense-defense balance, since unrestricted model access can also help defenders find and fix flaws first.