Skip to content
Neural Daily

ResearchNews

GLM 5.3 built Firefox exploits from the patch gap

🇭🇺 Olvasd el magyarul →

In an Epoch AI experiment, the open-weight GLM 5.3 autonomously built working Firefox exploit chains from security fixes that were public but not yet shipped. Each successful attack cost about $1,000 in API fees.

By: Mikola Máté Patrik · · 2 min read

Abstract illustration of staggered teal bars on a dark green background
Image: Epoch AI · CC BY · Epoch AI publication thumbnail, Epoch AI content is CC BY · Source

What Epoch AI found

The patch gap is the window when a security fix is visible in the source code but has not yet reached users. Epoch AI researchers tested whether a widely available open-weight model could exploit it (Epoch AI). It could: Z.ai's GLM 5.3, released in August, compromised every Firefox version released between September 17 and October 26 using only information available at the time of each release.

The model built a webpage that, when a Firefox user visited it, read a file from the visitor's computer and sent it to the attacker with no further interaction. Once the setup was in place, attacking each Firefox version cost about $1,000 in API fees.

How the model worked

  • The researchers deliberately emulated a low-resource, relatively unsophisticated attacker: target version, basic tools, public information, an offline environment.
  • Mozilla disguises security fixes as routine changes, yet GLM 5.3 still identified which ones were security-related.
  • It assembled multi-stage exploit chains on its own; the fastest successful attack took 12 hours out of an allowed 48.
  • In every successful attack it also rediscovered a previously unpublished vulnerability that let it escape the browser sandbox.

According to The Decoder, neither Z.ai nor other API providers triggered refusals or guardrails during the exploit work (The Decoder). The same setup spent roughly $100,000 against Chrome without an equivalent exploit, which the researchers stress does not prove Chrome is immune.

What happened next

Epoch disclosed the findings to Mozilla, and Firefox 159.0 (October 27) patches the unpublished flaw, which the researchers expect makes such attacks at least substantially harder for GLM 5.3. The lesson goes beyond Firefox: the patch gap exists in browsers, mobile operating systems and router firmware. Exploiting it used to require serious expertise or access to a frontier model; now a freely downloadable model can do much of the work.

For developers this means two things. Ship updates fast, because the time between publishing a fix and installing it can now be exploited cheaply. Open-source projects should also consider how much a security commit reveals before release.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles